Edit tour

Windows Analysis Report
l1QC9H0SNR.exe

Overview

General Information

Sample name:	l1QC9H0SNR.exe renamed because original name is a hash value
Original sample name:	c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
Analysis ID:	1588244
MD5:	be20dfffcba37064d6087aa714036873
SHA1:	4f50f7f954ed27b8e3373a5d900905d98d1bb51e
SHA256:	c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0
Tags:	exeRemcosRATuser-adrian__luca
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Drops VBS files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to execute programs as a different user

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

l1QC9H0SNR.exe (PID: 5912 cmdline: "C:\Users\user\Desktop\l1QC9H0SNR.exe" MD5: BE20DFFFCBA37064D6087AA714036873)

Milburr.exe (PID: 3652 cmdline: "C:\Users\user\Desktop\l1QC9H0SNR.exe" MD5: BE20DFFFCBA37064D6087AA714036873)

wscript.exe (PID: 4156 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

Milburr.exe (PID: 364 cmdline: "C:\Users\user\AppData\Local\obtenebrate\Milburr.exe" MD5: BE20DFFFCBA37064D6087AA714036873)

Milburr.exe (PID: 5160 cmdline: "C:\Users\user\AppData\Local\obtenebrate\Milburr.exe" MD5: BE20DFFFCBA37064D6087AA714036873)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["192.210.150.26:3678:0"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-MKYDDH", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": ""}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4575991012.0000000003E6F000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.2281153273.000000000151B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.2281175297.0000000001557000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
00000002.00000002.4573965402.0000000001187000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
00000002.00000002.4573167433.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
Process Memory Space: Milburr.exe PID: 3652	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Milburr.exe PID: 3652	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Milburr.exe PID: 3652	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Milburr.exe PID: 3652	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x109675:$a1: Remcos restarted by watchdog! 0x1d967a:$a1: Remcos restarted by watchdog! 0x109bd2:$a3: %02i:%02i:%02i:%03i 0x109f8a:$a3: %02i:%02i:%02i:%03i 0x1d9bd7:$a3: %02i:%02i:%02i:%03i 0x1d9f8f:$a3: %02i:%02i:%02i:%03i
Process Memory Space: Milburr.exe PID: 364	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Milburr.exe PID: 364	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Milburr.exe PID: 364	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Milburr.exe PID: 364	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xe1a88:$a1: Remcos restarted by watchdog! 0xe1fe5:$a3: %02i:%02i:%02i:%03i 0xe239d:$a3: %02i:%02i:%02i:%03i
Process Memory Space: Milburr.exe PID: 5160	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Milburr.exe PID: 5160	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Milburr.exe PID: 5160	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Milburr.exe PID: 5160	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x54e0c:$a1: Remcos restarted by watchdog! 0x123392:$a1: Remcos restarted by watchdog! 0x55369:$a3: %02i:%02i:%02i:%03i 0x55721:$a3: %02i:%02i:%02i:%03i 0x1238ef:$a3: %02i:%02i:%02i:%03i 0x123ca7:$a3: %02i:%02i:%02i:%03i
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.Milburr.exe.400000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.Milburr.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.Milburr.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.Milburr.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
2.2.Milburr.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
2.2.Milburr.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
2.2.Milburr.exe.3630000.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.Milburr.exe.3630000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.Milburr.exe.3630000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.Milburr.exe.3630000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x69ef8:$a1: Remcos restarted by watchdog! 0x6a470:$a3: %02i:%02i:%02i:%03i
2.2.Milburr.exe.3630000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x64194:$str_a1: C:\Windows\System32\cmd.exe 0x64110:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64110:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x64c10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64204:$str_b2: Executing file: 0x6503c:$str_b3: GetDirectListeningPort 0x64a00:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x64b80:$str_b7: \update.vbs 0x6422c:$str_b9: Downloaded file: 0x64218:$str_b10: Downloading file: 0x642bc:$str_b12: Failed to upload file: 0x65004:$str_b13: StartForward 0x65024:$str_b14: StopForward 0x64ad8:$str_b15: fso.DeleteFile " 0x64a6c:$str_b16: On Error Resume Next 0x64b08:$str_b17: fso.DeleteFolder " 0x642ac:$str_b18: Uploaded file: 0x6426c:$str_b19: Unable to delete: 0x64aa0:$str_b20: while fso.FileExists(" 0x64749:$str_c0: [Firefox StoredLogins not found]
2.2.Milburr.exe.3630000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64080:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64010:$s1: CoGetObject 0x64024:$s1: CoGetObject 0x64040:$s1: CoGetObject 0x6dc70:$s1: CoGetObject 0x63fd0:$s2: Elevation:Administrator!new:
4.2.Milburr.exe.3280000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.2.Milburr.exe.3280000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
4.2.Milburr.exe.3280000.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.Milburr.exe.3280000.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x69ef8:$a1: Remcos restarted by watchdog! 0x6a470:$a3: %02i:%02i:%02i:%03i
4.2.Milburr.exe.3280000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x64194:$str_a1: C:\Windows\System32\cmd.exe 0x64110:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64110:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x64c10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64204:$str_b2: Executing file: 0x6503c:$str_b3: GetDirectListeningPort 0x64a00:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x64b80:$str_b7: \update.vbs 0x6422c:$str_b9: Downloaded file: 0x64218:$str_b10: Downloading file: 0x642bc:$str_b12: Failed to upload file: 0x65004:$str_b13: StartForward 0x65024:$str_b14: StopForward 0x64ad8:$str_b15: fso.DeleteFile " 0x64a6c:$str_b16: On Error Resume Next 0x64b08:$str_b17: fso.DeleteFolder " 0x642ac:$str_b18: Uploaded file: 0x6426c:$str_b19: Unable to delete: 0x64aa0:$str_b20: while fso.FileExists(" 0x64749:$str_c0: [Firefox StoredLogins not found]
4.2.Milburr.exe.3280000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64080:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64010:$s1: CoGetObject 0x64024:$s1: CoGetObject 0x64040:$s1: CoGetObject 0x6dc70:$s1: CoGetObject 0x63fd0:$s2: Elevation:Administrator!new:
5.2.Milburr.exe.3d80000.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.Milburr.exe.3d80000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.Milburr.exe.3d80000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.Milburr.exe.3d80000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x69ef8:$a1: Remcos restarted by watchdog! 0x6a470:$a3: %02i:%02i:%02i:%03i
5.2.Milburr.exe.3d80000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x64194:$str_a1: C:\Windows\System32\cmd.exe 0x64110:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64110:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x64c10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64204:$str_b2: Executing file: 0x6503c:$str_b3: GetDirectListeningPort 0x64a00:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x64b80:$str_b7: \update.vbs 0x6422c:$str_b9: Downloaded file: 0x64218:$str_b10: Downloading file: 0x642bc:$str_b12: Failed to upload file: 0x65004:$str_b13: StartForward 0x65024:$str_b14: StopForward 0x64ad8:$str_b15: fso.DeleteFile " 0x64a6c:$str_b16: On Error Resume Next 0x64b08:$str_b17: fso.DeleteFolder " 0x642ac:$str_b18: Uploaded file: 0x6426c:$str_b19: Unable to delete: 0x64aa0:$str_b20: while fso.FileExists(" 0x64749:$str_c0: [Firefox StoredLogins not found]
5.2.Milburr.exe.3d80000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64080:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64010:$s1: CoGetObject 0x64024:$s1: CoGetObject 0x64040:$s1: CoGetObject 0x6dc70:$s1: CoGetObject 0x63fd0:$s2: Elevation:Administrator!new:
2.2.Milburr.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.Milburr.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.Milburr.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.Milburr.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
2.2.Milburr.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
2.2.Milburr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
5.2.Milburr.exe.400000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.Milburr.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.Milburr.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.Milburr.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
5.2.Milburr.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
5.2.Milburr.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
4.2.Milburr.exe.3280000.1.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.2.Milburr.exe.3280000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
4.2.Milburr.exe.3280000.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.Milburr.exe.3280000.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
4.2.Milburr.exe.3280000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
4.2.Milburr.exe.3280000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
5.2.Milburr.exe.3d80000.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.Milburr.exe.3d80000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.Milburr.exe.3d80000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.Milburr.exe.3d80000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
5.2.Milburr.exe.3d80000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
5.2.Milburr.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.Milburr.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.Milburr.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.Milburr.exe.3d80000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
5.2.Milburr.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
5.2.Milburr.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
5.2.Milburr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
2.2.Milburr.exe.3630000.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.Milburr.exe.3630000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.Milburr.exe.3630000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.Milburr.exe.3630000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
2.2.Milburr.exe.3630000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
2.2.Milburr.exe.3630000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
Click to see the 55 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs" , ProcessId: 4156, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs" , ProcessId: 4156, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe, ProcessId: 3652, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe, ProcessId: 3652, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

ET MALWARE Remcos 3.x Unencrypted Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:00:29.468941+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49709	192.210.150.26	3678	TCP
2025-01-10T23:00:31.947273+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49711	192.210.150.26	3678	TCP
2025-01-10T23:00:34.368796+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49713	192.210.150.26	3678	TCP
2025-01-10T23:00:37.665119+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49724	192.210.150.26	3678	TCP
2025-01-10T23:00:40.092206+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49741	192.210.150.26	3678	TCP
2025-01-10T23:00:42.521701+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49761	192.210.150.26	3678	TCP
2025-01-10T23:00:44.952021+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49779	192.210.150.26	3678	TCP
2025-01-10T23:00:47.369791+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49798	192.210.150.26	3678	TCP
2025-01-10T23:00:49.806042+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49814	192.210.150.26	3678	TCP
2025-01-10T23:00:52.275053+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49829	192.210.150.26	3678	TCP
2025-01-10T23:00:54.728155+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49842	192.210.150.26	3678	TCP
2025-01-10T23:00:57.198302+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49858	192.210.150.26	3678	TCP
2025-01-10T23:00:59.634762+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49877	192.210.150.26	3678	TCP
2025-01-10T23:01:02.055857+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49893	192.210.150.26	3678	TCP
2025-01-10T23:01:04.527659+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49908	192.210.150.26	3678	TCP
2025-01-10T23:01:07.009273+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49921	192.210.150.26	3678	TCP
2025-01-10T23:01:09.462163+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49937	192.210.150.26	3678	TCP
2025-01-10T23:01:12.012999+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49955	192.210.150.26	3678	TCP
2025-01-10T23:01:14.448056+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49971	192.210.150.26	3678	TCP
2025-01-10T23:01:16.946591+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49988	192.210.150.26	3678	TCP
2025-01-10T23:01:19.371772+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50005	192.210.150.26	3678	TCP
2025-01-10T23:01:21.821959+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50006	192.210.150.26	3678	TCP
2025-01-10T23:01:24.243694+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50008	192.210.150.26	3678	TCP
2025-01-10T23:01:26.665361+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50009	192.210.150.26	3678	TCP
2025-01-10T23:01:29.106561+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50010	192.210.150.26	3678	TCP
2025-01-10T23:01:31.524979+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50011	192.210.150.26	3678	TCP
2025-01-10T23:01:33.977695+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50012	192.210.150.26	3678	TCP
2025-01-10T23:01:36.400509+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50013	192.210.150.26	3678	TCP
2025-01-10T23:01:38.826379+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50015	192.210.150.26	3678	TCP
2025-01-10T23:01:41.259088+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50016	192.210.150.26	3678	TCP
2025-01-10T23:01:43.680924+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50017	192.210.150.26	3678	TCP
2025-01-10T23:01:46.668953+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50018	192.210.150.26	3678	TCP
2025-01-10T23:01:49.087251+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50020	192.210.150.26	3678	TCP
2025-01-10T23:01:51.493566+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50021	192.210.150.26	3678	TCP
2025-01-10T23:01:53.986539+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50022	192.210.150.26	3678	TCP
2025-01-10T23:01:56.326471+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50023	192.210.150.26	3678	TCP
2025-01-10T23:01:58.634713+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50024	192.210.150.26	3678	TCP
2025-01-10T23:02:00.946791+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50025	192.210.150.26	3678	TCP
2025-01-10T23:02:03.181016+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50026	192.210.150.26	3678	TCP
2025-01-10T23:02:05.383980+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50028	192.210.150.26	3678	TCP
2025-01-10T23:02:07.571463+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50029	192.210.150.26	3678	TCP
2025-01-10T23:02:09.775046+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50030	192.210.150.26	3678	TCP
2025-01-10T23:02:11.931129+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50031	192.210.150.26	3678	TCP
2025-01-10T23:02:14.064052+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50032	192.210.150.26	3678	TCP
2025-01-10T23:02:16.138451+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50033	192.210.150.26	3678	TCP
2025-01-10T23:02:18.212413+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50034	192.210.150.26	3678	TCP
2025-01-10T23:02:20.276370+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50035	192.210.150.26	3678	TCP
2025-01-10T23:02:22.326515+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50036	192.210.150.26	3678	TCP
2025-01-10T23:02:24.368630+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50037	192.210.150.26	3678	TCP
2025-01-10T23:02:26.382539+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50038	192.210.150.26	3678	TCP
2025-01-10T23:02:28.430823+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50039	192.210.150.26	3678	TCP
2025-01-10T23:02:30.388017+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50040	192.210.150.26	3678	TCP
2025-01-10T23:02:32.382612+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50041	192.210.150.26	3678	TCP
2025-01-10T23:02:34.322505+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50043	192.210.150.26	3678	TCP
2025-01-10T23:02:36.212518+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50044	192.210.150.26	3678	TCP
2025-01-10T23:02:38.090796+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50045	192.210.150.26	3678	TCP
2025-01-10T23:02:39.993563+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50046	192.210.150.26	3678	TCP
2025-01-10T23:02:41.950190+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50047	192.210.150.26	3678	TCP
2025-01-10T23:02:43.775780+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50048	192.210.150.26	3678	TCP
2025-01-10T23:02:45.603130+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50049	192.210.150.26	3678	TCP
2025-01-10T23:02:47.431543+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50050	192.210.150.26	3678	TCP
2025-01-10T23:02:49.244013+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50051	192.210.150.26	3678	TCP
2025-01-10T23:02:51.337478+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50052	192.210.150.26	3678	TCP
2025-01-10T23:02:53.118512+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50053	192.210.150.26	3678	TCP
2025-01-10T23:02:54.884158+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50054	192.210.150.26	3678	TCP
2025-01-10T23:02:56.659605+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50055	192.210.150.26	3678	TCP
2025-01-10T23:02:58.430966+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50056	192.210.150.26	3678	TCP
2025-01-10T23:03:00.165763+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50057	192.210.150.26	3678	TCP
2025-01-10T23:03:01.884055+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50058	192.210.150.26	3678	TCP
2025-01-10T23:03:03.604295+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50059	192.210.150.26	3678	TCP
2025-01-10T23:03:05.306266+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50060	192.210.150.26	3678	TCP
2025-01-10T23:03:06.993987+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50061	192.210.150.26	3678	TCP
2025-01-10T23:03:08.696361+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50062	192.210.150.26	3678	TCP
2025-01-10T23:03:10.386485+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50064	192.210.150.26	3678	TCP
2025-01-10T23:03:12.072832+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50066	192.210.150.26	3678	TCP
2025-01-10T23:03:13.729115+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50067	192.210.150.26	3678	TCP
2025-01-10T23:03:15.384777+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50068	192.210.150.26	3678	TCP
2025-01-10T23:03:17.103031+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50069	192.210.150.26	3678	TCP
2025-01-10T23:03:18.750328+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50070	192.210.150.26	3678	TCP
2025-01-10T23:03:20.402437+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50071	192.210.150.26	3678	TCP
2025-01-10T23:03:22.025051+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50072	192.210.150.26	3678	TCP
2025-01-10T23:03:23.635600+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50073	192.210.150.26	3678	TCP
2025-01-10T23:03:25.296460+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50074	192.210.150.26	3678	TCP
2025-01-10T23:03:26.915958+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50075	192.210.150.26	3678	TCP
2025-01-10T23:03:28.509428+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50076	192.210.150.26	3678	TCP
2025-01-10T23:03:30.103290+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50077	192.210.150.26	3678	TCP
2025-01-10T23:03:31.665583+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50078	192.210.150.26	3678	TCP
2025-01-10T23:03:33.306634+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50079	192.210.150.26	3678	TCP
2025-01-10T23:03:34.870987+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50080	192.210.150.26	3678	TCP
2025-01-10T23:03:36.432271+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50081	192.210.150.26	3678	TCP
2025-01-10T23:03:38.151695+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50082	192.210.150.26	3678	TCP
2025-01-10T23:03:39.712526+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50083	192.210.150.26	3678	TCP
2025-01-10T23:03:41.428858+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50084	192.210.150.26	3678	TCP
2025-01-10T23:03:42.977891+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50085	192.210.150.26	3678	TCP
2025-01-10T23:03:44.509043+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50086	192.210.150.26	3678	TCP
2025-01-10T23:03:46.071726+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50087	192.210.150.26	3678	TCP
2025-01-10T23:03:47.618682+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50088	192.210.150.26	3678	TCP
2025-01-10T23:03:49.149727+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50089	192.210.150.26	3678	TCP
2025-01-10T23:03:50.697206+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50090	192.210.150.26	3678	TCP
2025-01-10T23:03:52.228002+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50091	192.210.150.26	3678	TCP
2025-01-10T23:03:53.790232+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50092	192.210.150.26	3678	TCP
2025-01-10T23:03:55.337388+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50093	192.210.150.26	3678	TCP
2025-01-10T23:03:56.855743+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50094	192.210.150.26	3678	TCP
2025-01-10T23:03:58.400066+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50095	192.210.150.26	3678	TCP
2025-01-10T23:03:59.954954+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50096	192.210.150.26	3678	TCP
2025-01-10T23:04:01.478076+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50097	192.210.150.26	3678	TCP
2025-01-10T23:04:02.978913+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50098	192.210.150.26	3678	TCP
2025-01-10T23:04:04.463825+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50100	192.210.150.26	3678	TCP
2025-01-10T23:04:05.962236+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50101	192.210.150.26	3678	TCP
2025-01-10T23:04:07.478773+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50102	192.210.150.26	3678	TCP
2025-01-10T23:04:08.977665+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50103	192.210.150.26	3678	TCP
2025-01-10T23:04:10.447012+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50104	192.210.150.26	3678	TCP
2025-01-10T23:04:11.930882+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50105	192.210.150.26	3678	TCP
2025-01-10T23:04:13.400548+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50106	192.210.150.26	3678	TCP
2025-01-10T23:04:14.884448+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50107	192.210.150.26	3678	TCP
2025-01-10T23:04:16.369010+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50108	192.210.150.26	3678	TCP
2025-01-10T23:04:17.854766+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50109	192.210.150.26	3678	TCP
2025-01-10T23:04:19.400123+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50110	192.210.150.26	3678	TCP
2025-01-10T23:04:20.902762+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50111	192.210.150.26	3678	TCP
2025-01-10T23:04:22.384249+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50112	192.210.150.26	3678	TCP
2025-01-10T23:04:23.853477+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50113	192.210.150.26	3678	TCP
2025-01-10T23:04:25.321961+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50114	192.210.150.26	3678	TCP
2025-01-10T23:04:26.790484+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50115	192.210.150.26	3678	TCP
2025-01-10T23:04:28.259264+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50116	192.210.150.26	3678	TCP
2025-01-10T23:04:29.776044+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50117	192.210.150.26	3678	TCP
2025-01-10T23:04:31.305922+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50118	192.210.150.26	3678	TCP
2025-01-10T23:04:34.072096+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	50119	192.210.150.26	3678	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000005.00000002.2281175297.0000000001557000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["192.210.150.26:3678:0"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-MKYDDH", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": ""}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: l1QC9H0SNR.exe	Virustotal: Detection: 68%			Perma Link
Source: l1QC9H0SNR.exe	ReversingLabs: Detection: 75%

Yara detected Remcos RAT

Source: Yara match	File source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4575991012.0000000003E6F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281153273.000000000151B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281175297.0000000001557000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573965402.0000000001187000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573167433.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 5160, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: l1QC9H0SNR.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		2_2_0043293A
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		5_2_0043293A

Source: Milburr.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 5160, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00406764 _wcslen,CoGetObject,		2_2_00406764
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00406764 _wcslen,CoGetObject,		5_2_00406764

Source: l1QC9H0SNR.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BB445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BB445A
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBC6D1 FindFirstFileW,FindClose,	0_2_00BBC6D1
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00BBC75C
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BBEF95
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BBF0F2
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BBF3F3
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BB37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BB37EF
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BB3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BB3B12
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BBBCBC
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040B335
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	2_2_0041B42F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040B53A
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0044D5E9 FindFirstFileExA,	2_2_0044D5E9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	2_2_004089A9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00406AC2 FindFirstFileW,FindNextFileW,	2_2_00406AC2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	2_2_00407A8C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00418C69
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	2_2_00408DA7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0072445A
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072C6D1 FindFirstFileW,FindClose,	2_2_0072C6D1
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0072C75C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0072EF95
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0072F0F2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0072F3F3
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_007237EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_007237EF
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00723B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00723B12
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0072BCBC
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	5_2_0040B335
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	5_2_0041B42F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	5_2_0040B53A
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0044D5E9 FindFirstFileExA,	5_2_0044D5E9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	5_2_004089A9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00406AC2 FindFirstFileW,FindNextFileW,	5_2_00406AC2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	5_2_00407A8C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	5_2_00418C69
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	5_2_00408DA7

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Code function: 2_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00406F06

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49713 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49709 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49761 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49741 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49711 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49779 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49814 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49798 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49829 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49724 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49842 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49858 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49877 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49893 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49908 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49921 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49937 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49955 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49971 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49988 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50005 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50006 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50013 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50008 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50009 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50010 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50015 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50017 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50018 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50016 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50020 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50021 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50022 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50011 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50023 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50026 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50029 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50031 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50012 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50034 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50033 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50032 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50030 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50036 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50037 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50025 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50038 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50024 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50039 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50041 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50035 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50040 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50043 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50045 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50044 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50028 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50046 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50049 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50047 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50050 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50051 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50048 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50052 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50054 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50055 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50058 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50053 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50056 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50060 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50059 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50064 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50062 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50057 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50061 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50073 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50067 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50076 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50070 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50078 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50079 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50082 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50084 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50085 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50080 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50088 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50087 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50089 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50068 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50086 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50092 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50083 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50066 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50093 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50098 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50090 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50095 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50074 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50097 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50100 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50104 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50103 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50105 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50094 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50069 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50108 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50109 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50101 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50091 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50077 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50071 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50113 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50106 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50114 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50107 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50112 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50117 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50075 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50116 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50072 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50111 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50118 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50096 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50119 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50110 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50115 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50102 -> 192.210.150.26:3678
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:50081 -> 192.210.150.26:3678

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 192.210.150.26

Source: Joe Sandbox View

IP Address: 192.210.150.26 192.210.150.26

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BC22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00BC22EE

Source: Milburr.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: Milburr.exe, 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Milburr.exe, 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Milburr.exe, 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, Milburr.exe, 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Milburr.exe, 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Code function: 2_2_004099E4 SetWindowsHookExA 0000000D,004099D0,00000000

2_2_004099E4

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BC4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00BC4164

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BC4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_00BC4164
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	2_2_004159C6
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00734164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_00734164
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	5_2_004159C6

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BC3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00BC3F66

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BB001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00BB001C

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDCABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_00BDCABC
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		2_2_0074CABC

Source: Yara match	File source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 5160, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4575991012.0000000003E6F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281153273.000000000151B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281175297.0000000001557000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573965402.0000000001187000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573167433.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 5160, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0041BB77 SystemParametersInfoW,		2_2_0041BB77
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0041BB77 SystemParametersInfoW,		5_2_0041BB77

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: Milburr.exe PID: 3652, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Milburr.exe PID: 364, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Milburr.exe PID: 5160, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00B53B3A
Source: l1QC9H0SNR.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: l1QC9H0SNR.exe, 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ff0710b1-8
Source: l1QC9H0SNR.exe, 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_77596639-c
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: This is a third-party compiled AutoIt script.	2_2_006C3B3A
Source: Milburr.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Milburr.exe, 00000002.00000002.4568068709.0000000000774000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_832eee1c-1
Source: Milburr.exe, 00000002.00000002.4568068709.0000000000774000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_5d257fcd-a
Source: Milburr.exe, 00000004.00000002.2268483446.0000000000774000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5fadeae3-d
Source: Milburr.exe, 00000004.00000002.2268483446.0000000000774000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_68826bf8-7
Source: Milburr.exe, 00000005.00000002.2280550392.0000000000774000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_460592e9-d
Source: Milburr.exe, 00000005.00000002.2280550392.0000000000774000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_26033025-9

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B53633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	0_2_00B53633
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	0_2_00BDC1AC
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	0_2_00BDC498
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_00BDC5FE
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC57D SendMessageW,NtdllDialogWndProc_W,	0_2_00BDC57D
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC8BE NtdllDialogWndProc_W,	0_2_00BDC8BE
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC88F NtdllDialogWndProc_W,	0_2_00BDC88F
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC860 NtdllDialogWndProc_W,	0_2_00BDC860
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC93E ClientToScreen,NtdllDialogWndProc_W,	0_2_00BDC93E
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDC909 NtdllDialogWndProc_W,	0_2_00BDC909
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDCABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_00BDCABC
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDCA7C GetWindowLongW,NtdllDialogWndProc_W,	0_2_00BDCA7C
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B51290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	0_2_00B51290
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B51287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74A3C8D0,NtdllDialogWndProc_W,	0_2_00B51287
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDD3B8 NtdllDialogWndProc_W,	0_2_00BDD3B8
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDD43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	0_2_00BDD43E
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B516B5 NtdllDialogWndProc_W,	0_2_00B516B5
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B516DE GetParent,NtdllDialogWndProc_W,	0_2_00B516DE
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B5167D NtdllDialogWndProc_W,	0_2_00B5167D
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDD78C NtdllDialogWndProc_W,	0_2_00BDD78C
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B5189B NtdllDialogWndProc_W,	0_2_00B5189B
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDBC5D NtdllDialogWndProc_W,CallWindowProcW,	0_2_00BDBC5D
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDBF8C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	0_2_00BDBF8C
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BDBF30 NtdllDialogWndProc_W,	0_2_00BDBF30
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0041ACC1 OpenProcess,NtSuspendProcess,CloseHandle,	2_2_0041ACC1
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0041ACED OpenProcess,NtResumeProcess,CloseHandle,	2_2_0041ACED
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C3633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	2_2_006C3633
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	2_2_0074C1AC
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	2_2_0074C498
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C57D SendMessageW,NtdllDialogWndProc_W,	2_2_0074C57D
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	2_2_0074C5FE
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C860 NtdllDialogWndProc_W,	2_2_0074C860
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C8BE NtdllDialogWndProc_W,	2_2_0074C8BE
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C88F NtdllDialogWndProc_W,	2_2_0074C88F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C93E ClientToScreen,NtdllDialogWndProc_W,	2_2_0074C93E
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074C909 NtdllDialogWndProc_W,	2_2_0074C909
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074CA7C GetWindowLongW,NtdllDialogWndProc_W,	2_2_0074CA7C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	2_2_0074CABC
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C1287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74A3C8D0,NtdllDialogWndProc_W,	2_2_006C1287
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C1290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	2_2_006C1290
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074D3B8 NtdllDialogWndProc_W,	2_2_0074D3B8
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074D43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	2_2_0074D43E
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C167D NtdllDialogWndProc_W,	2_2_006C167D
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C16DE GetParent,NtdllDialogWndProc_W,	2_2_006C16DE
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C16B5 NtdllDialogWndProc_W,	2_2_006C16B5
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074D78C NtdllDialogWndProc_W,	2_2_0074D78C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C189B NtdllDialogWndProc_W,	2_2_006C189B
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074BC5D NtdllDialogWndProc_W,CallWindowProcW,	2_2_0074BC5D
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074BF30 NtdllDialogWndProc_W,	2_2_0074BF30
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0074BF8C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	2_2_0074BF8C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0041ACC1 OpenProcess,NtSuspendProcess,CloseHandle,	5_2_0041ACC1
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0041ACED OpenProcess,NtResumeProcess,CloseHandle,	5_2_0041ACED

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BBA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00BBA1EF

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BA8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74BD5590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

0_2_00BA8310

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BB51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_00BB51BD
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,	2_2_004158B9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_007251BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	2_2_007251BD
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,	5_2_004158B9

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B7D975	0_2_00B7D975
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B721C5	0_2_00B721C5
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B862D2	0_2_00B862D2
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BD03DA	0_2_00BD03DA
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B8242E	0_2_00B8242E
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B725FA	0_2_00B725FA
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B5E6A0	0_2_00B5E6A0
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B666E1	0_2_00B666E1
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BAE616	0_2_00BAE616
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B8878F	0_2_00B8878F
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BB8889	0_2_00BB8889
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B68808	0_2_00B68808
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BD0857	0_2_00BD0857
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B86844	0_2_00B86844
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B7CB21	0_2_00B7CB21
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B86DB6	0_2_00B86DB6
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B66F9E	0_2_00B66F9E
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B63030	0_2_00B63030
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B73187	0_2_00B73187
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B7F1D9	0_2_00B7F1D9
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B51287	0_2_00B51287
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B71484	0_2_00B71484
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B65520	0_2_00B65520
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B77696	0_2_00B77696
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B65760	0_2_00B65760
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B71978	0_2_00B71978
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B89AB5	0_2_00B89AB5
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B5FCE0	0_2_00B5FCE0
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B7BDA6	0_2_00B7BDA6
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B71D90	0_2_00B71D90
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BD7DDB	0_2_00BD7DDB
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B63FE0	0_2_00B63FE0
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B5DF00	0_2_00B5DF00
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_0100ACB0	0_2_0100ACB0
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0041D071	2_2_0041D071
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_004520D2	2_2_004520D2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0043D098	2_2_0043D098
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00437150	2_2_00437150
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_004361AA	2_2_004361AA
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00426254	2_2_00426254
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00431377	2_2_00431377
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0041E5DF	2_2_0041E5DF
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0044C739	2_2_0044C739
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_004267CB	2_2_004267CB
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0043C9DD	2_2_0043C9DD
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00432A49	2_2_00432A49
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0043CC0C	2_2_0043CC0C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00434D22	2_2_00434D22
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00426E73	2_2_00426E73
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00440E20	2_2_00440E20
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0043CE3B	2_2_0043CE3B
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00412F45	2_2_00412F45
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00452F00	2_2_00452F00
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00426FAD	2_2_00426FAD
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006ED975	2_2_006ED975
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006E21C5	2_2_006E21C5
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006F62D2	2_2_006F62D2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_007403DA	2_2_007403DA
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006F242E	2_2_006F242E
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006E25FA	2_2_006E25FA
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0071E616	2_2_0071E616
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006D66E1	2_2_006D66E1
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006CE6A0	2_2_006CE6A0
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006F878F	2_2_006F878F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00740857	2_2_00740857
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006F6844	2_2_006F6844
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006D8808	2_2_006D8808
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00728889	2_2_00728889
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006ECB21	2_2_006ECB21
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006F6DB6	2_2_006F6DB6
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006D6F9E	2_2_006D6F9E
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006D3030	2_2_006D3030
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006EF1D9	2_2_006EF1D9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006E3187	2_2_006E3187
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C1287	2_2_006C1287
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006E1484	2_2_006E1484
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006D5520	2_2_006D5520
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006E7696	2_2_006E7696
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006D5760	2_2_006D5760
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006E1978	2_2_006E1978
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006F9AB5	2_2_006F9AB5
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006CFCE0	2_2_006CFCE0
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00747DDB	2_2_00747DDB
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006EBDA6	2_2_006EBDA6
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006E1D90	2_2_006E1D90
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006CDF00	2_2_006CDF00
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006D3FE0	2_2_006D3FE0
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_01147670	2_2_01147670
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 4_2_00F6AB68	4_2_00F6AB68
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0041D071	5_2_0041D071
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_004520D2	5_2_004520D2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0043D098	5_2_0043D098
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00437150	5_2_00437150
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_004361AA	5_2_004361AA
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00426254	5_2_00426254
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00431377	5_2_00431377
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0041E5DF	5_2_0041E5DF
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0044C739	5_2_0044C739
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_004267CB	5_2_004267CB
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0043C9DD	5_2_0043C9DD
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00432A49	5_2_00432A49
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0043CC0C	5_2_0043CC0C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00434D22	5_2_00434D22
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00426E73	5_2_00426E73
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00440E20	5_2_00440E20
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0043CE3B	5_2_0043CE3B
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00412F45	5_2_00412F45
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00452F00	5_2_00452F00
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00426FAD	5_2_00426FAD
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0151A328	5_2_0151A328

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: String function: 00B70AE3 appears 70 times
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: String function: 00B78900 appears 42 times
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: String function: 00B57DE1 appears 35 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00444B14 appears 56 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00404C9E appears 32 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 004020E7 appears 79 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00401E8F appears 37 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00401D64 appears 43 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00447174 appears 36 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 006E0AE3 appears 70 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 004040BB appears 36 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00401F66 appears 100 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00410D8D appears 36 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 004338A5 appears 82 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00401FAA appears 42 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00403B40 appears 44 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 006E8900 appears 42 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 006C7DE1 appears 36 times
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: String function: 00433FB0 appears 110 times

Source: l1QC9H0SNR.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: Milburr.exe PID: 3652, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Milburr.exe PID: 364, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Milburr.exe PID: 5160, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@8/13@0/1

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BBA06A GetLastError,FormatMessageW,

0_2_00BBA06A

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BA81CB AdjustTokenPrivileges,CloseHandle,	0_2_00BA81CB
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BA87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00BA87E1
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	2_2_00416AB7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_007181CB AdjustTokenPrivileges,CloseHandle,	2_2_007181CB
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_007187E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	2_2_007187E1
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	5_2_00416AB7

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BBB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00BBB3FB

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BCEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00BCEE0D

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BC83BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00BC83BB

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B54E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00B54E89

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Code function: 2_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_00419BC4

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

File created: C:\Users\user\AppData\Local\obtenebrate

Jump to behavior

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-MKYDDH

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

File created: C:\Users\user\AppData\Local\Temp\aut7743.tmp

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: l1QC9H0SNR.exe	Virustotal: Detection: 68%
Source: l1QC9H0SNR.exe	ReversingLabs: Detection: 75%

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

File read: C:\Users\user\Desktop\l1QC9H0SNR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\l1QC9H0SNR.exe "C:\Users\user\Desktop\l1QC9H0SNR.exe"
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Process created: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe "C:\Users\user\Desktop\l1QC9H0SNR.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe "C:\Users\user\AppData\Local\obtenebrate\Milburr.exe"
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process created: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe "C:\Users\user\AppData\Local\obtenebrate\Milburr.exe"
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Process created: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe "C:\Users\user\Desktop\l1QC9H0SNR.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe "C:\Users\user\AppData\Local\obtenebrate\Milburr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process created: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe "C:\Users\user\AppData\Local\obtenebrate\Milburr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00CB2A60 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00CB2A60

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B78945 push ecx; ret	0_2_00B78958
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_004567E0 push eax; ret	2_2_004567FE
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0045B9DD push esi; ret	2_2_0045B9E6
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00455EAF push ecx; ret	2_2_00455EC2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00433FF6 push ecx; ret	2_2_00434009
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006CC4C4 push A3006CBAh; retn 006Ch	2_2_006CC50D
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006E8945 push ecx; ret	2_2_006E8958
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C2F12 push es; retf	2_2_006C2F13
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_004567E0 push eax; ret	5_2_004567FE
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0045B9DD push esi; ret	5_2_0045B9E6
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00455EAF push ecx; ret	5_2_00455EC2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00433FF6 push ecx; ret	5_2_00434009

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Code function: 2_2_00406128 ShellExecuteW,URLDownloadToFileW,

2_2_00406128

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

File created: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Code function: 2_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_00419BC4

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00B548D7
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BD5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00BD5376
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006C48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	2_2_006C48D7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00745376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	2_2_00745376

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B73187 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B73187

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0040E54F Sleep,ExitProcess,		2_2_0040E54F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0040E54F Sleep,ExitProcess,		5_2_0040E54F

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Milburr.exe, 00000004.00000002.2270035484.0000000001027000.00000004.00000020.00020000.00000000.sdmp, Milburr.exe, 00000005.00000002.2281229333.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: Milburr.exe, 00000004.00000002.2268951587.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, Milburr.exe, 00000005.00000002.2281035123.00000000014AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: Milburr.exe, 00000002.00000002.4574070147.0000000001213000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEP
Source: l1QC9H0SNR.exe, 00000000.00000002.2131174618.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEORG
Source: Milburr.exe, 00000002.00000002.4573167433.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXERG
Source: l1QC9H0SNR.exe, 00000000.00000003.2120110912.000000000104A000.00000004.00000020.00020000.00000000.sdmp, l1QC9H0SNR.exe, 00000000.00000002.2131421488.000000000104A000.00000004.00000020.00020000.00000000.sdmp, l1QC9H0SNR.exe, 00000000.00000003.2120047789.0000000001027000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEX

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		2_2_004198C2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		5_2_004198C2

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Window / User API: threadDelayed 4067	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Window / User API: threadDelayed 5424	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Window / User API: foregroundWindowGot 1747	Jump to behavior

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-105377
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	API coverage: 4.6 %
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	API coverage: 6.1 %
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	API coverage: 2.0 %

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe TID: 1136	Thread sleep count: 181 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe TID: 1136	Thread sleep time: -90500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe TID: 2128	Thread sleep count: 4067 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe TID: 2128	Thread sleep time: -12201000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe TID: 2128	Thread sleep count: 5424 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe TID: 2128	Thread sleep time: -16272000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BB445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BB445A
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBC6D1 FindFirstFileW,FindClose,	0_2_00BBC6D1
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00BBC75C
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BBEF95
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BBF0F2
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BBF3F3
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BB37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BB37EF
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BB3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BB3B12
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BBBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BBBCBC
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040B335
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	2_2_0041B42F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040B53A
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0044D5E9 FindFirstFileExA,	2_2_0044D5E9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	2_2_004089A9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00406AC2 FindFirstFileW,FindNextFileW,	2_2_00406AC2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	2_2_00407A8C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00418C69
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	2_2_00408DA7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0072445A
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072C6D1 FindFirstFileW,FindClose,	2_2_0072C6D1
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0072C75C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0072EF95
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0072F0F2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0072F3F3
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_007237EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_007237EF
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00723B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00723B12
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0072BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0072BCBC
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	5_2_0040B335
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	5_2_0041B42F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	5_2_0040B53A
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0044D5E9 FindFirstFileExA,	5_2_0044D5E9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	5_2_004089A9
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00406AC2 FindFirstFileW,FindNextFileW,	5_2_00406AC2
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	5_2_00407A8C
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	5_2_00418C69
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	5_2_00408DA7

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Code function: 2_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00406F06

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B549A0

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: Milburr.exe, 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	API call chain: ExitProcess graph end node	graph_0-107554
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	API call chain: ExitProcess graph end node	graph_0-104582
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	API call chain: ExitProcess graph end node	graph_0-104654
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BC3F09 BlockInput,

0_2_00BC3F09

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B53B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B53B3A

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B85A7C RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_00B85A7C

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00CB2A60 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00CB2A60

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_0100950E mov eax, dword ptr fs:[00000030h]	0_2_0100950E
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_01009520 mov eax, dword ptr fs:[00000030h]	0_2_01009520
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_0100AB40 mov eax, dword ptr fs:[00000030h]	0_2_0100AB40
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_0100ABA0 mov eax, dword ptr fs:[00000030h]	0_2_0100ABA0
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00442554 mov eax, dword ptr fs:[00000030h]	2_2_00442554
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_01147500 mov eax, dword ptr fs:[00000030h]	2_2_01147500
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_01147560 mov eax, dword ptr fs:[00000030h]	2_2_01147560
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_01145ECE mov eax, dword ptr fs:[00000030h]	2_2_01145ECE
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_01145EE0 mov eax, dword ptr fs:[00000030h]	2_2_01145EE0
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 4_2_00F6A9F8 mov eax, dword ptr fs:[00000030h]	4_2_00F6A9F8
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 4_2_00F6AA58 mov eax, dword ptr fs:[00000030h]	4_2_00F6AA58
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 4_2_00F693D8 mov eax, dword ptr fs:[00000030h]	4_2_00F693D8
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 4_2_00F693C6 mov eax, dword ptr fs:[00000030h]	4_2_00F693C6
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00442554 mov eax, dword ptr fs:[00000030h]	5_2_00442554
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0151A1B8 mov eax, dword ptr fs:[00000030h]	5_2_0151A1B8
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0151A218 mov eax, dword ptr fs:[00000030h]	5_2_0151A218
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_01518B98 mov eax, dword ptr fs:[00000030h]	5_2_01518B98
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_01518B86 mov eax, dword ptr fs:[00000030h]	5_2_01518B86

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BA80A9 GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,

0_2_00BA80A9

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B7A124 SetUnhandledExceptionFilter,	0_2_00B7A124
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00B7A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B7A155
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00434168
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0043A65D
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00433B44
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00433CD7 SetUnhandledExceptionFilter,	2_2_00433CD7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006EA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_006EA155
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_006EA124 SetUnhandledExceptionFilter,	2_2_006EA124
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00434168
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0043A65D
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00433B44
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 5_2_00433CD7 SetUnhandledExceptionFilter,	5_2_00433CD7

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		2_2_00410F36
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		5_2_00410F36

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BA87B1 LogonUserW,

0_2_00BA87B1

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B53B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B53B3A

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00B548D7

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BB4C27 mouse_event,

0_2_00BB4C27

Source: C:\Windows\System32\wscript.exe

Process created: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe "C:\Users\user\AppData\Local\obtenebrate\Milburr.exe"

Jump to behavior

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BA7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00BA7CAF

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00BA874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00BA874B

Source: l1QC9H0SNR.exe, 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmp, Milburr.exe, 00000002.00000002.4568068709.0000000000774000.00000040.00000001.01000000.00000004.sdmp, Milburr.exe, 00000004.00000002.2268483446.0000000000774000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Milburr.exe, 00000002.00000002.4574103580.0000000001238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: l1QC9H0SNR.exe, Milburr.exe	Binary or memory string: Shell_TrayWnd
Source: Milburr.exe, 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDH\r
Source: Milburr.exe, 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDH\
Source: Milburr.exe, 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager0.26:3678
Source: Milburr.exe, 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager0.26
Source: Milburr.exe, 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDH\8
Source: Milburr.exe, 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDH\rA'
Source: Milburr.exe, 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: Milburr.exe, 00000002.00000002.4574103580.0000000001238000.00000004.00000020.00020000.00000000.sdmp, logs.dat.2.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B7862B cpuid

0_2_00B7862B

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: EnumSystemLocalesW,	2_2_004470AE
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,	2_2_004510BA
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004511E3
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,	2_2_004512EA
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004513B7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,	2_2_00447597
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoA,	2_2_0040E679
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00450A7F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: EnumSystemLocalesW,	2_2_00450CF7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: EnumSystemLocalesW,	2_2_00450D42
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: EnumSystemLocalesW,	2_2_00450DDD
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00450E6A
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: EnumSystemLocalesW,	5_2_004470AE
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,	5_2_004510BA
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004511E3
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,	5_2_004512EA
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_004513B7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,	5_2_00447597
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoA,	5_2_0040E679
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_00450A7F
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: EnumSystemLocalesW,	5_2_00450CF7
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: EnumSystemLocalesW,	5_2_00450D42
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: EnumSystemLocalesW,	5_2_00450DDD
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00450E6A

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B84E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B84E87

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B91E06 GetUserNameW,

0_2_00B91E06

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B83F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00B83F3A

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Code function: 0_2_00B549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B549A0

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Milburr.exe, 00000004.00000002.2270035484.0000000001027000.00000004.00000020.00020000.00000000.sdmp, Milburr.exe, 00000005.00000002.2281229333.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: l1QC9H0SNR.exe, 00000000.00000003.2120110912.000000000104A000.00000004.00000020.00020000.00000000.sdmp, l1QC9H0SNR.exe, 00000000.00000002.2131421488.000000000104A000.00000004.00000020.00020000.00000000.sdmp, l1QC9H0SNR.exe, 00000000.00000003.2120047789.0000000001027000.00000004.00000020.00020000.00000000.sdmp, Milburr.exe, 00000002.00000002.4574070147.0000000001213000.00000004.00000020.00020000.00000000.sdmp, Milburr.exe, 00000004.00000002.2270035484.0000000001027000.00000004.00000020.00020000.00000000.sdmp, Milburr.exe, 00000005.00000002.2281229333.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcupdate.exe

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4575991012.0000000003E6F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281153273.000000000151B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281175297.0000000001557000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573965402.0000000001187000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573167433.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 5160, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		2_2_0040B21B
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		5_2_0040B21B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	2_2_0040B335
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: \key3.db	2_2_0040B335
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	5_2_0040B335
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: \key3.db	5_2_0040B335

Source: Milburr.exe	Binary or memory string: WIN_81
Source: Milburr.exe	Binary or memory string: WIN_XP
Source: Milburr.exe	Binary or memory string: WIN_XPe
Source: Milburr.exe	Binary or memory string: WIN_VISTA
Source: Milburr.exe	Binary or memory string: WIN_7
Source: Milburr.exe	Binary or memory string: WIN_8
Source: Milburr.exe, 00000005.00000002.2280550392.0000000000774000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-MKYDDH			Jump to behavior
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-MKYDDH			Jump to behavior

Yara detected Remcos RAT

Source: Yara match	File source: 2.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Milburr.exe.3280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.3d80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Milburr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Milburr.exe.3630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4575991012.0000000003E6F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281153273.000000000151B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281175297.0000000001557000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573965402.0000000001187000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4573167433.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Milburr.exe PID: 5160, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: cmd.exe		2_2_00405042
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: cmd.exe		5_2_00405042

Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BC6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_00BC6283
Source: C:\Users\user\Desktop\l1QC9H0SNR.exe	Code function: 0_2_00BC6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00BC6747
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00736283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	2_2_00736283
Source: C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	Code function: 2_2_00736747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	2_2_00736747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	2 Valid Accounts	1 Bypass User Account Control	21 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	2 Valid Accounts	1 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	26 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 Bypass User Account Control	Cached Domain Credentials	241 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	22 Process Injection	1 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	22 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
l1QC9H0SNR.exe	68%	Virustotal		Browse
l1QC9H0SNR.exe	75%	ReversingLabs	Win32.Backdoor.Remcos
l1QC9H0SNR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\obtenebrate\Milburr.exe	75%	ReversingLabs	Win32.Backdoor.Remcos

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	Milburr.exe	false		high
http://geoplugin.net/json.gp/C	Milburr.exe, 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Milburr.exe, 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Milburr.exe, 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, Milburr.exe, 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Milburr.exe, 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.210.150.26	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588244
Start date and time:	2025-01-10 22:59:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	l1QC9H0SNR.exe renamed because original name is a hash value
Original Sample Name:	c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@8/13@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 279
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:01:01	API Interceptor	7116284x Sleep call for process: Milburr.exe modified
23:00:31	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
192.210.150.26	bwYw3UUfy7.exe	Get hash	malicious	Remcos	Browse
	FACTURA.xlsx	Get hash	malicious	Remcos	Browse
	7056ZCiFdE.exe	Get hash	malicious	Remcos	Browse
	uIarPolvHR.exe	Get hash	malicious	Remcos	Browse
	IB9876789000.bat.exe	Get hash	malicious	Remcos	Browse
	z49FACTURA-0987678.exe	Get hash	malicious	Remcos	Browse
	FAT6789098700900.scr.exe	Get hash	malicious	Remcos	Browse
	Rgh99876k7e.exe	Get hash	malicious	Remcos	Browse
	SALKI098765R400.exe	Get hash	malicious	Remcos	Browse
	FTE98767800000.bat.exe	Get hash	malicious	Remcos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	MLxloAVuCZ.exe	Get hash	malicious	Remcos	Browse	192.3.64.152
	bwYw3UUfy7.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	sh4.elf	Get hash	malicious	Mirai	Browse	23.95.117.229
	sweetnessgoodforgreatnessthingswithgood.tIF.vbs	Get hash	malicious	SmokeLoader	Browse	192.3.27.144
	begoodforeverythinggreatthingsformebetterforgood.hta	Get hash	malicious	Cobalt Strike, SmokeLoader	Browse	192.3.27.144
	PO#3311-20250108003.xls	Get hash	malicious	Unknown	Browse	192.3.27.144
	PO#3311-20250108003.xls	Get hash	malicious	Unknown	Browse	192.3.27.144

Process:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	3.3359425119253987
Encrypted:	false
SSDEEP:	3:rglsOlfUlSl9U5JWRal2Jl+7R0DAlBG45klovDl64oojklovDl6v:Mls6UlSs5YcIeeDAlOWA41gWAv
MD5:	536B536A90D98BBCC091AC5516A08495
SHA1:	BEE4E3E04B0BBCF197AB6EE93E63D3BBC4135207
SHA-256:	86D354A89109E6510CA5DB58B055238D464BC032BDF02F41DA959C4894C678D7
SHA-512:	C677633380C66A0E994CF3B3DDC6A63720D93E32AC5BD8D5638BDFAADC1C315DFB65F7B446ED44217CD41E047C09B055D1023360F0B4DCC26B16E397AD3FF42E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.5./.0.1./.1.0. .1.7.:.0.0.:.2.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Temp\Charley

Download File

Process:	C:\Users\user\Desktop\l1QC9H0SNR.exe
File Type:	data
Category:	dropped
Size (bytes):	492544
Entropy (8bit):	7.568668414012018
Encrypted:	false
SSDEEP:	12288:Bk1P31hPfYMVOxdwC2kEPuqzrgGqHkg6H9yy4zG5F1i4xP:Bk1P319fYlByPuqfgXb6DtXi4xP
MD5:	E8F92D99524EFF3DE429C3718B7A1491
SHA1:	B0C6F6A240841E77E7D20F99B379A9C6EE35D85B
SHA-256:	894CB71AD99FF88B5C93218788DE1D133B4D0404D4996F7E5D3255209322F6E9
SHA-512:	4CF796747DB21C4EB2CDA23FB79E184C49B62B2E84E15B669A0025224991E4F9E0E261C6E03A12DD8B5E6B105D2AA7E8E652AA3F4863CEC73A88BC02906C17D6
Malicious:	false
Reputation:	low
Preview:	u..B[L00SBQS..J8.IBXL00W.QSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ0WIBVS.>W.X.k.Kt.h.0%C.'0>480'.5(,6#D.5'q!??jQ8i....]8&4}G\@.VIBXL00.k...........x.N.{....E.r.#x..].a..p...h.....u.O......l.......q..............zr......x......Y.......#vd.....+w.......+2;....VIBXL00W..SJ.K=V".\|+00WBQSJQ.8THIYB 07GQSjSJ8VIBbw30WRQSJ!O8VI.XL 0WBSSJTJ9VIBXL50VBQSJQJ.QIB\L00WBQQJQ.8VYBX\00WBASJAJ8VIBX\00WBQSJQJ8Vi.^L41WBQ3MQ.pVIBXL00WBQSJQJ8VIBX.70.yQSZ.L8nIBXL00WBQSJQJ8VIBXL..QBISJQ..PI.XL00WBQSJQJ8&LB.H00WBQSJQJ8VIBXL00WBQSJQJ8Vg6=4D0WBL.OQJ(VIB8I00SBQSJQJ8VIBXL00wBQ3d#.Y"(BXL.1WB!VJQ.9VI&]L00WBQSJQJ8VI.XLp.3#%2JQJT.IBXL70WLQSJ.L8VIBXL00WBQSJ.J8.g0+>S0WB..JQJXQIB.L00.DQSJQJ8VIBXL00.BQ.d#/T9*BX..0WB.TJQv8VI._L00WBQSJQJ8VI.XLr0WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WBQSJQJ8VIBXL00WB

C:\Users\user\AppData\Local\Temp\aut7743.tmp

Download File

Process:	C:\Users\user\Desktop\l1QC9H0SNR.exe
File Type:	data
Category:	dropped
Size (bytes):	414136
Entropy (8bit):	7.981207697530746
Encrypted:	false
SSDEEP:	12288:QybYqhspyXD4x3fqeDypBCJXqEGsKRjVXByS81PXkU:QghsppFwuqbZVr4XZ
MD5:	DF6CE24C1D936B4B56DCD548DEF18B8D
SHA1:	BB8CCA79E83C81605FE2B2FFCFB657612FD798A1
SHA-256:	FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
SHA-512:	7AEA698B0A2C06812FBE00D0315AF7BA18C15AE572C2EF7088DB28CE3A5B6AB122CE4E711E8FE20D7763A47E8591AFB248A02B55D5059F49F06B3201918648E8
Malicious:	false
Reputation:	low
Preview:	EA06......;4.2a0..5=...8.RhU.......U.T........0..hUj.}W.V3.M..E..Z.BO0.M'..<bk(.M.tH..Oq...............i}..(......~o..3....9......S.........r.-....p..7...\|...>&?..]tT...=....7F...h.9~w<...D=Z..g...^.Z.D+...^1.]Dk'...p...C+...oT......[O......S....KQ(.N....j....V..T.H..hR...Q..`....3.U.@.....@.....iS......]5.U.Gq..hU...TiU.T.Y.V+.....J...b....N..L.L@..6........y...YJd...+.v>...$.<..j.....$..........y..iD..)..}F.(..'.. ......,Y$r..P..n.)I.Z.Q..x.j..?...\#.9..d..U!`...aW.....`.....N2.y..}S..81....XD...M......1;$._T..U.d,....)U.......<\|w ....?....!.z..3].TdY9.2....&ux.K.2.Cg...6.L.agpz..cy..!...2.w.o...s..D.:..g0.`gq=...;.D<<...)..n...T.}..Gi.....Q.bgt......i/....s..E)]...X...6..Z...Qg.i..i..v(6..N'...-....?.U.ZY.>..._.T(.>.0.J..JV...ReZi..a..]...F'....-..uZ.9.....%..i.U.u.d6...^i4).z.u..wJMF'...o..gc.Y.Tgui.>q...kt.O....-.y...~..-.....V.\|..c.m...Qi=...._...NS.a..-.z.....Zf .T...C.GIU..t..@GH...u.L.QjWB/G.V$.Z.J....jT..W....-.Jp..>.Zk..V.],..(3..

C:\Users\user\AppData\Local\Temp\aut77B1.tmp

Download File

Process:	C:\Users\user\Desktop\l1QC9H0SNR.exe
File Type:	data
Category:	dropped
Size (bytes):	14584
Entropy (8bit):	7.63320383966088
Encrypted:	false
SSDEEP:	384:ITYznw6siKOPb6ZyDWPcq7jisLHk6h8FAeXHxHiWp3isCLf:IAw6sipDqcSLHwFAeRiZsCz
MD5:	00360588750369BC243ED68948507859
SHA1:	861AF2E9E7E94F3FBABB95259D86F2A93C4EDDB3
SHA-256:	71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
SHA-512:	C8B360B472A1E0CB8957AFCE1EC644D465EB087B28328D7B3D3C88B3C2870CA885D42D66C9CFAEAE2347D02A87E47DA645A92F16C6140CEB036DF147F91D51DF
Malicious:	false
Reputation:	low
Preview:	EA06..0..[.....+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\aut7B1B.tmp

Download File

Process:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
File Type:	data
Category:	dropped
Size (bytes):	414136
Entropy (8bit):	7.981207697530746
Encrypted:	false
SSDEEP:	12288:QybYqhspyXD4x3fqeDypBCJXqEGsKRjVXByS81PXkU:QghsppFwuqbZVr4XZ
MD5:	DF6CE24C1D936B4B56DCD548DEF18B8D
SHA1:	BB8CCA79E83C81605FE2B2FFCFB657612FD798A1
SHA-256:	FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
SHA-512:	7AEA698B0A2C06812FBE00D0315AF7BA18C15AE572C2EF7088DB28CE3A5B6AB122CE4E711E8FE20D7763A47E8591AFB248A02B55D5059F49F06B3201918648E8
Malicious:	false
Reputation:	low
Preview:	EA06......;4.2a0..5=...8.RhU.......U.T........0..hUj.}W.V3.M..E..Z.BO0.M'..<bk(.M.tH..Oq...............i}..(......~o..3....9......S.........r.-....p..7...\|...>&?..]tT...=....7F...h.9~w<...D=Z..g...^.Z.D+...^1.]Dk'...p...C+...oT......[O......S....KQ(.N....j....V..T.H..hR...Q..`....3.U.@.....@.....iS......]5.U.Gq..hU...TiU.T.Y.V+.....J...b....N..L.L@..6........y...YJd...+.v>...$.<..j.....$..........y..iD..)..}F.(..'.. ......,Y$r..P..n.)I.Z.Q..x.j..?...\#.9..d..U!`...aW.....`.....N2.y..}S..81....XD...M......1;$._T..U.d,....)U.......<\|w ....?....!.z..3].TdY9.2....&ux.K.2.Cg...6.L.agpz..cy..!...2.w.o...s..D.:..g0.`gq=...;.D<<...)..n...T.}..Gi.....Q.bgt......i/....s..E)]...X...6..Z...Qg.i..i..v(6..N'...-....?.U.ZY.>..._.T(.>.0.J..JV...ReZi..a..]...F'....-..uZ.9.....%..i.U.u.d6...^i4).z.u..wJMF'...o..gc.Y.Tgui.>q...kt.O....-.y...~..-.....V.\|..c.m...Qi=...._...NS.a..-.z.....Zf .T...C.GIU..t..@GH...u.L.QjWB/G.V$.Z.J....jT..W....-.Jp..>.Zk..V.],..(3..

C:\Users\user\AppData\Local\Temp\aut7B99.tmp

Download File

Process:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
File Type:	data
Category:	dropped
Size (bytes):	14584
Entropy (8bit):	7.63320383966088
Encrypted:	false
SSDEEP:	384:ITYznw6siKOPb6ZyDWPcq7jisLHk6h8FAeXHxHiWp3isCLf:IAw6sipDqcSLHwFAeRiZsCz
MD5:	00360588750369BC243ED68948507859
SHA1:	861AF2E9E7E94F3FBABB95259D86F2A93C4EDDB3
SHA-256:	71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
SHA-512:	C8B360B472A1E0CB8957AFCE1EC644D465EB087B28328D7B3D3C88B3C2870CA885D42D66C9CFAEAE2347D02A87E47DA645A92F16C6140CEB036DF147F91D51DF
Malicious:	false
Reputation:	low
Preview:	EA06..0..[.....+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\autADA5.tmp

Download File

Process:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
File Type:	data
Category:	dropped
Size (bytes):	414136
Entropy (8bit):	7.981207697530746
Encrypted:	false
SSDEEP:	12288:QybYqhspyXD4x3fqeDypBCJXqEGsKRjVXByS81PXkU:QghsppFwuqbZVr4XZ
MD5:	DF6CE24C1D936B4B56DCD548DEF18B8D
SHA1:	BB8CCA79E83C81605FE2B2FFCFB657612FD798A1
SHA-256:	FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
SHA-512:	7AEA698B0A2C06812FBE00D0315AF7BA18C15AE572C2EF7088DB28CE3A5B6AB122CE4E711E8FE20D7763A47E8591AFB248A02B55D5059F49F06B3201918648E8
Malicious:	false
Reputation:	low
Preview:	EA06......;4.2a0..5=...8.RhU.......U.T........0..hUj.}W.V3.M..E..Z.BO0.M'..<bk(.M.tH..Oq...............i}..(......~o..3....9......S.........r.-....p..7...\|...>&?..]tT...=....7F...h.9~w<...D=Z..g...^.Z.D+...^1.]Dk'...p...C+...oT......[O......S....KQ(.N....j....V..T.H..hR...Q..`....3.U.@.....@.....iS......]5.U.Gq..hU...TiU.T.Y.V+.....J...b....N..L.L@..6........y...YJd...+.v>...$.<..j.....$..........y..iD..)..}F.(..'.. ......,Y$r..P..n.)I.Z.Q..x.j..?...\#.9..d..U!`...aW.....`.....N2.y..}S..81....XD...M......1;$._T..U.d,....)U.......<\|w ....?....!.z..3].TdY9.2....&ux.K.2.Cg...6.L.agpz..cy..!...2.w.o...s..D.:..g0.`gq=...;.D<<...)..n...T.}..Gi.....Q.bgt......i/....s..E)]...X...6..Z...Qg.i..i..v(6..N'...-....?.U.ZY.>..._.T(.>.0.J..JV...ReZi..a..]...F'....-..uZ.9.....%..i.U.u.d6...^i4).z.u..wJMF'...o..gc.Y.Tgui.>q...kt.O....-.y...~..-.....V.\|..c.m...Qi=...._...NS.a..-.z.....Zf .T...C.GIU..t..@GH...u.L.QjWB/G.V$.Z.J....jT..W....-.Jp..>.Zk..V.],..(3..

C:\Users\user\AppData\Local\Temp\autAE23.tmp

Download File

Process:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
File Type:	data
Category:	dropped
Size (bytes):	14584
Entropy (8bit):	7.63320383966088
Encrypted:	false
SSDEEP:	384:ITYznw6siKOPb6ZyDWPcq7jisLHk6h8FAeXHxHiWp3isCLf:IAw6sipDqcSLHwFAeRiZsCz
MD5:	00360588750369BC243ED68948507859
SHA1:	861AF2E9E7E94F3FBABB95259D86F2A93C4EDDB3
SHA-256:	71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
SHA-512:	C8B360B472A1E0CB8957AFCE1EC644D465EB087B28328D7B3D3C88B3C2870CA885D42D66C9CFAEAE2347D02A87E47DA645A92F16C6140CEB036DF147F91D51DF
Malicious:	false
Reputation:	low
Preview:	EA06..0..[.....+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\autB15E.tmp

Download File

Process:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
File Type:	data
Category:	dropped
Size (bytes):	414136
Entropy (8bit):	7.981207697530746
Encrypted:	false
SSDEEP:	12288:QybYqhspyXD4x3fqeDypBCJXqEGsKRjVXByS81PXkU:QghsppFwuqbZVr4XZ
MD5:	DF6CE24C1D936B4B56DCD548DEF18B8D
SHA1:	BB8CCA79E83C81605FE2B2FFCFB657612FD798A1
SHA-256:	FED7B359F763F28D9E01BB5F6C734A29F17A67AE34161F4053DDAC0407F52610
SHA-512:	7AEA698B0A2C06812FBE00D0315AF7BA18C15AE572C2EF7088DB28CE3A5B6AB122CE4E711E8FE20D7763A47E8591AFB248A02B55D5059F49F06B3201918648E8
Malicious:	false
Preview:	EA06......;4.2a0..5=...8.RhU.......U.T........0..hUj.}W.V3.M..E..Z.BO0.M'..<bk(.M.tH..Oq...............i}..(......~o..3....9......S.........r.-....p..7...\|...>&?..]tT...=....7F...h.9~w<...D=Z..g...^.Z.D+...^1.]Dk'...p...C+...oT......[O......S....KQ(.N....j....V..T.H..hR...Q..`....3.U.@.....@.....iS......]5.U.Gq..hU...TiU.T.Y.V+.....J...b....N..L.L@..6........y...YJd...+.v>...$.<..j.....$..........y..iD..)..}F.(..'.. ......,Y$r..P..n.)I.Z.Q..x.j..?...\#.9..d..U!`...aW.....`.....N2.y..}S..81....XD...M......1;$._T..U.d,....)U.......<\|w ....?....!.z..3].TdY9.2....&ux.K.2.Cg...6.L.agpz..cy..!...2.w.o...s..D.:..g0.`gq=...;.D<<...)..n...T.}..Gi.....Q.bgt......i/....s..E)]...X...6..Z...Qg.i..i..v(6..N'...-....?.U.ZY.>..._.T(.>.0.J..JV...ReZi..a..]...F'....-..uZ.9.....%..i.U.u.d6...^i4).z.u..wJMF'...o..gc.Y.Tgui.>q...kt.O....-.y...~..-.....V.\|..c.m...Qi=...._...NS.a..-.z.....Zf .T...C.GIU..t..@GH...u.L.QjWB/G.V$.Z.J....jT..W....-.Jp..>.Zk..V.],..(3..

C:\Users\user\AppData\Local\Temp\autB333.tmp

Download File

Process:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
File Type:	data
Category:	dropped
Size (bytes):	14584
Entropy (8bit):	7.63320383966088
Encrypted:	false
SSDEEP:	384:ITYznw6siKOPb6ZyDWPcq7jisLHk6h8FAeXHxHiWp3isCLf:IAw6sipDqcSLHwFAeRiZsCz
MD5:	00360588750369BC243ED68948507859
SHA1:	861AF2E9E7E94F3FBABB95259D86F2A93C4EDDB3
SHA-256:	71E5D5E454B65C35189F3CC57C5923678F53758420ABF6C3975A0E188FB8D855
SHA-512:	C8B360B472A1E0CB8957AFCE1EC644D465EB087B28328D7B3D3C88B3C2870CA885D42D66C9CFAEAE2347D02A87E47DA645A92F16C6140CEB036DF147F91D51DF
Malicious:	false
Preview:	EA06..0..[.....+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\teer

Download File

Process:	C:\Users\user\Desktop\l1QC9H0SNR.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	143378
Entropy (8bit):	2.9932403669409404
Encrypted:	false
SSDEEP:	96:AIXLr44+F05BDjciMi0Fl7dSA6V5vevGcu29IwyJuv35rWVjjYqnBaAJZdjurebD:H3LjC7YmGcu29IwyJuv35rWVgqnBaA
MD5:	B98EE815FE928B457A8CA6290CA38293
SHA1:	B2A6929D5A5B461AD3AA6A8ED873F2E5FC106FD5
SHA-256:	D1DE55CC4B804A902CD9ECBC8C4658586A9B85D4A26F147E49CA17406EBE5C6B
SHA-512:	2964C872A41DDAC596490BE2C9B4797EE97294503D509EA8E6B8FC8D43336BF2896189AF88C8A225BB3E59F4127BC7CB81B9C05ED927B813AEB04DE4F80AF5BB
Malicious:	false
Preview:	dowp0dowpxdowp5dowp5dowp8dowpbdowpedowpcdowp8dowp1dowpedowpcdowpcdowpcdowp0dowp2dowp0dowp0dowp0dowp0dowp5dowp6dowp5dowp7dowpbdowp8dowp6dowpbdowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp8dowp4dowpbdowp9dowp6dowp5dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp8dowp6dowpbdowpadowp7dowp2dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp8dowp8dowpbdowp8dowp6dowpedowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp8dowpadowpbdowp9dowp6dowp5dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp8dowpcdowpbdowpadowp6dowpcdowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp8dowpedowpbdowp8dowp3dowp3dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp9dowp0dowpbdowp9dowp3dowp2dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp9dowp2dowpbdowpadowp2dowpedowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp9dowp4dowpbdowp8dowp6dowp4dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9

C:\Users\user\AppData\Local\obtenebrate\Milburr.exe

Download File

Process:	C:\Users\user\Desktop\l1QC9H0SNR.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	921600
Entropy (8bit):	7.775145133962969
Encrypted:	false
SSDEEP:	24576:0rl6kD68JmlotQf1nQr8zKS7ifTcvt2S3Sc1YNTN:Cl328U2yfuo2hfwvtJCxT
MD5:	BE20DFFFCBA37064D6087AA714036873
SHA1:	4F50F7F954ED27B8E3373A5D900905D98D1BB51E
SHA-256:	C889443786DC57C284A40FD1A9764BAD2F026A8C20E191059707D1646FF931E0
SHA-512:	955A14D104EDF528CD3D1F140181E6222CC1F88C8F1FB0A6A60FA0D37962B34C535A29E45BA029CF8DAA039DF06D25B26689FEB600FB8B499FE46DE0B3BF4696
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L.....Wg.........."......`..........`*.......0....@.......................................@...@.......@.....................@...$....0..@...................d.......................................D,..H...........................................UPX0....................................UPX1.....`.......^..................@....rsrc........0.......b..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs

Download File

Process:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.38394623991052
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclzXUEZ+lX1Klxbs7nriIM8lfQVn:DsO+vNlDQ1kkmA2n
MD5:	86B98D0A8F987C1D3016FCC2EB957CD5
SHA1:	98AF46925D84EF241EB425E57DDF80670FA7E630
SHA-256:	E35ED9BC0F1482905A13771C4FC11F91DA24515AB5E759926F4C8E5F1B2E0858
SHA-512:	F41AA40F748DE917CE86D40BEA5CD7A4A76F9995D59EDA50ABDA5639DCE92BBC71A0762C26719EC056421AC0A0BB594C0C9FDB981AB46A50FBFFCC32FB1E62EE
Malicious:	true
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.o.b.t.e.n.e.b.r.a.t.e.\.M.i.l.b.u.r.r...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.775145133962969
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	l1QC9H0SNR.exe
File size:	921'600 bytes
MD5:	be20dfffcba37064d6087aa714036873
SHA1:	4f50f7f954ed27b8e3373a5d900905d98d1bb51e
SHA256:	c889443786dc57c284a40fd1a9764bad2f026a8c20e191059707d1646ff931e0
SHA512:	955a14d104edf528cd3d1f140181e6222cc1f88c8f1fb0a6a60fa0d37962b34c535a29e45ba029cf8daa039df06d25b26689feb600fb8b499fe46de0b3bf4696
SSDEEP:	24576:0rl6kD68JmlotQf1nQr8zKS7ifTcvt2S3Sc1YNTN:Cl328U2yfuo2hfwvtJCxT
TLSH:	F815238BB9D22547D926FEB704230C54C7EBBE1979B87205486F3E1696B3293203B51F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	0d2d0d1723293133

Static PE Info

General

Entrypoint:	0x562a60
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6757B2BE [Tue Dec 10 03:17:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc6683d30d9f25244a50fd5357825e79

Entrypoint Preview

Instruction
pushad
mov esi, 0050D000h
lea edi, dword ptr [esi-0010C000h]
push edi
jmp 00007F08C8EF734Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F08C8EF7349h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F08C8EF732Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F08C8EF7349h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F08C8EF734Dh
jne 00007F08C8EF736Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F08C8EF7361h
dec eax
add ebx, ebx
jne 00007F08C8EF7349h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F08C8EF7316h
add ebx, ebx
jne 00007F08C8EF7349h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F08C8EF7394h
xor ecx, ecx
sub eax, 03h
jc 00007F08C8EF7353h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F08C8EF73B7h
sar eax, 1
mov ebp, eax
jmp 00007F08C8EF734Dh
add ebx, ebx
jne 00007F08C8EF7349h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F08C8EF730Eh
inc ecx
add ebx, ebx
jne 00007F08C8EF7349h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F08C8EF7300h
add ebx, ebx
jne 00007F08C8EF7349h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F08C8EF7331h
jne 00007F08C8EF734Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F08C8EF7326h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F08C8EF7350h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1ed840	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x163000	0x8a840	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1edc64	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x162c44	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x10c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x10d000	0x56000	0x55e00	3068eaff798efd25fba376a74becc907	False	0.9872464064774381	data	7.935578392322046	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x163000	0x8b000	0x8ae00	5c159fbf3d4ef645401aa34a46905f5c	False	0.8487391707920792	data	7.584238827929412	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x16351c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x163648	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x163774	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x1638a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	Great Britain	0.45567375886524825
RT_ICON	0x163d0c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	Great Britain	0.299953095684803
RT_ICON	0x164db8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	Great Britain	0.2274896265560166
RT_ICON	0x167364	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	Great Britain	0.18865139348134152
RT_ICON	0x16b590	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	Great Britain	0.13214243463858985
RT_MENU	0xdfd98	0x50	empty	English	Great Britain	0
RT_STRING	0xdfde8	0x594	empty	English	Great Britain	0
RT_STRING	0xe037c	0x68a	empty	English	Great Britain	0
RT_STRING	0xe0a08	0x490	empty	English	Great Britain	0
RT_STRING	0xe0e98	0x5fc	empty	English	Great Britain	0
RT_STRING	0xe1494	0x65c	empty	English	Great Britain	0
RT_STRING	0xe1af0	0x466	empty	English	Great Britain	0
RT_STRING	0xe1f58	0x158	empty	English	Great Britain	0
RT_RCDATA	0x17bdbc	0x71518	data			1.000325324462676
RT_GROUP_ICON	0x1ed2d8	0x4c	data	English	Great Britain	0.8157894736842105
RT_GROUP_ICON	0x1ed328	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1ed340	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1ed358	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1ed370	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1ed450	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	GetAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetOpenFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:00:29.402272940 CET	49709	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:29.408930063 CET	3678	49709	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:29.409374952 CET	49709	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:29.468940973 CET	49709	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:29.475450039 CET	3678	49709	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:30.826081038 CET	3678	49709	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:30.826193094 CET	49709	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:30.826268911 CET	49709	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:30.830982924 CET	3678	49709	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:31.938632965 CET	49711	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:31.943476915 CET	3678	49711	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:31.943597078 CET	49711	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:31.947273016 CET	49711	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:31.952069044 CET	3678	49711	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:33.352921009 CET	3678	49711	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:33.353013039 CET	49711	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:33.353080034 CET	49711	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:33.357913971 CET	3678	49711	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:34.363214970 CET	49713	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:34.368118048 CET	3678	49713	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:34.368242025 CET	49713	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:34.368796110 CET	49713	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:34.373647928 CET	3678	49713	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:36.655436993 CET	3678	49713	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:36.655642033 CET	49713	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:36.655709028 CET	49713	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:36.656002998 CET	3678	49713	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:36.656054974 CET	49713	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:36.657821894 CET	3678	49713	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:36.657857895 CET	49713	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:36.658525944 CET	3678	49713	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:36.658564091 CET	49713	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:36.664495945 CET	3678	49713	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:37.659827948 CET	49724	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:37.664638996 CET	3678	49724	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:37.664726973 CET	49724	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:37.665118933 CET	49724	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:37.669900894 CET	3678	49724	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:39.073668003 CET	3678	49724	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:39.073724031 CET	49724	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:39.073762894 CET	49724	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:39.078552961 CET	3678	49724	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:40.086357117 CET	49741	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:40.091119051 CET	3678	49741	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:40.091187954 CET	49741	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:40.092206001 CET	49741	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:40.096956968 CET	3678	49741	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:41.492341995 CET	3678	49741	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:41.492396116 CET	49741	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:41.492433071 CET	49741	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:41.497188091 CET	3678	49741	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:42.516319990 CET	49761	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:42.521187067 CET	3678	49761	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:42.521307945 CET	49761	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:42.521701097 CET	49761	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:42.526473045 CET	3678	49761	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:43.928692102 CET	3678	49761	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:43.928760052 CET	49761	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:43.928833961 CET	49761	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:43.933604002 CET	3678	49761	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:44.945909023 CET	49779	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:44.950795889 CET	3678	49779	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:44.950874090 CET	49779	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:44.952020884 CET	49779	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:44.956841946 CET	3678	49779	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:46.350888014 CET	3678	49779	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:46.350945950 CET	49779	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:46.350981951 CET	49779	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:46.357290030 CET	3678	49779	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:47.364278078 CET	49798	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:47.369302988 CET	3678	49798	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:47.369398117 CET	49798	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:47.369791031 CET	49798	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:47.374556065 CET	3678	49798	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:48.792607069 CET	3678	49798	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:48.792706966 CET	49798	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:48.792865038 CET	49798	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:48.797650099 CET	3678	49798	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:49.800491095 CET	49814	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:49.805433035 CET	3678	49814	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:49.805526972 CET	49814	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:49.806041956 CET	49814	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:49.810965061 CET	3678	49814	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:51.254915953 CET	3678	49814	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:51.254971981 CET	49814	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:51.255091906 CET	49814	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:51.259850979 CET	3678	49814	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:52.269462109 CET	49829	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:52.274346113 CET	3678	49829	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:52.274559021 CET	49829	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:52.275053024 CET	49829	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:52.279823065 CET	3678	49829	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:53.719511986 CET	3678	49829	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:53.719649076 CET	49829	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:53.719649076 CET	49829	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:53.724522114 CET	3678	49829	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:54.722616911 CET	49842	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:54.727524996 CET	3678	49842	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:54.727644920 CET	49842	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:54.728154898 CET	49842	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:54.732979059 CET	3678	49842	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:56.180541039 CET	3678	49842	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:56.180668116 CET	49842	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:56.180783987 CET	49842	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:56.185688972 CET	3678	49842	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:57.192374945 CET	49858	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:57.197257042 CET	3678	49858	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:57.197331905 CET	49858	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:57.198302031 CET	49858	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:57.203229904 CET	3678	49858	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:58.617378950 CET	3678	49858	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:58.617515087 CET	49858	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:58.617515087 CET	49858	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:58.622353077 CET	3678	49858	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:59.628940105 CET	49877	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:59.634274006 CET	3678	49877	192.210.150.26	192.168.2.6
Jan 10, 2025 23:00:59.634370089 CET	49877	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:59.634762049 CET	49877	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:00:59.639600039 CET	3678	49877	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:01.041819096 CET	3678	49877	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:01.041908026 CET	49877	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:01.041985035 CET	49877	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:01.046705961 CET	3678	49877	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:02.050565958 CET	49893	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:02.055396080 CET	3678	49893	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:02.055484056 CET	49893	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:02.055856943 CET	49893	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:02.060683966 CET	3678	49893	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:03.499007940 CET	3678	49893	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:03.500713110 CET	49893	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:03.502192974 CET	49893	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:03.506899118 CET	3678	49893	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:04.519248009 CET	49908	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:04.527195930 CET	3678	49908	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:04.527276039 CET	49908	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:04.527658939 CET	49908	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:04.532696962 CET	3678	49908	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:05.997715950 CET	3678	49908	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:05.997931957 CET	49908	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:05.997931957 CET	49908	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:06.002770901 CET	3678	49908	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:07.003715992 CET	49921	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:07.008642912 CET	3678	49921	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:07.008771896 CET	49921	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:07.009273052 CET	49921	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:07.014039040 CET	3678	49921	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:08.446800947 CET	3678	49921	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:08.446901083 CET	49921	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:08.446954966 CET	49921	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:08.451867104 CET	3678	49921	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:09.456795931 CET	49937	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:09.461700916 CET	3678	49937	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:09.461786032 CET	49937	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:09.462162971 CET	49937	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:09.466974020 CET	3678	49937	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:11.000953913 CET	3678	49937	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:11.001313925 CET	49937	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:11.001313925 CET	49937	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:11.006128073 CET	3678	49937	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:12.004331112 CET	49955	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:12.009166002 CET	3678	49955	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:12.012330055 CET	49955	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:12.012999058 CET	49955	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:12.017822981 CET	3678	49955	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:13.432360888 CET	3678	49955	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:13.432449102 CET	49955	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:13.432487011 CET	49955	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:13.437354088 CET	3678	49955	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:14.442095995 CET	49971	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:14.447165012 CET	3678	49971	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:14.447341919 CET	49971	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:14.448055983 CET	49971	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:14.452811956 CET	3678	49971	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:15.928606033 CET	3678	49971	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:15.928809881 CET	49971	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:15.928809881 CET	49971	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:15.933604956 CET	3678	49971	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:16.941195011 CET	49988	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:16.946022034 CET	3678	49988	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:16.946091890 CET	49988	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:16.946590900 CET	49988	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:16.951355934 CET	3678	49988	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:18.354707956 CET	3678	49988	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:18.354785919 CET	49988	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:18.354831934 CET	49988	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:18.359587908 CET	3678	49988	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:19.366209030 CET	50005	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:19.371119022 CET	3678	50005	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:19.371279001 CET	50005	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:19.371772051 CET	50005	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:19.376616001 CET	3678	50005	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:20.808783054 CET	3678	50005	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:20.808908939 CET	50005	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:20.808958054 CET	50005	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:20.813899040 CET	3678	50005	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:21.816438913 CET	50006	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:21.821413994 CET	3678	50006	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:21.821494102 CET	50006	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:21.821959019 CET	50006	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:21.826710939 CET	3678	50006	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:23.231592894 CET	3678	50006	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:23.231719971 CET	50006	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:23.231808901 CET	50006	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:23.236665010 CET	3678	50006	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:24.238197088 CET	50008	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:24.243177891 CET	3678	50008	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:24.243294001 CET	50008	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:24.243694067 CET	50008	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:24.248574972 CET	3678	50008	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:25.649034977 CET	3678	50008	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:25.652085066 CET	50008	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:25.652123928 CET	50008	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:25.656959057 CET	3678	50008	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:26.659940958 CET	50009	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:26.664884090 CET	3678	50009	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:26.664963007 CET	50009	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:26.665360928 CET	50009	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:26.670198917 CET	3678	50009	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:28.091897964 CET	3678	50009	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:28.092050076 CET	50009	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:28.092138052 CET	50009	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:28.096957922 CET	3678	50009	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:29.097538948 CET	50010	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:29.102452040 CET	3678	50010	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:29.106125116 CET	50010	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:29.106560946 CET	50010	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:29.111468077 CET	3678	50010	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:30.510999918 CET	3678	50010	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:30.511221886 CET	50010	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:30.511221886 CET	50010	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:30.516048908 CET	3678	50010	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:31.519427061 CET	50011	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:31.524512053 CET	3678	50011	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:31.524611950 CET	50011	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:31.524979115 CET	50011	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:31.529731035 CET	3678	50011	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:32.964488029 CET	3678	50011	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:32.964597940 CET	50011	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:32.964648962 CET	50011	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:32.969440937 CET	3678	50011	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:33.972352028 CET	50012	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:33.977340937 CET	3678	50012	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:33.977418900 CET	50012	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:33.977694988 CET	50012	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:33.982538939 CET	3678	50012	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:35.386995077 CET	3678	50012	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:35.387212038 CET	50012	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:35.387212038 CET	50012	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:35.392060995 CET	3678	50012	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:36.394407988 CET	50013	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:36.399565935 CET	3678	50013	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:36.400237083 CET	50013	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:36.400509119 CET	50013	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:36.405328989 CET	3678	50013	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:37.805211067 CET	3678	50013	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:37.805371046 CET	50013	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:37.805541039 CET	50013	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:37.810322046 CET	3678	50013	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:38.816343069 CET	50015	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:38.821271896 CET	3678	50015	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:38.826126099 CET	50015	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:38.826379061 CET	50015	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:38.831409931 CET	3678	50015	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:40.251535892 CET	3678	50015	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:40.251635075 CET	50015	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:40.251698971 CET	50015	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:40.256491899 CET	3678	50015	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:41.253679991 CET	50016	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:41.258678913 CET	3678	50016	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:41.258924007 CET	50016	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:41.259088039 CET	50016	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:41.263952017 CET	3678	50016	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:42.663840055 CET	3678	50016	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:42.663959026 CET	50016	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:42.664020061 CET	50016	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:42.668905020 CET	3678	50016	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:43.675574064 CET	50017	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:43.680597067 CET	3678	50017	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:43.680675983 CET	50017	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:43.680923939 CET	50017	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:43.685688972 CET	3678	50017	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:45.110914946 CET	3678	50017	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:45.110989094 CET	50017	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:45.111082077 CET	50017	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:45.115981102 CET	3678	50017	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:46.124742985 CET	50018	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:46.668261051 CET	3678	50018	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:46.668387890 CET	50018	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:46.668952942 CET	50018	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:46.675213099 CET	3678	50018	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:48.073779106 CET	3678	50018	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:48.074188948 CET	50018	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:48.074188948 CET	50018	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:48.079099894 CET	3678	50018	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:49.081864119 CET	50020	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:49.086833000 CET	3678	50020	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:49.086909056 CET	50020	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:49.087250948 CET	50020	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:49.092050076 CET	3678	50020	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:50.514153004 CET	3678	50020	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:50.514614105 CET	50020	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:50.514614105 CET	50020	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:50.519432068 CET	3678	50020	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:51.488185883 CET	50021	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:51.493236065 CET	3678	50021	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:51.493316889 CET	50021	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:51.493566036 CET	50021	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:51.498415947 CET	3678	50021	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:52.898313046 CET	3678	50021	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:52.902139902 CET	50021	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:52.902206898 CET	50021	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:52.907016993 CET	3678	50021	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:53.847803116 CET	50022	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:53.983208895 CET	3678	50022	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:53.986354113 CET	50022	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:53.986538887 CET	50022	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:53.991373062 CET	3678	50022	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:55.406275988 CET	3678	50022	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:55.406356096 CET	50022	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:55.406394005 CET	50022	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:55.411266088 CET	3678	50022	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:56.316282034 CET	50023	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:56.321300030 CET	3678	50023	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:56.326184988 CET	50023	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:56.326471090 CET	50023	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:56.331283092 CET	3678	50023	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:57.747129917 CET	3678	50023	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:57.749159098 CET	50023	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:57.749181986 CET	50023	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:57.754065990 CET	3678	50023	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:58.628973007 CET	50024	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:58.634033918 CET	3678	50024	192.210.150.26	192.168.2.6
Jan 10, 2025 23:01:58.634115934 CET	50024	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:58.634712934 CET	50024	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:01:58.639656067 CET	3678	50024	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:00.087610960 CET	3678	50024	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:00.087697983 CET	50024	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:00.087747097 CET	50024	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:00.092592955 CET	3678	50024	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:00.941200972 CET	50025	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:00.946208000 CET	3678	50025	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:00.946372032 CET	50025	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:00.946790934 CET	50025	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:00.951658010 CET	3678	50025	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:02.353312969 CET	3678	50025	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:02.354147911 CET	50025	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:02.355880976 CET	50025	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:02.360661983 CET	3678	50025	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:03.175657034 CET	50026	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:03.180603027 CET	3678	50026	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:03.180707932 CET	50026	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:03.181015968 CET	50026	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:03.185936928 CET	3678	50026	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:04.587888002 CET	3678	50026	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:04.588177919 CET	50026	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:04.588177919 CET	50026	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:04.597364902 CET	3678	50026	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:05.378707886 CET	50028	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:05.383615017 CET	3678	50028	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:05.383701086 CET	50028	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:05.383980036 CET	50028	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:05.388788939 CET	3678	50028	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:06.789963961 CET	3678	50028	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:06.790057898 CET	50028	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:06.790122986 CET	50028	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:06.794986963 CET	3678	50028	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:07.566159010 CET	50029	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:07.571074963 CET	3678	50029	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:07.571177959 CET	50029	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:07.571463108 CET	50029	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:07.576308966 CET	3678	50029	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:09.016295910 CET	3678	50029	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:09.016366959 CET	50029	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:09.016407967 CET	50029	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:09.021429062 CET	3678	50029	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:09.769516945 CET	50030	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:09.774620056 CET	3678	50030	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:09.774694920 CET	50030	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:09.775046110 CET	50030	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:09.779849052 CET	3678	50030	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:11.203423023 CET	3678	50030	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:11.203490019 CET	50030	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:11.203545094 CET	50030	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:11.208312035 CET	3678	50030	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:11.925803900 CET	50031	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:11.930738926 CET	3678	50031	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:11.930824995 CET	50031	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:11.931128979 CET	50031	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:11.935951948 CET	3678	50031	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:13.359755039 CET	3678	50031	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:13.359837055 CET	50031	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:13.359877110 CET	50031	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:13.364700079 CET	3678	50031	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:14.053364992 CET	50032	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:14.063458920 CET	3678	50032	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:14.063865900 CET	50032	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:14.064052105 CET	50032	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:14.068864107 CET	3678	50032	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:15.461463928 CET	3678	50032	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:15.461548090 CET	50032	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:15.461570978 CET	50032	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:15.466496944 CET	3678	50032	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:16.130397081 CET	50033	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:16.135243893 CET	3678	50033	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:16.138451099 CET	50033	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:16.138451099 CET	50033	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:16.143392086 CET	3678	50033	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:17.551599026 CET	3678	50033	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:17.551691055 CET	50033	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:17.555238962 CET	50033	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:17.560112000 CET	3678	50033	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:18.207168102 CET	50034	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:18.212002039 CET	3678	50034	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:18.212086916 CET	50034	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:18.212413073 CET	50034	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:18.217181921 CET	3678	50034	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:19.633235931 CET	3678	50034	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:19.633313894 CET	50034	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:19.633395910 CET	50034	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:19.638231993 CET	3678	50034	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:20.270953894 CET	50035	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:20.275975943 CET	3678	50035	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:20.276092052 CET	50035	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:20.276370049 CET	50035	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:20.281213045 CET	3678	50035	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:21.703485012 CET	3678	50035	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:21.703596115 CET	50035	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:21.703679085 CET	50035	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:21.708470106 CET	3678	50035	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:22.316304922 CET	50036	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:22.325476885 CET	3678	50036	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:22.326217890 CET	50036	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:22.326514959 CET	50036	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:22.331289053 CET	3678	50036	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:23.768189907 CET	3678	50036	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:23.768357038 CET	50036	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:23.768415928 CET	50036	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:23.773241043 CET	3678	50036	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:24.363398075 CET	50037	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:24.368275881 CET	3678	50037	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:24.368629932 CET	50037	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:24.368629932 CET	50037	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:24.373574972 CET	3678	50037	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:25.797127008 CET	3678	50037	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:25.797221899 CET	50037	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:25.797255039 CET	50037	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:25.802009106 CET	3678	50037	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:26.374181986 CET	50038	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:26.379128933 CET	3678	50038	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:26.382539034 CET	50038	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:26.382539034 CET	50038	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:26.387428045 CET	3678	50038	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:27.880311966 CET	3678	50038	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:27.880384922 CET	50038	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:27.880440950 CET	50038	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:27.885282993 CET	3678	50038	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:28.425647974 CET	50039	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:28.430471897 CET	3678	50039	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:28.430551052 CET	50039	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:28.430823088 CET	50039	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:28.435607910 CET	3678	50039	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:29.840378046 CET	3678	50039	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:29.840440035 CET	50039	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:29.840491056 CET	50039	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:29.845405102 CET	3678	50039	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:30.382529020 CET	50040	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:30.387518883 CET	3678	50040	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:30.387710094 CET	50040	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:30.388016939 CET	50040	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:30.392821074 CET	3678	50040	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:31.825633049 CET	3678	50040	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:31.825771093 CET	50040	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:31.825956106 CET	50040	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:31.830754995 CET	3678	50040	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:32.377168894 CET	50041	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:32.382059097 CET	3678	50041	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:32.382181883 CET	50041	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:32.382611990 CET	50041	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:32.387481928 CET	3678	50041	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:33.811764956 CET	3678	50041	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:33.811851025 CET	50041	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:33.811889887 CET	50041	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:33.816669941 CET	3678	50041	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:34.316545963 CET	50043	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:34.321430922 CET	3678	50043	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:34.322257996 CET	50043	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:34.322504997 CET	50043	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:34.327378988 CET	3678	50043	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:35.730952024 CET	3678	50043	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:35.731021881 CET	50043	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:35.731112957 CET	50043	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:35.735915899 CET	3678	50043	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:36.207283020 CET	50044	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:36.212135077 CET	3678	50044	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:36.212230921 CET	50044	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:36.212517977 CET	50044	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:36.217262030 CET	3678	50044	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:37.618680000 CET	3678	50044	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:37.618733883 CET	50044	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:37.618827105 CET	50044	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:37.623600960 CET	3678	50044	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:38.084503889 CET	50045	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:38.089436054 CET	3678	50045	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:38.089775085 CET	50045	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:38.090795994 CET	50045	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:38.095612049 CET	3678	50045	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:39.530529976 CET	3678	50045	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:39.530666113 CET	50045	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:39.530720949 CET	50045	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:39.535641909 CET	3678	50045	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:39.988354921 CET	50046	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:39.993232965 CET	3678	50046	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:39.993321896 CET	50046	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:39.993562937 CET	50046	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:39.998347998 CET	3678	50046	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:41.402240038 CET	3678	50046	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:41.402358055 CET	50046	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:41.402394056 CET	50046	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:41.536567926 CET	3678	50046	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:41.832026005 CET	50047	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:41.949831963 CET	3678	50047	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:41.949928045 CET	50047	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:41.950190067 CET	50047	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:41.954952955 CET	3678	50047	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:43.352359056 CET	3678	50047	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:43.352444887 CET	50047	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:43.352505922 CET	50047	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:43.357331991 CET	3678	50047	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:43.770486116 CET	50048	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:43.775405884 CET	3678	50048	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:43.775477886 CET	50048	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:43.775779963 CET	50048	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:43.780597925 CET	3678	50048	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:45.181794882 CET	3678	50048	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:45.181874037 CET	50048	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:45.181967974 CET	50048	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:45.186845064 CET	3678	50048	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:45.597804070 CET	50049	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:45.602739096 CET	3678	50049	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:45.602854013 CET	50049	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:45.603130102 CET	50049	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:45.607963085 CET	3678	50049	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:47.034158945 CET	3678	50049	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:47.034303904 CET	50049	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:47.034303904 CET	50049	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:47.039186954 CET	3678	50049	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:47.425916910 CET	50050	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:47.431116104 CET	3678	50050	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:47.431245089 CET	50050	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:47.431543112 CET	50050	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:47.436456919 CET	3678	50050	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:48.857239962 CET	3678	50050	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:48.857378006 CET	50050	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:48.857426882 CET	50050	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:48.862319946 CET	3678	50050	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:49.238598108 CET	50051	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:49.243547916 CET	3678	50051	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:49.243638039 CET	50051	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:49.244013071 CET	50051	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:49.248820066 CET	3678	50051	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:50.967683077 CET	3678	50051	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:50.967788935 CET	3678	50051	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:50.967967033 CET	50051	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:50.968070984 CET	50051	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:50.968070984 CET	50051	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:50.973005056 CET	3678	50051	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:51.331998110 CET	50052	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:51.337034941 CET	3678	50052	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:51.337121964 CET	50052	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:51.337477922 CET	50052	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:51.342308044 CET	3678	50052	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:52.743444920 CET	3678	50052	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:52.744297028 CET	50052	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:52.749596119 CET	50052	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:52.754544020 CET	3678	50052	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:53.113054037 CET	50053	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:53.118097067 CET	3678	50053	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:53.118417025 CET	50053	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:53.118511915 CET	50053	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:53.123294115 CET	3678	50053	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:54.530251026 CET	3678	50053	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:54.530350924 CET	50053	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:54.530435085 CET	50053	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:54.535275936 CET	3678	50053	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:54.878700972 CET	50054	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:54.883752108 CET	3678	50054	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:54.883835077 CET	50054	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:54.884157896 CET	50054	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:54.888969898 CET	3678	50054	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:56.292006969 CET	3678	50054	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:56.292104006 CET	50054	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:56.292143106 CET	50054	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:56.296900034 CET	3678	50054	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:56.628601074 CET	50055	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:56.659164906 CET	3678	50055	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:56.659270048 CET	50055	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:56.659605026 CET	50055	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:56.664339066 CET	3678	50055	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:58.099220991 CET	3678	50055	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:58.099328995 CET	50055	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:58.099329948 CET	50055	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:58.104087114 CET	3678	50055	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:58.425468922 CET	50056	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:58.430598021 CET	3678	50056	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:58.430701017 CET	50056	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:58.430965900 CET	50056	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:58.435806990 CET	3678	50056	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:59.841419935 CET	3678	50056	192.210.150.26	192.168.2.6
Jan 10, 2025 23:02:59.841519117 CET	50056	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:59.841519117 CET	50056	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:02:59.846514940 CET	3678	50056	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:00.160048008 CET	50057	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:00.165308952 CET	3678	50057	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:00.165394068 CET	50057	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:00.165762901 CET	50057	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:00.170598030 CET	3678	50057	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:01.573376894 CET	3678	50057	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:01.576381922 CET	50057	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:01.576381922 CET	50057	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:01.581319094 CET	3678	50057	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:01.878652096 CET	50058	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:01.883548021 CET	3678	50058	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:01.883635998 CET	50058	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:01.884054899 CET	50058	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:01.889003038 CET	3678	50058	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:03.310815096 CET	3678	50058	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:03.311079979 CET	50058	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:03.311079979 CET	50058	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:03.315924883 CET	3678	50058	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:03.597333908 CET	50059	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:03.602435112 CET	3678	50059	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:03.602591991 CET	50059	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:03.604295015 CET	50059	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:03.609025955 CET	3678	50059	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:05.012716055 CET	3678	50059	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:05.012787104 CET	50059	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:05.012819052 CET	50059	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:05.017721891 CET	3678	50059	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:05.300626040 CET	50060	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:05.305772066 CET	3678	50060	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:05.305882931 CET	50060	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:05.306266069 CET	50060	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:05.311124086 CET	3678	50060	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:06.714276075 CET	3678	50060	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:06.714360952 CET	50060	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:06.714396000 CET	50060	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:06.719187975 CET	3678	50060	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:06.988183975 CET	50061	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:06.993303061 CET	3678	50061	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:06.993700027 CET	50061	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:06.993987083 CET	50061	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:06.998828888 CET	3678	50061	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:08.423423052 CET	3678	50061	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:08.423501968 CET	50061	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:08.423544884 CET	50061	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:08.428448915 CET	3678	50061	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:08.691137075 CET	50062	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:08.695987940 CET	3678	50062	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:08.696084023 CET	50062	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:08.696361065 CET	50062	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:08.701144934 CET	3678	50062	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:10.124633074 CET	3678	50062	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:10.124731064 CET	50062	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:10.124825954 CET	50062	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:10.129698992 CET	3678	50062	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:10.380815029 CET	50064	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:10.385940075 CET	3678	50064	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:10.386054039 CET	50064	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:10.386485100 CET	50064	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:10.391350985 CET	3678	50064	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:11.814421892 CET	3678	50064	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:11.814557076 CET	50064	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:11.814687967 CET	50064	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:11.819561005 CET	3678	50064	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:12.066169024 CET	50066	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:12.072491884 CET	3678	50066	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:12.072593927 CET	50066	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:12.072832108 CET	50066	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:12.077758074 CET	3678	50066	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:13.482043028 CET	3678	50066	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:13.482187986 CET	50066	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:13.482232094 CET	50066	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:13.487240076 CET	3678	50066	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:13.722476006 CET	50067	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:13.727650881 CET	3678	50067	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:13.728753090 CET	50067	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:13.729115009 CET	50067	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:13.734006882 CET	3678	50067	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:15.138307095 CET	3678	50067	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:15.138364077 CET	50067	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:15.138417959 CET	50067	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:15.143182039 CET	3678	50067	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:15.378854036 CET	50068	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:15.384167910 CET	3678	50068	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:15.384247065 CET	50068	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:15.384777069 CET	50068	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:15.389707088 CET	3678	50068	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:16.879657030 CET	3678	50068	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:16.879729986 CET	50068	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:16.879781008 CET	50068	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:16.885112047 CET	3678	50068	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:17.097454071 CET	50069	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:17.102547884 CET	3678	50069	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:17.102649927 CET	50069	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:17.103030920 CET	50069	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:17.107914925 CET	3678	50069	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:18.513403893 CET	3678	50069	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:18.513485909 CET	50069	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:18.513588905 CET	50069	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:18.518383980 CET	3678	50069	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:18.738118887 CET	50070	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:18.743465900 CET	3678	50070	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:18.746418953 CET	50070	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:18.750328064 CET	50070	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:18.757086992 CET	3678	50070	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:20.175512075 CET	3678	50070	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:20.178502083 CET	50070	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:20.178502083 CET	50070	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:20.184608936 CET	3678	50070	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:20.394495010 CET	50071	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:20.399730921 CET	3678	50071	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:20.402172089 CET	50071	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:20.402436972 CET	50071	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:20.407440901 CET	3678	50071	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:21.810323954 CET	3678	50071	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:21.810437918 CET	50071	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:21.810525894 CET	50071	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:21.815476894 CET	3678	50071	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:22.019397020 CET	50072	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:22.024626970 CET	3678	50072	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:22.024760008 CET	50072	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:22.025051117 CET	50072	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:22.029942036 CET	3678	50072	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:23.435425043 CET	3678	50072	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:23.435513020 CET	50072	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:23.435559988 CET	50072	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:23.441179037 CET	3678	50072	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:23.628787041 CET	50073	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:23.635169983 CET	3678	50073	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:23.635261059 CET	50073	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:23.635600090 CET	50073	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:23.640465021 CET	3678	50073	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:25.066384077 CET	3678	50073	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:25.070328951 CET	50073	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:25.087697029 CET	50073	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:25.092658997 CET	3678	50073	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:25.289434910 CET	50074	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:25.294408083 CET	3678	50074	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:25.294509888 CET	50074	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:25.296459913 CET	50074	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:25.301342010 CET	3678	50074	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:26.720217943 CET	3678	50074	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:26.720294952 CET	50074	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:26.720340014 CET	50074	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:26.725904942 CET	3678	50074	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:26.909995079 CET	50075	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:26.915570021 CET	3678	50075	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:26.915664911 CET	50075	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:26.915957928 CET	50075	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:26.921526909 CET	3678	50075	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:28.330053091 CET	3678	50075	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:28.330136061 CET	50075	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:28.330208063 CET	50075	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:28.335015059 CET	3678	50075	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:28.504008055 CET	50076	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:28.509038925 CET	3678	50076	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:28.509130955 CET	50076	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:28.509428024 CET	50076	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:28.515152931 CET	3678	50076	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:29.916742086 CET	3678	50076	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:29.916800976 CET	50076	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:29.917315960 CET	50076	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:29.922080040 CET	3678	50076	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:30.097779989 CET	50077	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:30.102670908 CET	3678	50077	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:30.102775097 CET	50077	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:30.103290081 CET	50077	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:30.108035088 CET	3678	50077	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:31.494419098 CET	3678	50077	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:31.494498968 CET	50077	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:31.494558096 CET	50077	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:31.499337912 CET	3678	50077	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:31.660018921 CET	50078	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:31.665153980 CET	3678	50078	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:31.665307045 CET	50078	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:31.665582895 CET	50078	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:31.670433044 CET	3678	50078	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:33.138664961 CET	3678	50078	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:33.138818979 CET	50078	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:33.142271042 CET	50078	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:33.147080898 CET	3678	50078	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:33.300668001 CET	50079	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:33.306307077 CET	3678	50079	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:33.306379080 CET	50079	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:33.306633949 CET	50079	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:33.312041044 CET	3678	50079	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:34.697536945 CET	3678	50079	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:34.697648048 CET	50079	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:34.697648048 CET	50079	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:34.702635050 CET	3678	50079	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:34.864996910 CET	50080	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:34.870659113 CET	3678	50080	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:34.870800018 CET	50080	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:34.870986938 CET	50080	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:34.875983953 CET	3678	50080	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:36.276011944 CET	3678	50080	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:36.276113033 CET	50080	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:36.276153088 CET	50080	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:36.281011105 CET	3678	50080	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:36.426708937 CET	50081	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:36.431689978 CET	3678	50081	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:36.431813002 CET	50081	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:36.432271004 CET	50081	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:36.437128067 CET	3678	50081	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:37.861536980 CET	3678	50081	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:37.861608982 CET	50081	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:37.861645937 CET	50081	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:37.866523027 CET	3678	50081	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:38.003917933 CET	50082	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:38.151204109 CET	3678	50082	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:38.151376009 CET	50082	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:38.151695013 CET	50082	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:38.156584978 CET	3678	50082	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:39.560554981 CET	3678	50082	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:39.560622931 CET	50082	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:39.560694933 CET	50082	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:39.565432072 CET	3678	50082	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:39.707185030 CET	50083	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:39.712088108 CET	3678	50083	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:39.712188005 CET	50083	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:39.712526083 CET	50083	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:39.717502117 CET	3678	50083	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:41.137955904 CET	3678	50083	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:41.138019085 CET	50083	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:41.138058901 CET	50083	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:41.144330978 CET	3678	50083	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:41.285068035 CET	50084	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:41.428482056 CET	3678	50084	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:41.428570986 CET	50084	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:41.428858042 CET	50084	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:41.433636904 CET	3678	50084	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:42.821907997 CET	3678	50084	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:42.822410107 CET	50084	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:42.822458029 CET	50084	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:42.828085899 CET	3678	50084	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:42.962150097 CET	50085	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:42.967159033 CET	3678	50085	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:42.970427990 CET	50085	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:42.977890968 CET	50085	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:42.982692003 CET	3678	50085	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:44.369239092 CET	3678	50085	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:44.369344950 CET	50085	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:44.369345903 CET	50085	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:44.374293089 CET	3678	50085	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:44.503767014 CET	50086	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:44.508634090 CET	3678	50086	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:44.508758068 CET	50086	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:44.509042978 CET	50086	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:44.514103889 CET	3678	50086	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:45.938919067 CET	3678	50086	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:45.939003944 CET	50086	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:45.939093113 CET	50086	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:45.943885088 CET	3678	50086	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:46.066339016 CET	50087	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:46.071352959 CET	3678	50087	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:46.071439028 CET	50087	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:46.071726084 CET	50087	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:46.076535940 CET	3678	50087	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:47.498325109 CET	3678	50087	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:47.498414993 CET	50087	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:47.498508930 CET	50087	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:47.504422903 CET	3678	50087	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:47.613233089 CET	50088	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:47.618309975 CET	3678	50088	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:47.618393898 CET	50088	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:47.618681908 CET	50088	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:47.623552084 CET	3678	50088	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:49.028918982 CET	3678	50088	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:49.028992891 CET	50088	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:49.029122114 CET	50088	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:49.036025047 CET	3678	50088	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:49.144351006 CET	50089	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:49.149326086 CET	3678	50089	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:49.149418116 CET	50089	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:49.149727106 CET	50089	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:49.154521942 CET	3678	50089	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:50.577127934 CET	3678	50089	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:50.577228069 CET	50089	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:50.577229023 CET	50089	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:50.582094908 CET	3678	50089	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:50.691299915 CET	50090	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:50.696860075 CET	3678	50090	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:50.696958065 CET	50090	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:50.697206020 CET	50090	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:50.702924967 CET	3678	50090	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:52.108717918 CET	3678	50090	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:52.108867884 CET	50090	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:52.108903885 CET	50090	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:52.113679886 CET	3678	50090	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:52.222619057 CET	50091	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:52.227688074 CET	3678	50091	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:52.227791071 CET	50091	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:52.228002071 CET	50091	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:52.232858896 CET	3678	50091	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:53.674038887 CET	3678	50091	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:53.674232960 CET	50091	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:53.674232960 CET	50091	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:53.679074049 CET	3678	50091	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:53.784941912 CET	50092	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:53.789866924 CET	3678	50092	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:53.789959908 CET	50092	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:53.790231943 CET	50092	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:53.796318054 CET	3678	50092	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:55.225059986 CET	3678	50092	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:55.225127935 CET	50092	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:55.225161076 CET	50092	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:55.230021000 CET	3678	50092	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:55.331990004 CET	50093	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:55.336863995 CET	3678	50093	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:55.336949110 CET	50093	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:55.337388039 CET	50093	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:55.342190027 CET	3678	50093	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:56.749411106 CET	3678	50093	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:56.749564886 CET	50093	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:56.749564886 CET	50093	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:56.754585028 CET	3678	50093	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:56.849203110 CET	50094	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:56.854181051 CET	3678	50094	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:56.855153084 CET	50094	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:56.855742931 CET	50094	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:56.860606909 CET	3678	50094	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:58.301171064 CET	3678	50094	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:58.301398993 CET	50094	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:58.301398993 CET	50094	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:58.306322098 CET	3678	50094	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:58.394454002 CET	50095	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:58.399580956 CET	3678	50095	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:58.399763107 CET	50095	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:58.400065899 CET	50095	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:58.405006886 CET	3678	50095	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:59.811956882 CET	3678	50095	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:59.812037945 CET	50095	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:59.812138081 CET	50095	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:59.816891909 CET	3678	50095	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:59.949358940 CET	50096	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:59.954355001 CET	3678	50096	192.210.150.26	192.168.2.6
Jan 10, 2025 23:03:59.954435110 CET	50096	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:59.954953909 CET	50096	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:03:59.959836006 CET	3678	50096	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:01.371537924 CET	3678	50096	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:01.372836113 CET	50096	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:01.372878075 CET	50096	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:01.377753973 CET	3678	50096	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:01.472631931 CET	50097	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:01.477696896 CET	3678	50097	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:01.477823019 CET	50097	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:01.478075981 CET	50097	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:01.482943058 CET	3678	50097	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:02.887901068 CET	3678	50097	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:02.887958050 CET	50097	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:02.888004065 CET	50097	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:02.892838955 CET	3678	50097	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:02.972548008 CET	50098	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:02.978501081 CET	3678	50098	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:02.978606939 CET	50098	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:02.978913069 CET	50098	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:02.983925104 CET	3678	50098	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:04.369648933 CET	3678	50098	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:04.369796038 CET	50098	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:04.369796038 CET	50098	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:04.374655008 CET	3678	50098	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:04.458396912 CET	50100	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:04.463252068 CET	3678	50100	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:04.463546991 CET	50100	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:04.463824987 CET	50100	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:04.468578100 CET	3678	50100	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:05.873164892 CET	3678	50100	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:05.873337030 CET	50100	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:05.873337030 CET	50100	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:05.878108978 CET	3678	50100	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:05.956996918 CET	50101	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:05.961874962 CET	3678	50101	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:05.961947918 CET	50101	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:05.962235928 CET	50101	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:05.967408895 CET	3678	50101	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:07.386312962 CET	3678	50101	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:07.386382103 CET	50101	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:07.386446953 CET	50101	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:07.391288042 CET	3678	50101	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:07.472959042 CET	50102	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:07.477945089 CET	3678	50102	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:07.478080034 CET	50102	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:07.478773117 CET	50102	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:07.483586073 CET	3678	50102	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:08.888150930 CET	3678	50102	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:08.888329029 CET	50102	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:08.888329029 CET	50102	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:08.893198013 CET	3678	50102	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:08.972477913 CET	50103	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:08.977294922 CET	3678	50103	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:08.977379084 CET	50103	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:08.977664948 CET	50103	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:08.982470989 CET	3678	50103	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:10.369810104 CET	3678	50103	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:10.370498896 CET	50103	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:10.370882988 CET	50103	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:10.375688076 CET	3678	50103	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:10.441268921 CET	50104	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:10.446264029 CET	3678	50104	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:10.446536064 CET	50104	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:10.447011948 CET	50104	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:10.451901913 CET	3678	50104	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:11.854808092 CET	3678	50104	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:11.854883909 CET	50104	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:11.854963064 CET	50104	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:11.859714985 CET	3678	50104	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:11.925708055 CET	50105	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:11.930535078 CET	3678	50105	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:11.930619955 CET	50105	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:11.930881977 CET	50105	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:11.935630083 CET	3678	50105	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:13.323457003 CET	3678	50105	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:13.323534966 CET	50105	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:13.323615074 CET	50105	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:13.328412056 CET	3678	50105	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:13.394952059 CET	50106	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:13.400053978 CET	3678	50106	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:13.400126934 CET	50106	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:13.400547981 CET	50106	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:13.405307055 CET	3678	50106	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:14.810117960 CET	3678	50106	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:14.810211897 CET	50106	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:14.810211897 CET	50106	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:14.815042019 CET	3678	50106	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:14.878952026 CET	50107	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:14.883972883 CET	3678	50107	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:14.884063005 CET	50107	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:14.884448051 CET	50107	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:14.889241934 CET	3678	50107	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:16.299868107 CET	3678	50107	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:16.299952984 CET	50107	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:16.300002098 CET	50107	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:16.304878950 CET	3678	50107	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:16.363368034 CET	50108	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:16.368458986 CET	3678	50108	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:16.368555069 CET	50108	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:16.369009972 CET	50108	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:16.373898983 CET	3678	50108	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:17.784466982 CET	3678	50108	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:17.786539078 CET	50108	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:17.786539078 CET	50108	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:17.791369915 CET	3678	50108	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:17.847520113 CET	50109	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:17.852427959 CET	3678	50109	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:17.854501963 CET	50109	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:17.854765892 CET	50109	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:17.859561920 CET	3678	50109	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:19.324090958 CET	3678	50109	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:19.324198008 CET	50109	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:19.324198008 CET	50109	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:19.329117060 CET	3678	50109	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:19.394553900 CET	50110	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:19.399558067 CET	3678	50110	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:19.399648905 CET	50110	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:19.400122881 CET	50110	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:19.404923916 CET	3678	50110	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:20.827893019 CET	3678	50110	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:20.830543995 CET	50110	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:20.830595970 CET	50110	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:20.835522890 CET	3678	50110	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:20.894578934 CET	50111	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:20.899565935 CET	3678	50111	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:20.902515888 CET	50111	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:20.902761936 CET	50111	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:20.907613993 CET	3678	50111	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:22.312163115 CET	3678	50111	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:22.312225103 CET	50111	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:22.312266111 CET	50111	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:22.317037106 CET	3678	50111	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:22.378875017 CET	50112	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:22.383919001 CET	3678	50112	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:22.384005070 CET	50112	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:22.384248972 CET	50112	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:22.389084101 CET	3678	50112	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:23.792597055 CET	3678	50112	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:23.794529915 CET	50112	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:23.794550896 CET	50112	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:23.799380064 CET	3678	50112	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:23.848098993 CET	50113	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:23.852987051 CET	3678	50113	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:23.853080034 CET	50113	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:23.853477001 CET	50113	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:23.858275890 CET	3678	50113	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:25.264827967 CET	3678	50113	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:25.264955997 CET	50113	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:25.264997005 CET	50113	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:25.269809961 CET	3678	50113	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:25.316529036 CET	50114	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:25.321443081 CET	3678	50114	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:25.321556091 CET	50114	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:25.321960926 CET	50114	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:25.326740980 CET	3678	50114	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:26.734154940 CET	3678	50114	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:26.734586000 CET	50114	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:26.734635115 CET	50114	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:26.739523888 CET	3678	50114	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:26.785032034 CET	50115	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:26.790127993 CET	3678	50115	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:26.790227890 CET	50115	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:26.790483952 CET	50115	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:26.795452118 CET	3678	50115	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:28.199307919 CET	3678	50115	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:28.199399948 CET	50115	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:28.199450016 CET	50115	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:28.204312086 CET	3678	50115	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:28.253923893 CET	50116	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:28.258928061 CET	3678	50116	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:28.259031057 CET	50116	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:28.259263992 CET	50116	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:28.264086008 CET	3678	50116	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:29.711582899 CET	3678	50116	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:29.712572098 CET	50116	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:29.723038912 CET	50116	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:29.727935076 CET	3678	50116	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:29.770653963 CET	50117	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:29.775495052 CET	3678	50117	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:29.775569916 CET	50117	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:29.776043892 CET	50117	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:29.780792952 CET	3678	50117	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:31.243272066 CET	3678	50117	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:31.243454933 CET	50117	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:31.243546963 CET	50117	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:31.248311996 CET	3678	50117	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:31.300705910 CET	50118	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:31.305598021 CET	3678	50118	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:31.305671930 CET	50118	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:31.305922031 CET	50118	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:31.310760975 CET	3678	50118	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:32.717372894 CET	3678	50118	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:32.717489958 CET	50118	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:33.053091049 CET	50118	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:33.058099031 CET	3678	50118	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:34.066535950 CET	50119	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:34.071701050 CET	3678	50119	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:34.071870089 CET	50119	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:34.072096109 CET	50119	3678	192.168.2.6	192.210.150.26
Jan 10, 2025 23:04:34.076927900 CET	3678	50119	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:35.687808037 CET	3678	50119	192.210.150.26	192.168.2.6
Jan 10, 2025 23:04:35.687886953 CET	50119	3678	192.168.2.6	192.210.150.26

Target ID:	0
Start time:	17:00:26
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\l1QC9H0SNR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\l1QC9H0SNR.exe"
Imagebase:	0xb50000
File size:	921'600 bytes
MD5 hash:	BE20DFFFCBA37064D6087AA714036873
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:00:27
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\l1QC9H0SNR.exe"
Imagebase:	0x6c0000
File size:	921'600 bytes
MD5 hash:	BE20DFFFCBA37064D6087AA714036873
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4575991012.0000000003E6F000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4573869491.0000000001151000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4573965402.0000000001187000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4573167433.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.4574181082.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.4567862337.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:00:40
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs"
Imagebase:	0x7ff6948c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:00:40
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\obtenebrate\Milburr.exe"
Imagebase:	0x6c0000
File size:	921'600 bytes
MD5 hash:	BE20DFFFCBA37064D6087AA714036873
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.2273702079.0000000003280000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:00:41
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\obtenebrate\Milburr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\obtenebrate\Milburr.exe"
Imagebase:	0x6c0000
File size:	921'600 bytes
MD5 hash:	BE20DFFFCBA37064D6087AA714036873
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2281153273.000000000151B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2281175297.0000000001557000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000005.00000002.2280428273.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000005.00000002.2281391837.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	8.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	179

Executed Functions

Function 00B53B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B53B68
IsDebuggerPresent.KERNEL32 ref: 00B53B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,00C152F8,00C152E0,?,?), ref: 00B53BEB

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

Part of subcall function 00B6092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00B53C14,00C152F8,?,?,?), ref: 00B6096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00B53C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00C07770,00000010), ref: 00B8D281
SetCurrentDirectoryW.KERNEL32(?,00C152F8,?,?,?), ref: 00B8D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00C04260,00C152F8,?,?,?), ref: 00B8D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 00B8D346

Part of subcall function 00B53A46: GetSysColorBrush.USER32(0000000F), ref: 00B53A50
Part of subcall function 00B53A46: LoadCursorW.USER32(00000000,00007F00), ref: 00B53A5F
Part of subcall function 00B53A46: LoadIconW.USER32(00000063), ref: 00B53A76
Part of subcall function 00B53A46: LoadIconW.USER32(000000A4), ref: 00B53A88
Part of subcall function 00B53A46: LoadIconW.USER32(000000A2), ref: 00B53A9A
Part of subcall function 00B53A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00B53AC0
Part of subcall function 00B53A46: RegisterClassExW.USER32(?), ref: 00B53B16

Part of subcall function 00B539D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B53A03
Part of subcall function 00B539D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B53A24
Part of subcall function 00B539D5: ShowWindow.USER32(00000000,?,?), ref: 00B53A38
Part of subcall function 00B539D5: ShowWindow.USER32(00000000,?,?), ref: 00B53A41

Part of subcall function 00B5434A: _memset.LIBCMT ref: 00B54370
Part of subcall function 00B5434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B54415

Strings

This is a third-party compiled AutoIt script., xrefs: 00B8D279
runas, xrefs: 00B8D33A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: a22cf691f5ee570915250ec48cd9d4b491797b99c62f462a7098d98f5016a75e
Instruction ID: f2358336adf61647857a3442c2a1330213cf40bb9ebeca1fb73897be9766e568
Opcode Fuzzy Hash: a22cf691f5ee570915250ec48cd9d4b491797b99c62f462a7098d98f5016a75e
Instruction Fuzzy Hash: E651D771E48209EADF11EBB4DC55BED7BF4EB46741F0080E6F811A32A1DA705649CB21

Function 00B53633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00B536D2
KillTimer.USER32(?,00000001), ref: 00B536FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B5371F
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00B5372A
CreatePopupMenu.USER32 ref: 00B5373E
PostQuitMessage.USER32(00000000), ref: 00B5374D

Strings

TaskbarCreated, xrefs: 00B53725

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: 3d8a50a919a67ad374dd52bd80df8db0b748cca966427aee0ca00c677a23c7d4
Instruction ID: 91ddd5d12f022b534c15da0734c42e2a78431dc73081d16e03203f96ca528fc6
Opcode Fuzzy Hash: 3d8a50a919a67ad374dd52bd80df8db0b748cca966427aee0ca00c677a23c7d4
Instruction Fuzzy Hash: 914146B2608505EBDB106F64DC49BFD37D4EB86782F1401EAFD02963E1DA709E499321

Function 00B549A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00B549CD

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

GetCurrentProcess.KERNEL32(?,00BDFAEC,00000000,00000000,?), ref: 00B54A9A
IsWow64Process.KERNEL32(00000000), ref: 00B54AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00B54AE7
FreeLibrary.KERNEL32(00000000), ref: 00B54AF2
GetSystemInfo.KERNEL32(00000000), ref: 00B54B23
GetSystemInfo.KERNEL32(00000000), ref: 00B54B2F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 48ea6e9e2fc457bb20246a5e149ec6d74e68c86d625acb1246d91ec75fadcfbc
Instruction ID: 13d948d2faf39dfa44346c496186d2508432f5bf0d5d287b6e7a90111d17d41d
Opcode Fuzzy Hash: 48ea6e9e2fc457bb20246a5e149ec6d74e68c86d625acb1246d91ec75fadcfbc
Instruction Fuzzy Hash: 6991E43198E7C1DEC731DB6894902AAFFF5AF2A305B0449EED4CB93A41D720A94CC759

Function 00B54E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00B54E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00B54D8E,?,?,00000000,00000000), ref: 00B54EB0
LoadResource.KERNEL32(?,00000000,?,?,00B54D8E,?,?,00000000,00000000,?,?,?,?,?,?,00B54E2F), ref: 00B8D937
SizeofResource.KERNEL32(?,00000000,?,?,00B54D8E,?,?,00000000,00000000,?,?,?,?,?,?,00B54E2F), ref: 00B8D94C
LockResource.KERNEL32(00B54D8E,?,?,00B54D8E,?,?,00000000,00000000,?,?,?,?,?,?,00B54E2F,00000000), ref: 00B8D95F

Strings

SCRIPT, xrefs: 00B54EA6

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: d27da2dbde1cd6160a86f5042ebacd12cfed8c1fa385aec243d18a43237c4ce5
Instruction ID: f9c6467a54eea3498d31bc3bf770d0c945514534443778d9f6e6d3d93c6a3b7b
Opcode Fuzzy Hash: d27da2dbde1cd6160a86f5042ebacd12cfed8c1fa385aec243d18a43237c4ce5
Instruction Fuzzy Hash: F4119E70200701BFD7258B65EC49F37BBFAFBC5B11F1482ADF80686260EB61E8448A60

Function 00CB2A60 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 00CB2B9A
GetProcAddress.KERNEL32(?,00CABFF9), ref: 00CB2BB8
ExitProcess.KERNEL32(?,00CABFF9), ref: 00CB2BC9
VirtualProtect.KERNELBASE(00B50000,00001000,00000004,?,00000000), ref: 00CB2C17
VirtualProtect.KERNELBASE(00B50000,00001000), ref: 00CB2C2C

Memory Dump Source

Source File: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: f7649bca48d54fbb4d5f46f2128329ff7c3409fe8a7a178a3b209fb7db3d13b3
Instruction ID: dcc2312d98d8a7b6d5279f573ad6d886ce5a452523c0571976df9453da11183e
Opcode Fuzzy Hash: f7649bca48d54fbb4d5f46f2128329ff7c3409fe8a7a178a3b209fb7db3d13b3
Instruction Fuzzy Hash: 2D513772A553524BD7349EB8CCC06E1BBA4EB15324F280738C5F2CB3C6EBA45D0697A0

Function 00BB445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00B8E398), ref: 00BB446A
FindFirstFileW.KERNELBASE(?,?), ref: 00BB447B
FindClose.KERNEL32(00000000), ref: 00BB448B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 7dd5904be97a56a07406d824fd865882563f7b46c3c0ed82448e8e063369b432
Instruction ID: ec07c44c86e87c5da325d1d17042b70774d1bec61969d29a2a6664219b07f6a0
Opcode Fuzzy Hash: 7dd5904be97a56a07406d824fd865882563f7b46c3c0ed82448e8e063369b432
Instruction Fuzzy Hash: 5EE0D8324155016B42106B38EC4D4F9B79CEE05335F100766F836C21D0FFB459109595

Function 00B609D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B60A5B
timeGetTime.WINMM ref: 00B60D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B60E53
Sleep.KERNEL32(0000000A), ref: 00B60E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00B60EFA
DestroyWindow.USER32 ref: 00B60F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B60F20
Sleep.KERNEL32(0000000A,?,?), ref: 00B94E83
TranslateMessage.USER32(?), ref: 00B95C60
DispatchMessageW.USER32(?), ref: 00B95C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B95C82

Strings

@GUI_CTRLHANDLE, xrefs: 00B94FE4
@TRAY_ID, xrefs: 00B9578F
@GUI_CTRLID, xrefs: 00B94F3A
@COM_EVENTOBJ, xrefs: 00B954F0
@GUI_WINHANDLE, xrefs: 00B94F8F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: 0aeca4524dbf1a892957b01eee2075d47ff3e817545c89b2ec50db78db497036
Instruction ID: 3113808b4cc884c5e4316c7baa4c015fc4087e75e14ff2311b3a452a995ed691
Opcode Fuzzy Hash: 0aeca4524dbf1a892957b01eee2075d47ff3e817545c89b2ec50db78db497036
Instruction Fuzzy Hash: 51B2D170608741DFDB35DF24C884BAAB7E4FF85304F1489ADE99A972A1DB74E844CB42

Function 00BB9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB8F5F: __time64.LIBCMT ref: 00BB8F69

Part of subcall function 00B54EE5: _fseek.LIBCMT ref: 00B54EFD

__wsplitpath.LIBCMT ref: 00BB9234

Part of subcall function 00B740FB: __wsplitpath_helper.LIBCMT ref: 00B7413B

_wcscpy.LIBCMT ref: 00BB9247
_wcscat.LIBCMT ref: 00BB925A
__wsplitpath.LIBCMT ref: 00BB927F
_wcscat.LIBCMT ref: 00BB9295
_wcscat.LIBCMT ref: 00BB92A8

Part of subcall function 00BB8FA5: _memmove.LIBCMT ref: 00BB8FDE
Part of subcall function 00BB8FA5: _memmove.LIBCMT ref: 00BB8FED

_wcscmp.LIBCMT ref: 00BB91EF

Part of subcall function 00BB9734: _wcscmp.LIBCMT ref: 00BB9824
Part of subcall function 00BB9734: _wcscmp.LIBCMT ref: 00BB9837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00BB9452
_wcsncpy.LIBCMT ref: 00BB94C5
DeleteFileW.KERNEL32(?,?), ref: 00BB94FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00BB9511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00BB9522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00BB9534

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: c20255474d3bfcdb93c2cc4791eddd5ffed6a65fdfac98f318743ae2f6a23a2a
Instruction ID: fe89da570ea05df686e9d6f6d1018750074245d132b143f23584ddd579df2b31
Opcode Fuzzy Hash: c20255474d3bfcdb93c2cc4791eddd5ffed6a65fdfac98f318743ae2f6a23a2a
Instruction Fuzzy Hash: ABC129B1D00219ABDF21DFA5CC85AEEB7F9EF55310F0040EAF609E6151EB709A848F65

Function 00B5708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B54706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00C152F8,?,00B537AE,?), ref: 00B54724

Part of subcall function 00B7050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00B57165), ref: 00B7052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00B571A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00B8E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00B8E909
RegCloseKey.ADVAPI32(?), ref: 00B8E947
_wcscat.LIBCMT ref: 00B8E9A0

Strings

\, xrefs: 00B8E9C3
Software\AutoIt v3\AutoIt, xrefs: 00B5719E
\Include\, xrefs: 00B57165
Include, xrefs: 00B8E8BF, 00B8E900

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: c2a024640af834db10de01c1b59ec6c1bc09d4812ca74a06097f9272253bfefe
Instruction ID: 95e4247cf390664c1cd1a98421725f11dc6e64cb45bb2b242dd18a93d69f0e41
Opcode Fuzzy Hash: c2a024640af834db10de01c1b59ec6c1bc09d4812ca74a06097f9272253bfefe
Instruction Fuzzy Hash: 41718E715093019EC310EF65E841BAFBBE8FF86350B4089AEF855872B0EB719948CB52

Function 00B53A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B53A50
LoadCursorW.USER32(00000000,00007F00), ref: 00B53A5F
LoadIconW.USER32(00000063), ref: 00B53A76
LoadIconW.USER32(000000A4), ref: 00B53A88
LoadIconW.USER32(000000A2), ref: 00B53A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00B53AC0
RegisterClassExW.USER32(?), ref: 00B53B16

Part of subcall function 00B53041: GetSysColorBrush.USER32(0000000F), ref: 00B53074
Part of subcall function 00B53041: RegisterClassExW.USER32(00000030), ref: 00B5309E
Part of subcall function 00B53041: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00B530AF
Part of subcall function 00B53041: LoadIconW.USER32(000000A9), ref: 00B530F2

Strings

0, xrefs: 00B53AF4
AutoIt v3, xrefs: 00B53B05
#, xrefs: 00B53AFB

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: de126838c3da66eef181e169c60aecb6e1ee504400c18125f5930ab2becbad95
Instruction ID: bf476b22b2713d337e84bfe596b45cbaba645da199cf42a221af1dd8ddf54a63
Opcode Fuzzy Hash: de126838c3da66eef181e169c60aecb6e1ee504400c18125f5930ab2becbad95
Instruction Fuzzy Hash: 90212772905309EFEB10DFA4EC49BDD7BF0FB49711F00816AE500A72A1D7B55A448B84

Function 00B53766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00B537AE
CMDLINE, xrefs: 00B53822
/AutoIt3OutputDebug, xrefs: 00B53892
CMDLINERAW, xrefs: 00B537FB
/AutoIt3ExecuteScript, xrefs: 00B538BC
/AutoIt3ExecuteLine, xrefs: 00B538A7
/ErrorStdOut, xrefs: 00B5387D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 0c21d5394ef0570bff6f998391bd297f753c781614a7885f4b02212773210e3c
Instruction ID: aa0e5034db6873fba490870bac995b4fc435fa5ef4e2a0c37e90ed15c4929c5e
Opcode Fuzzy Hash: 0c21d5394ef0570bff6f998391bd297f753c781614a7885f4b02212773210e3c
Instruction Fuzzy Hash: E7A15D7290021D9ADB05EBA0DC95BEEB7F8FF15741F4404EAE816B7291EF745A08CB60

Function 00B53015 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B53074
RegisterClassExW.USER32(00000030), ref: 00B5309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00B530AF
LoadIconW.USER32(000000A9), ref: 00B530F2

Strings

AutoIt v3 GUI, xrefs: 00B53090
+, xrefs: 00B5305D
0, xrefs: 00B53056
TaskbarCreated, xrefs: 00B530A4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: cf101e31d55d54ceed5b3322889bf59afd932def85a222bd152f121fbd681172
Instruction ID: f2592dde1d8f4ead1a1041fd1c0a307f7c08d0e98946d9dccf54e014f753dbc9
Opcode Fuzzy Hash: cf101e31d55d54ceed5b3322889bf59afd932def85a222bd152f121fbd681172
Instruction Fuzzy Hash: 1A3105B294520AEFDB10CFA8E884BDDBBF0FB09310F14856AE581A72A0E7B54585CF51

Function 00B53041 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B53074
RegisterClassExW.USER32(00000030), ref: 00B5309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00B530AF
LoadIconW.USER32(000000A9), ref: 00B530F2

Strings

AutoIt v3 GUI, xrefs: 00B53090
+, xrefs: 00B5305D
0, xrefs: 00B53056
TaskbarCreated, xrefs: 00B530A4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: a44db909cbd3b547b3d43918e7b9604076ab966de72c0f77615a0c7882d4e0de
Instruction ID: 1bc16959a85319d780181f76aca4d913680aa39920246f6309326c14814f60ce
Opcode Fuzzy Hash: a44db909cbd3b547b3d43918e7b9604076ab966de72c0f77615a0c7882d4e0de
Instruction Fuzzy Hash: CC21C5B5D55619EFEB00DFA4E849BEDBBF4FB09700F00812AF911A72A0EBB145448F95

Function 01007FA0 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 01007FE5

Memory Dump Source

Source File: 00000000.00000002.2131329969.0000000001007000.00000040.00000020.00020000.00000000.sdmp, Offset: 01007000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1007000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction ID: 522e93274f81fb7c53309dd3697c0bb6c76bf4feea5e6a0ee254badb62fe417f
Opcode Fuzzy Hash: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction Fuzzy Hash: 4F51F9B5A50248FBEF60DFA4CC49FDE77B8BF48700F108954F64AEA2C0DA7496448B64

Function 00B539D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B53A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B53A24
ShowWindow.USER32(00000000,?,?), ref: 00B53A38
ShowWindow.USER32(00000000,?,?), ref: 00B53A41

Strings

AutoIt v3, xrefs: 00B539FB, 00B53A00, 00B53A01
edit, xrefs: 00B53A1E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8b0d95a03384235277081aeb1b27a3e0f2e4928a18002e7cfbaa7c41fe3164ef
Instruction ID: 24ffe618c100a79ff6c8b84777bc8c3f9c69bca05c9fc2e01ecc738e02ac4767
Opcode Fuzzy Hash: 8b0d95a03384235277081aeb1b27a3e0f2e4928a18002e7cfbaa7c41fe3164ef
Instruction Fuzzy Hash: DAF03A76601690BEEA305B23AC08FBB6E7DE7C7F50B01802AB900A3270D6B10801CAB0

Function 00B5407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00B8D3D7

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

_memset.LIBCMT ref: 00B540FC
_wcscpy.LIBCMT ref: 00B54150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B54160

Strings

Line: , xrefs: 00B8D400

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 281cd9cf18b7dc52a750a60aef78ebbdc68eabe6e3dc6a1aa3ab864676cb1b95
Instruction ID: 484226f92eddfd8a367e65c6d91033e9dfe0bc597b37224012add90c0b41b058
Opcode Fuzzy Hash: 281cd9cf18b7dc52a750a60aef78ebbdc68eabe6e3dc6a1aa3ab864676cb1b95
Instruction Fuzzy Hash: 7D31D072108705AED320EB60EC46FDB77D8EF84305F1085AAF985921E1EF70969CCB82

Function 00B7541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00B7547B
_memcpy_s.LIBCMT ref: 00B754ED
__read_nolock.LIBCMT ref: 00B7554B
__filbuf.LIBCMT ref: 00B7556E
_memset.LIBCMT ref: 00B755B2

Part of subcall function 00B78B28: __getptd_noexit.LIBCMT ref: 00B78B28

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 38f9f4307beecffcefa8249c5b8ec4e16dbd60b88c8a93fbd5e50c39494d654b
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 6351A370A00B059BDB349F69D88066E77E6EF50321F24C7A9F83D962D4D7B1DE909B40

Function 00B5686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00B54DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00C152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00B54E0F

_free.LIBCMT ref: 00B8E263
_free.LIBCMT ref: 00B8E2AA

Part of subcall function 00B56A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00B56BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00B8E039
Bad directive syntax error, xrefs: 00B8E292

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: f099eee9783d550136962053b6d18631607dc0c79cf1198fa24dec0a01677dba
Instruction ID: e261935bf06c1e00a5082cf2a2a665a56a1b4870f0c89e8d1e87647d1f326790
Opcode Fuzzy Hash: f099eee9783d550136962053b6d18631607dc0c79cf1198fa24dec0a01677dba
Instruction Fuzzy Hash: 88916D719142199FCF14EFA4CC929EDB7F4FF09311B1044AAF826AB2A1DB70E945CB50

Function 01009A60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144fileCOMMON

Download Yara Rule

APIs

Part of subcall function 01009950: Sleep.KERNELBASE(000001F4), ref: 01009961

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01009B6B

Strings

8VIBXL00WBQSJQJ, xrefs: 01009BEB, 01009BEE

Memory Dump Source

Source File: 00000000.00000002.2131329969.0000000001007000.00000040.00000020.00020000.00000000.sdmp, Offset: 01007000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1007000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateFileSleep
String ID: 8VIBXL00WBQSJQJ
API String ID: 2694422964-822010546
Opcode ID: e7ff5be01e2585babea1e6856b9219b47a3c41df6653cdb419f0c3404d6d8e59
Instruction ID: 762a38620ab55ea60b6dbe7ec3de3450ed5108cb082a17facebd82ce97052e6d
Opcode Fuzzy Hash: e7ff5be01e2585babea1e6856b9219b47a3c41df6653cdb419f0c3404d6d8e59
Instruction Fuzzy Hash: 7851A231D04249DBEF12DBA4C914BEFBBB4AF08304F004198E648BB2C1D7791B49CBA5

Function 00B535B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00B535A1,SwapMouseButtons,00000004,?), ref: 00B535D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00B535A1,SwapMouseButtons,00000004,?,?,?,?,00B52754), ref: 00B535F5
RegCloseKey.KERNELBASE(00000000,?,?,00B535A1,SwapMouseButtons,00000004,?,?,?,?,00B52754), ref: 00B53617

Strings

Control Panel\Mouse, xrefs: 00B535D2

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 74f63551e2a75947e93d66876ef58deea8f394429c4f82503ea6b350ddca01df
Instruction ID: b59badd1e5f55a4ff5b5f03a3ae71123aa34d1db9d58d24c919c5b9ac5bb3f4d
Opcode Fuzzy Hash: 74f63551e2a75947e93d66876ef58deea8f394429c4f82503ea6b350ddca01df
Instruction Fuzzy Hash: 17114871519209BFDB208F64DC80ABEB7F8EF04B81F0084AAF805D7310E6719E549760

Function 00B7470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B747A0
__flush.LIBCMT ref: 00B747C0
__write.LIBCMT ref: 00B747F3
__flsbuf.LIBCMT ref: 00B74821

Part of subcall function 00B78B28: __getptd_noexit.LIBCMT ref: 00B78B28

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 2af298497ab0877867d5e0a62d4f3379a925012c12cb560e94a46984c847d75b
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 38419375B007499BDB1C8E69C8809AE7BE5EF46362B24C5BDE83DCB640EB70DD418B41

Function 00B57285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B8EA39
75D3D0D0.COMDLG32(?), ref: 00B8EA83

Part of subcall function 00B54750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B54743,?,?,00B537AE,?), ref: 00B54770

Part of subcall function 00B70791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B707B0

Strings

X, xrefs: 00B8EA51

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: NamePath$FullLong_memset
String ID: X
API String ID: 3051022977-3081909835
Opcode ID: 8041893aa20d719217cf31e2a1087b83b88535ff46e7c2fd249c2424a72d067b
Instruction ID: 5c14e49679abe86b63a17bc4072ccd4ecc3705f4abefb4c2cba13961c26246f0
Opcode Fuzzy Hash: 8041893aa20d719217cf31e2a1087b83b88535ff46e7c2fd249c2424a72d067b
Instruction Fuzzy Hash: 9121C371A102489BCF01AF94D845BEE7BFCAF49715F00809AE858A7281DFB4598DCFA1

Function 00BB8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BB8DAC
__fread_nolock.LIBCMT ref: 00BB8DC1

Strings

EA06, xrefs: 00BB8DF3

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 13e6d7720c811f7fece47b6ef7f6b5805a097db4a6ccf41778ef8bad5b013571
Instruction ID: e023149b6c1b871992c1d28fb42625d6b2364027c00348aa7e5faa9fefdcb30a
Opcode Fuzzy Hash: 13e6d7720c811f7fece47b6ef7f6b5805a097db4a6ccf41778ef8bad5b013571
Instruction Fuzzy Hash: C301D6718042186EDB28DAA8C856EFE7BFCDB11301F0081AFF596D2181E9B5A6088B60

Function 00B70DB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B7571C: __FF_MSGBANNER.LIBCMT ref: 00B75733
Part of subcall function 00B7571C: __NMSG_WRITE.LIBCMT ref: 00B7573A
Part of subcall function 00B7571C: RtlAllocateHeap.NTDLL(00F80000,00000000,00000001), ref: 00B7575F

std::exception::exception.LIBCMT ref: 00B70DEC
__CxxThrowException@8.LIBCMT ref: 00B70E01

Part of subcall function 00B7859B: RaiseException.KERNEL32(?,?,00000000,00C09E78,?,00000001,?,?,?,00B70E06,00000000,00C09E78,00B59E8C,00000001), ref: 00B785F0

Strings

bad allocation, xrefs: 00B70DE1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: 1453dd1d4c5a069baf42df710cca0666f7c8b792bc27a3f7239b68400a121fe0
Instruction ID: c652f340c99ee507b62df535f5670b661ceab5b8fcd1b4cef33456908a211cc2
Opcode Fuzzy Hash: 1453dd1d4c5a069baf42df710cca0666f7c8b792bc27a3f7239b68400a121fe0
Instruction Fuzzy Hash: 15F06D3294031DA6DB20BBA5EC469DEB7ECDB05311F1084A6BD2C96281DBB09A9092D1

Function 01008680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 010086C5
ExitProcess.KERNEL32(00000000), ref: 010086E4

Strings

D, xrefs: 01008691

Memory Dump Source

Source File: 00000000.00000002.2131329969.0000000001007000.00000040.00000020.00020000.00000000.sdmp, Offset: 01007000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1007000_l1QC9H0SNR.jbxd

Similarity

API ID: Process$CreateExit
String ID: D
API String ID: 126409537-2746444292
Opcode ID: 03e416529f94357cb7ee45147abf4bf6199a2e9bce9b56f1b6d0fc2bb1e3bcca
Instruction ID: 0a9ec670b5506a5111371725d51f3d34d8b931d5bac2a2345b94818e14243d4c
Opcode Fuzzy Hash: 03e416529f94357cb7ee45147abf4bf6199a2e9bce9b56f1b6d0fc2bb1e3bcca
Instruction Fuzzy Hash: 83F0EC7594024CABEB61DFE0CC49FEE77BCBF08705F008509BB5A9A180DA7496488B61

Function 00BB98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00BB98F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00BB990F

Strings

aut, xrefs: 00BB9909

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 24eb931da8f0e4fea4176a7bedb41f2939908d1011a8c1743ec626e3856a31bf
Instruction ID: 09c7898c6e479bdfb8a3b66ebc70c788bf7d60bbd3339f26271c1732c5632863
Opcode Fuzzy Hash: 24eb931da8f0e4fea4176a7bedb41f2939908d1011a8c1743ec626e3856a31bf
Instruction Fuzzy Hash: 28D05B7554530E6BDB509B90DC0DFA6B73CD704700F0042B1BA55921D1ED7095588B95

Function 00BCCADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50ccda27b2b409b8159b045ede53cc50f3dd673fe1d614405ca84f1e4970dee
Instruction ID: c97da53f7347dfe21de736acfb8a3b5947acb82f1c6a6c99d2620d7b096824ff
Opcode Fuzzy Hash: c50ccda27b2b409b8159b045ede53cc50f3dd673fe1d614405ca84f1e4970dee
Instruction Fuzzy Hash: 95F139716083059FCB14DF28C480A6ABBE5FF99314F1489AEF89A9B351D730E945CF82

Function 00B5F76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B70162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B70193
Part of subcall function 00B70162: MapVirtualKeyW.USER32(00000010,00000000), ref: 00B7019B
Part of subcall function 00B70162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B701A6
Part of subcall function 00B70162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B701B1
Part of subcall function 00B70162: MapVirtualKeyW.USER32(00000011,00000000), ref: 00B701B9
Part of subcall function 00B70162: MapVirtualKeyW.USER32(00000012,00000000), ref: 00B701C1

Part of subcall function 00B660F9: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 00B66154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00B5F9CD
OleInitialize.OLE32(00000000), ref: 00B5FA4A
CloseHandle.KERNEL32(00000000), ref: 00B945C8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Virtual$Handle$ClipboardCloseFormatInitializeRegister
String ID:
API String ID: 3094916012-0
Opcode ID: aa786e454a7c1beffbf9c654cddaea032458b37ed44d1394a542647dbbbd3749
Instruction ID: 58467768f47ddd3c81433d0aa3aeeb955ee91025df59434d8c80674cd4ff7166
Opcode Fuzzy Hash: aa786e454a7c1beffbf9c654cddaea032458b37ed44d1394a542647dbbbd3749
Instruction Fuzzy Hash: F781CCB0915A40CEC784DF29E8817DCBBE5FBDB306790C1AAA019CB3B1EB7044858F55

Function 00B5434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B54370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B54415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B54432

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: a6cff9cbae200312e62c4832060d248716072512ab1e4a2005ea1970b993bd8f
Instruction ID: 0e6775b137a8643b284c84068eed8c9e284b7777b0bd54af16b024f9d97ba828
Opcode Fuzzy Hash: a6cff9cbae200312e62c4832060d248716072512ab1e4a2005ea1970b993bd8f
Instruction Fuzzy Hash: 45318071505701DFC721DF24D88479BBBF8FB49309F0049AEE99A87251E7B0A988CB52

Function 00B7571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00B75733

Part of subcall function 00B7A16B: __NMSG_WRITE.LIBCMT ref: 00B7A192
Part of subcall function 00B7A16B: __NMSG_WRITE.LIBCMT ref: 00B7A19C

__NMSG_WRITE.LIBCMT ref: 00B7573A

Part of subcall function 00B7A1C8: GetModuleFileNameW.KERNEL32(00000000,00C133BA,00000104,00000000,00000001,00000000), ref: 00B7A25A
Part of subcall function 00B7A1C8: ___crtMessageBoxW.LIBCMT ref: 00B7A308

Part of subcall function 00B7309F: ___crtCorExitProcess.LIBCMT ref: 00B730A5
Part of subcall function 00B7309F: ExitProcess.KERNEL32 ref: 00B730AE

Part of subcall function 00B78B28: __getptd_noexit.LIBCMT ref: 00B78B28

RtlAllocateHeap.NTDLL(00F80000,00000000,00000001), ref: 00B7575F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: e14430ae9741bbb880673444767a5be10a5d71f0d089c610cb50d6f359253e39
Instruction ID: 052577923be417da4ba72afca69f90381bdf7b826858ae6ae5612e09afe001d2
Opcode Fuzzy Hash: e14430ae9741bbb880673444767a5be10a5d71f0d089c610cb50d6f359253e39
Instruction Fuzzy Hash: 7801D231244A02DAE6292738AC82B6E63C8DB82762F1080A5F43DEB281DEB09D014660

Function 00BB98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00BB9548,?,?,?,?,?,00000004), ref: 00BB98BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00BB9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00BB98D1
CloseHandle.KERNEL32(00000000,?,00BB9548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00BB98D8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 251c3266143260f89d1b877c7cd246278ed76fb63c12af8ad81deef16cc49fcd
Instruction ID: dddc0433c6970e43308bbddd74fe6aafe15e5d4121c257e4ab68b03d905cf05f
Opcode Fuzzy Hash: 251c3266143260f89d1b877c7cd246278ed76fb63c12af8ad81deef16cc49fcd
Instruction Fuzzy Hash: B2E08632146225B7D7211B54EC09FEABF59EF06B70F104121FB157A0E09BB11A119798

Function 00BB8D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BB8D1B

Part of subcall function 00B72D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00B79A24), ref: 00B72D69
Part of subcall function 00B72D55: GetLastError.KERNEL32(00000000,?,00B79A24), ref: 00B72D7B

_free.LIBCMT ref: 00BB8D2C
_free.LIBCMT ref: 00BB8D3E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 1c6bd86f07bbaf6ca1a6bc234ad92ac0c8f186dc2d95ca0260f276e2bdc3557a
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: 2DE012A160160157CB34A679A940AE313DC8F5835271449BEB41DD7186CEA4F842C124

Function 00B5A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00B8FC01

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 0767369bc6551722374289b9c17469c8933d4520eee1796384f5a6ad11d31cc5
Instruction ID: 16cade2d6ac3dafe901ab27ca086340fb43f73bf2d7880c291604f146d08d9dc
Opcode Fuzzy Hash: 0767369bc6551722374289b9c17469c8933d4520eee1796384f5a6ad11d31cc5
Instruction Fuzzy Hash: 6B223770508201DFDB24EF14C494B6ABBE1FF89305F1589EDE89A9B261D731ED49CB82

Function 00B54C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B54CBA

Strings

EA06, xrefs: 00B8D8CC

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: cb9333909c27bae07445e8891500a4bfc90a11d5c568b52ea79617b9ff919afe
Instruction ID: 9b6e0d4b73defcbf86d46f40a85c1940afea7c508adc8db1f3ba37820e96ad39
Opcode Fuzzy Hash: cb9333909c27bae07445e8891500a4bfc90a11d5c568b52ea79617b9ff919afe
Instruction Fuzzy Hash: ED415D21A0415867DF229B6488927BE7FF1DB4530AF2844F5EC869B2C2D7245DCD83A1

Function 00B547D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

74A3C8D0.UXTHEME ref: 00B54834

Part of subcall function 00B7336C: __lock.LIBCMT ref: 00B73372
Part of subcall function 00B7336C: RtlDecodePointer.NTDLL(00000001), ref: 00B7337E
Part of subcall function 00B7336C: RtlEncodePointer.NTDLL(?), ref: 00B73389

Part of subcall function 00B548FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00B54915
Part of subcall function 00B548FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00B5492A

Part of subcall function 00B53B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B53B68
Part of subcall function 00B53B3A: IsDebuggerPresent.KERNEL32 ref: 00B53B7A
Part of subcall function 00B53B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,00C152F8,00C152E0,?,?), ref: 00B53BEB
Part of subcall function 00B53B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00B53C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00B54874

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$DebuggerDecodeEncodeFullNamePathPresent__lock
String ID:
API String ID: 2688871447-0
Opcode ID: 6c864644345f32ba2d2b8014b179c1015e06814c3e886bff41c0a613ca67d068
Instruction ID: 364d39d37853042a28bf1b4114ff9d195bf8b18bf0256ee60d8827e9f75c7169
Opcode Fuzzy Hash: 6c864644345f32ba2d2b8014b179c1015e06814c3e886bff41c0a613ca67d068
Instruction Fuzzy Hash: D1118C72908341DFC700DF68E845B4EBBE8FB96750F10859EF455872B1DBB09A48CB92

Function 00B55C99 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00B55821,?,?,?,?), ref: 00B55CC7
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00B55821,?,?,?,?), ref: 00B8DD73

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 094284bc86861249283c325129b76087e55008498543e2d96fe07692ed1fbaba
Instruction ID: c9d4bb2983c8d3c9680a08e930b5539ab81ba0233c4e03cb5bb7e07142d95f26
Opcode Fuzzy Hash: 094284bc86861249283c325129b76087e55008498543e2d96fe07692ed1fbaba
Instruction Fuzzy Hash: B3016D70244748BEF2301E24CC9AF767BDCEB0576AF108399BAE5AA1E0C6B45C488B50

Function 00B755FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B7562C
__lock_file.LIBCMT ref: 00B7564D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 40e7704e8706b862a21c5d7ceaf299dc28a4ed30096919d2764fc7a90d7f7546
Instruction ID: b6cbb99f06b01e976c9de49d4aabbd57c775156c8ee9abe49e7d337872e2e7d7
Opcode Fuzzy Hash: 40e7704e8706b862a21c5d7ceaf299dc28a4ed30096919d2764fc7a90d7f7546
Instruction Fuzzy Hash: 5C018471C00A09ABCF32AF649C0649E7BE1EF51361F54C1A5B83C5A191DB71CA51DF91

Function 00B753A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B78B28: __getptd_noexit.LIBCMT ref: 00B78B28

__lock_file.LIBCMT ref: 00B753EB

Part of subcall function 00B76C11: __lock.LIBCMT ref: 00B76C34

__fclose_nolock.LIBCMT ref: 00B753F6

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 8ede77047b2177a498b39854dd9ffb89fde64400e90cbb5c475e8477cfb4713d
Instruction ID: e7e5c5be7c7bfb4f000a7fa486ef9fa16347b7d7eb00af9f7a86785691a55842
Opcode Fuzzy Hash: 8ede77047b2177a498b39854dd9ffb89fde64400e90cbb5c475e8477cfb4713d
Instruction Fuzzy Hash: 8CF0BB71800B049AD7316F7598067AD77E06F41374F21C2D8A43DAB1D1CFFC4941AB55

Function 00B61FC3 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dde90ae16b4451cebadd3eb49954729d56aea94a9e03c57e9b9cb26ec5545a8
Instruction ID: 4450ed6c656f4228072d0ed5760d1d051a985c56766a8ff913352b8bcbdac908
Opcode Fuzzy Hash: 8dde90ae16b4451cebadd3eb49954729d56aea94a9e03c57e9b9cb26ec5545a8
Instruction Fuzzy Hash: DD518A30A00604EBDF24EB68C991FAE77E6AF45311F1480E8F906AB392DA34ED04CB51

Function 010086F0 Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 01007F60: GetFileAttributesW.KERNELBASE(?), ref: 01007F6B

CreateDirectoryW.KERNELBASE(?,00000000), ref: 0100884C

Memory Dump Source

Source File: 00000000.00000002.2131329969.0000000001007000.00000040.00000020.00020000.00000000.sdmp, Offset: 01007000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1007000_l1QC9H0SNR.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 0b123c2c37f26543cc8b44d8b0353a9df7f5705004a2e2ba94bd6ba47c0da593
Instruction ID: 2a064f6de4b5c1d8e0607f71dc40e32887721032de3d19a19d79789a331c04b4
Opcode Fuzzy Hash: 0b123c2c37f26543cc8b44d8b0353a9df7f5705004a2e2ba94bd6ba47c0da593
Instruction Fuzzy Hash: 98519131A1120996EF14EFA0D804BEF7379FF58300F1085A9A649F72C0EB799B44CB66

Function 00B55AEE Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00B55B96

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2f946b201ec5f5a8a7c8478a4c9d338836236deb88371187c8617ca7e9b66553
Instruction ID: cc5451e5cbf133f381216d22c07726b55f55e3630081b78f9d6bbbaadb7e7bc1
Opcode Fuzzy Hash: 2f946b201ec5f5a8a7c8478a4c9d338836236deb88371187c8617ca7e9b66553
Instruction Fuzzy Hash: EF313B31A00A05ABCB28DF6CC494AADB7F5FF48322F1486A9DC1993750D770B994CB90

Function 00B70C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00B70CB7

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 3d547ab254de8bef72e4f021a845cddc3bf60f57939ad4ce22e3e86d10b56eff
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: E731A170A10105DBC71AEF68C4C4A69FBE6FB59300B64C6E6E81ACB355D631EDD1DB80

Function 00B8FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00B8FCB7

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d80a0cbfe89e4c4274946fd2ab4b854f3780793176342f0fc9523496ad2c5209
Instruction ID: 4eec1f263c4924e4ac5ac5036ef6462709257bc1df3f0b063da847b61d314a78
Opcode Fuzzy Hash: d80a0cbfe89e4c4274946fd2ab4b854f3780793176342f0fc9523496ad2c5209
Instruction Fuzzy Hash: 19410574504341DFDB14DF14C494B1ABBE0BF49315F0989ECE99A9B362D732E849CB52

Function 00B559B9 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B55A01

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: e75b07057267258661b26c07b81abfdd2a22560227d0709ca859ae3ec03292c2
Instruction ID: a2e081dc28d433c4b31e5667feff4ae10d0248fefaf719e6223504e8edfb2d4a
Opcode Fuzzy Hash: e75b07057267258661b26c07b81abfdd2a22560227d0709ca859ae3ec03292c2
Instruction Fuzzy Hash: B521D871914A08EBDB10AF51E8807AE7BF8FF04311F2184EBE885D5061D77095D0DB45

Function 00B54DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B54BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00B54BEF

Part of subcall function 00B7525B: __wfsopen.LIBCMT ref: 00B75266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00C152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00B54E0F

Part of subcall function 00B54B6A: FreeLibrary.KERNEL32(00000000), ref: 00B54BA4

Part of subcall function 00B54C70: _memmove.LIBCMT ref: 00B54CBA

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: a22b6f02fef4ab54fa0ff742f7f499e06b9b8deb63c40c8d2de29a9e035f3c71
Instruction ID: be2fc6f961dfac910d1e2ab155440e5609404aa3a7643050823dc805b5d3e818
Opcode Fuzzy Hash: a22b6f02fef4ab54fa0ff742f7f499e06b9b8deb63c40c8d2de29a9e035f3c71
Instruction Fuzzy Hash: 9E11E731600205ABCF15BF74C817FAD77E4EF44715F1088EEF942A7181EBB19A499B50

Function 00B8FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00B8FD91

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b6f003962da78e57425e0186271d25b494337d4a469ea8972517c2cb92e66d48
Instruction ID: adac41a0122567ade572ba5242b1470e4ca32e52f736700f1d268a54fb8b6e2c
Opcode Fuzzy Hash: b6f003962da78e57425e0186271d25b494337d4a469ea8972517c2cb92e66d48
Instruction Fuzzy Hash: 5B211374908301DFCB14EF24C484B2ABBE1BF88315F0589A8F89A57762D731E849CB92

Function 00B55BC0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00B556A7,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00B55C16

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c923d3f202ac726c142b7bace49209a2d4b2e9b9a2b77787e022511ce32abb97
Instruction ID: 3e4e794c90f1e164029d24770a8bba552466dc6695dfdfe3d8097217f8df3ff0
Opcode Fuzzy Hash: c923d3f202ac726c142b7bace49209a2d4b2e9b9a2b77787e022511ce32abb97
Instruction Fuzzy Hash: 3F113A71204B059FE3308F19C894B66B7E5EF44762F10C9AEE99A86A51D771F848CB60

Function 00B55A7A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B8DD18

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 68205d27ac4155f798ec0ec681d5576bc6f6357978d24f8a088acc3bb8418320
Instruction ID: 51d0f4bd627bea8e332200a0e309f033b568e1a82a0898d7c259f083780662a2
Opcode Fuzzy Hash: 68205d27ac4155f798ec0ec681d5576bc6f6357978d24f8a088acc3bb8418320
Instruction Fuzzy Hash: 33018FB5600A02AFC315EB68C451D26F7E9FF8A31171485AAF969C7702DB35EC21CBE0

Function 00B74863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00B748A6

Part of subcall function 00B78B28: __getptd_noexit.LIBCMT ref: 00B78B28

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 1a2503c4d61c90b35927e20cd04c50c426f99d08ac39f0823fa956d07bb4c282
Instruction ID: aa9e47a3c10ee9129a97ac8c4e9e3a85df6bf1a19752aac167786ef099165dc7
Opcode Fuzzy Hash: 1a2503c4d61c90b35927e20cd04c50c426f99d08ac39f0823fa956d07bb4c282
Instruction Fuzzy Hash: 64F0AF31940609ABDF11AFB48C0A7AE36E0EF00326F15C594F43C9A191CB788A51DB52

Function 00B54E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00C152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00B54E7E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 571201b6bc3126d3ed77c53b9cf34cdee0ac5d223958c8c58a4bf5dc5a44ce3a
Instruction ID: 3fbf90e2b877e2e508be1796540aabefa7d4b1a77836fc574fd3bb64e55a4e85
Opcode Fuzzy Hash: 571201b6bc3126d3ed77c53b9cf34cdee0ac5d223958c8c58a4bf5dc5a44ce3a
Instruction Fuzzy Hash: E5F03071505751CFCB389F64E495916B7E1FF1432A32089FEE5D782620C7719888DF40

Function 00B70791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B707B0

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: f1bb39f329779d57038be80c9ccfa679a1169a5be699662cca4fb43d02c7ef41
Instruction ID: e27c6dcc4b0fdd45ecdbe31fd6af82f3ead79c63c9f8adbb313681cdf61c5d2d
Opcode Fuzzy Hash: f1bb39f329779d57038be80c9ccfa679a1169a5be699662cca4fb43d02c7ef41
Instruction Fuzzy Hash: 74E08636A4512957C720A6589C05FEAB7DDDB887A1F0441F6FC08D7254DD609C818690

Function 00BB8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00BB8EC1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 3553fd6d6f0368e9f1a401640012ef7c2d40a991706f8a2d1f1ce14bd9fdfc5a
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 96E092B0104B045FD7388A24D840BE373E5EB05304F00085DF2AA83241EBA3B841C759

Function 01007F60 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 01007F6B

Memory Dump Source

Source File: 00000000.00000002.2131329969.0000000001007000.00000040.00000020.00020000.00000000.sdmp, Offset: 01007000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1007000_l1QC9H0SNR.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction ID: 845cb4beded8a56630cb80c0f484f072a3f900b244b3d4f942e72fb58fef68d3
Opcode Fuzzy Hash: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction Fuzzy Hash: B8E08630505208DBE795CBA88C046BD73A4D705310F004699E595C31C0DA34A940D665

Function 00B55C4E Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00B8DD42,?,?,00000000), ref: 00B55C5F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a7ecd69a2f3863eb4eaa2c97d88c3dc5bf55b448b4ed78f7f1d5f24610dbbe37
Instruction ID: a3cb6935f9d9da303a763681a0e3895988e80823990b7d1cc198030fdeb13c65
Opcode Fuzzy Hash: a7ecd69a2f3863eb4eaa2c97d88c3dc5bf55b448b4ed78f7f1d5f24610dbbe37
Instruction Fuzzy Hash: EFD0C77464420CBFE710DB80DC46FA9B77CD705710F100195FD0467290E6B27D508795

Function 01007F30 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 01007F3B

Memory Dump Source

Source File: 00000000.00000002.2131329969.0000000001007000.00000040.00000020.00020000.00000000.sdmp, Offset: 01007000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1007000_l1QC9H0SNR.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction ID: 2253cc8459ca1d491c809f17296f988ba5cca3a2efdf996f0537d2947e220cda
Opcode Fuzzy Hash: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction Fuzzy Hash: 1DD0A77090520CEBDB10CFB8DC049EE73A8D705320F004798FD59C32C1D535A9409750

Function 00B7525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00B75266

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: ae5fdbd9bffaeb62f312959acb3d908732e55506f676240291793ee9d057d1f6
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 4EB0927644020C77CE112A82EC02A493B5D9B41764F408060FB1C18162A6B3A6649A89

Function 00BBD07B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00BBD1FF

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 3b133604e3c35b8b6c7507b89bef6b0e4b915d07d35fc4973e0e4ebff91d79e7
Instruction ID: ff2afaa97fceddfaf176cd2d2c7d83306ca91fb99c7e287733f5976e3de96f1c
Opcode Fuzzy Hash: 3b133604e3c35b8b6c7507b89bef6b0e4b915d07d35fc4973e0e4ebff91d79e7
Instruction Fuzzy Hash: 9C718F702047428FC714EF68C491AAAB7E0EF89355F0449EDF8969B3A1DB74ED09CB52

Function 01009950 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01009961

Memory Dump Source

Source File: 00000000.00000002.2131329969.0000000001007000.00000040.00000020.00020000.00000000.sdmp, Offset: 01007000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1007000_l1QC9H0SNR.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: a5ad71b3c69aa147feeb2c73f4610c21f3117544286a7e26f7a21db9a2cf9c13
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 3FE0E67494410EDFDB00EFF8D5496DE7FB4EF04301F100161FD05D2281DA309D508A62

Non-executed Functions

Function 00BDCABC Relevance: 68.9, APIs: 37, Strings: 2, Instructions: 632windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?), ref: 00BDCB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00BDCB95
GetWindowLongW.USER32(?,000000F0), ref: 00BDCBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00BDCC00
SendMessageW.USER32 ref: 00BDCC29
_wcsncpy.LIBCMT ref: 00BDCC95
GetKeyState.USER32(00000011), ref: 00BDCCB6
GetKeyState.USER32(00000009), ref: 00BDCCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00BDCCD9
GetKeyState.USER32(00000010), ref: 00BDCCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00BDCD0C
SendMessageW.USER32 ref: 00BDCD33
SendMessageW.USER32(?,00001030,?,00BDB348), ref: 00BDCE37
SetCapture.USER32(?), ref: 00BDCE69
ClientToScreen.USER32(?,?), ref: 00BDCECE
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00BDCEF5
ReleaseCapture.USER32 ref: 00BDCF00
GetCursorPos.USER32(?), ref: 00BDCF3A
ScreenToClient.USER32(?,?), ref: 00BDCF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 00BDCFA3
SendMessageW.USER32 ref: 00BDCFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00BDD00E
SendMessageW.USER32 ref: 00BDD03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00BDD05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00BDD06D
GetCursorPos.USER32(?), ref: 00BDD08D
ScreenToClient.USER32(?,?), ref: 00BDD09A
GetParent.USER32(?), ref: 00BDD0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 00BDD123
SendMessageW.USER32 ref: 00BDD154
ClientToScreen.USER32(?,?), ref: 00BDD1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00BDD1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00BDD20C
SendMessageW.USER32 ref: 00BDD22F
ClientToScreen.USER32(?,?), ref: 00BDD281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00BDD2B5

Part of subcall function 00B525DB: GetWindowLongW.USER32(?,000000EB), ref: 00B525EC

GetWindowLongW.USER32(?,000000F0), ref: 00BDD351

Strings

F, xrefs: 00BDD235
@GUI_DRAGID, xrefs: 00BDCE9C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongWindow$State$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 302779176-4164748364
Opcode ID: 6f1ed162aec4cf2a3655625d9093067b0dbc20986c11b6d92f324096891e48e5
Instruction ID: d06289ca1c0c7b3196f5f841f48bff2ef0cc24384dc1da856810b8d2fcf3e622
Opcode Fuzzy Hash: 6f1ed162aec4cf2a3655625d9093067b0dbc20986c11b6d92f324096891e48e5
Instruction Fuzzy Hash: 0742BC74209246AFDB24CF28C884BAAFFE5FF49310F14459AF696873A0E731D845DB91

Function 00B66F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B671C3
_memset.LIBCMT ref: 00B67539
_memmove.LIBCMT ref: 00B676AC

Strings

\b(?<=\w), xrefs: 00BA3773
Q\E, xrefs: 00B67FCB
[:>:]], xrefs: 00B67492
\b(?=\w), xrefs: 00BA3769
[:<:]], xrefs: 00B67479
DEFINE, xrefs: 00BA2103

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 091e7272ccc4847613a37599495c399c74234575d1d82e7fc23590a78471346f
Instruction ID: beb77bf9a6d616040578a70228f72fec8323b96cdef5f26b7808fd36ee06772a
Opcode Fuzzy Hash: 091e7272ccc4847613a37599495c399c74234575d1d82e7fc23590a78471346f
Instruction Fuzzy Hash: 2593A171A48215DFDB24CF98C881BADB7F1FF49714F2485AAE945AB380E7749E81CB40

Function 00B548D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00B548DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B8D665
IsIconic.USER32(?), ref: 00B8D66E
ShowWindow.USER32(?,00000009), ref: 00B8D67B
SetForegroundWindow.USER32(?), ref: 00B8D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B8D69B
GetCurrentThreadId.KERNEL32 ref: 00B8D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B8D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B8D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B8D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 00B8D6CF
SetForegroundWindow.USER32(?), ref: 00B8D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B8D6E7
keybd_event.USER32(00000012,00000000), ref: 00B8D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B8D6FC
keybd_event.USER32(00000012,00000000), ref: 00B8D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B8D70A
keybd_event.USER32(00000012,00000000), ref: 00B8D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B8D719
keybd_event.USER32(00000012,00000000), ref: 00B8D71E
SetForegroundWindow.USER32(?), ref: 00B8D721
AttachThreadInput.USER32(?,?,00000000), ref: 00B8D748

Strings

Shell_TrayWnd, xrefs: 00B8D660

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: bf17b60b67f9c9877f051994ace877b1b1f22c8c168d5e511de9a4d55a2a35d2
Instruction ID: ce7157f824bea81dc180b1668a9aa3e8450b7f98420302dd107e3e643f4f4b30
Opcode Fuzzy Hash: bf17b60b67f9c9877f051994ace877b1b1f22c8c168d5e511de9a4d55a2a35d2
Instruction Fuzzy Hash: 59317771A453187AEB206F619C89F7F7F6CEB44B50F104066FA05EB1E1DA705D00EBA0

Function 00BA8310 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00BA87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00BA882B
Part of subcall function 00BA87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00BA8858
Part of subcall function 00BA87E1: GetLastError.KERNEL32 ref: 00BA8865

_memset.LIBCMT ref: 00BA8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00BA83A5
CloseHandle.KERNEL32(?), ref: 00BA83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00BA83CD
GetProcessWindowStation.USER32 ref: 00BA83E6
SetProcessWindowStation.USER32(00000000), ref: 00BA83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00BA840A

Part of subcall function 00BA81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00BA8309), ref: 00BA81E0
Part of subcall function 00BA81CB: CloseHandle.KERNEL32(?,?,00BA8309), ref: 00BA81F2

Strings

winsta0, xrefs: 00BA83C8
, xrefs: 00BA8362
default, xrefs: 00BA8405

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: e8a5800ba4b2c2148123d61f7bfa549c7e68b65abf8c015c768b14853b3e0838
Instruction ID: e2e797c9590b33d9d85ce170dbedc62a5606bd4c5885aac5af0b669dfb8f1c12
Opcode Fuzzy Hash: e8a5800ba4b2c2148123d61f7bfa549c7e68b65abf8c015c768b14853b3e0838
Instruction Fuzzy Hash: 9B814B71D09209AFDF119FA4CC45AEEBBF9EF05304F1481AAFD15A6661EB318E14DB20

Function 00BBC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00BBC78D
FindClose.KERNEL32(00000000), ref: 00BBC7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BBC806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BBC81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BBC844
__swprintf.LIBCMT ref: 00BBC890
__swprintf.LIBCMT ref: 00BBC8D3

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

__swprintf.LIBCMT ref: 00BBC927

Part of subcall function 00B73698: __woutput_l.LIBCMT ref: 00B736F1

__swprintf.LIBCMT ref: 00BBC975

Part of subcall function 00B73698: __flsbuf.LIBCMT ref: 00B73713
Part of subcall function 00B73698: __flsbuf.LIBCMT ref: 00B7372B

__swprintf.LIBCMT ref: 00BBC9C4
__swprintf.LIBCMT ref: 00BBCA13
__swprintf.LIBCMT ref: 00BBCA62

Strings

%4d, xrefs: 00BBC8CD
%4d%02d%02d%02d%02d%02d, xrefs: 00BBC88A
%02d, xrefs: 00BBC91B, 00BBC925, 00BBC973, 00BBC9C2, 00BBCA11, 00BBCA60

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 59f98f273bdf7acc2e7eaa23f519b74e24d8984ad04622f7aa4d41d5a6bee064
Instruction ID: 176cd7363fccc651d794aeca97498ee8b67e3c9d0d8229cb1da0fb610288eb05
Opcode Fuzzy Hash: 59f98f273bdf7acc2e7eaa23f519b74e24d8984ad04622f7aa4d41d5a6bee064
Instruction Fuzzy Hash: F1A11FB1508305ABC710EF94CC95EBFB7ECEF98701F4049A9F99586191EB35DA08CB62

Function 00BBEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00BBEFB6
_wcscmp.LIBCMT ref: 00BBEFCB
_wcscmp.LIBCMT ref: 00BBEFE2
GetFileAttributesW.KERNEL32(?), ref: 00BBEFF4
SetFileAttributesW.KERNEL32(?,?), ref: 00BBF00E
FindNextFileW.KERNEL32(00000000,?), ref: 00BBF026
FindClose.KERNEL32(00000000), ref: 00BBF031
FindFirstFileW.KERNEL32(*.*,?), ref: 00BBF04D
_wcscmp.LIBCMT ref: 00BBF074
_wcscmp.LIBCMT ref: 00BBF08B
SetCurrentDirectoryW.KERNEL32(?), ref: 00BBF09D
SetCurrentDirectoryW.KERNEL32(00C08920), ref: 00BBF0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BBF0C5
FindClose.KERNEL32(00000000), ref: 00BBF0D2
FindClose.KERNEL32(00000000), ref: 00BBF0E4

Strings

*.*, xrefs: 00BBF048

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 783977bdc71e10a349c8d7063d800573dc1ccf3cf6bfad31819151ed77331f7e
Instruction ID: e59da4f38bbdfa7f468280c9c39da89e82ab13376215a8fa98f9fdc17788d1cb
Opcode Fuzzy Hash: 783977bdc71e10a349c8d7063d800573dc1ccf3cf6bfad31819151ed77331f7e
Instruction Fuzzy Hash: 9631F03250520A6BDB14AFA4DC59AFEB7ECDF48360F0441B2F845E30A1EFB0DA44CA64

Function 00BD0857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BD0953
RegCreateKeyExW.ADVAPI32(?,?,00000000,00BDF910,00000000,?,00000000,?,?), ref: 00BD09C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00BD0A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00BD0A92
RegCloseKey.ADVAPI32(?), ref: 00BD0DB2
RegCloseKey.ADVAPI32(00000000), ref: 00BD0DBF

Strings

REG_EXPAND_SZ, xrefs: 00BD0A2F
REG_MULTI_SZ, xrefs: 00BD0B7A
REG_SZ, xrefs: 00BD0AD0
REG_QWORD, xrefs: 00BD0D00
REG_DWORD, xrefs: 00BD0C83
REG_BINARY, xrefs: 00BD0D4D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 66ec5299bade343ad993e1ad1be2ed6989493bef3820871e5530437cd32a64f5
Instruction ID: f07defda9d4ccd3e9f470572bb884fbde672b96a571506c22aa275710b47653d
Opcode Fuzzy Hash: 66ec5299bade343ad993e1ad1be2ed6989493bef3820871e5530437cd32a64f5
Instruction Fuzzy Hash: 500238756146019FCB14EF24C891E2AB7E5FF89314F0485ADF89A9B3A2DB30ED45CB81

Function 00BDC5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

DragQueryPoint.SHELL32(?,?), ref: 00BDC627

Part of subcall function 00BDAB37: ClientToScreen.USER32(?,?), ref: 00BDAB60
Part of subcall function 00BDAB37: GetWindowRect.USER32(?,?), ref: 00BDABD6
Part of subcall function 00BDAB37: PtInRect.USER32(?,?,00BDC014), ref: 00BDABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 00BDC690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00BDC69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00BDC6BE
_wcscat.LIBCMT ref: 00BDC6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00BDC705
SendMessageW.USER32(?,000000B0,?,?), ref: 00BDC71E
SendMessageW.USER32(?,000000B1,?,?), ref: 00BDC735
SendMessageW.USER32(?,000000B1,?,?), ref: 00BDC757
DragFinish.SHELL32(?), ref: 00BDC75E
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 00BDC851

Strings

@GUI_DRAGFILE, xrefs: 00BDC800
@GUI_DROPID, xrefs: 00BDC77E
@GUI_DRAGID, xrefs: 00BDC7C9

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2166380349-3440237614
Opcode ID: 89b7dbe5146dd2bb2301adc2d838f344b30f99535ccf8b03671099a9d23afafb
Instruction ID: 968dd062ef46fc255852b41928ddc9391b34680786a4e587bffaa44d6794cb34
Opcode Fuzzy Hash: 89b7dbe5146dd2bb2301adc2d838f344b30f99535ccf8b03671099a9d23afafb
Instruction Fuzzy Hash: 1D617D71508301AFC701DF64DC95EAFBBE8EF89310F00496EF595972A1EB309A49CB52

Function 00BBF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00BBF113
_wcscmp.LIBCMT ref: 00BBF128
_wcscmp.LIBCMT ref: 00BBF13F

Part of subcall function 00BB4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00BB43A0

FindNextFileW.KERNEL32(00000000,?), ref: 00BBF16E
FindClose.KERNEL32(00000000), ref: 00BBF179
FindFirstFileW.KERNEL32(*.*,?), ref: 00BBF195
_wcscmp.LIBCMT ref: 00BBF1BC
_wcscmp.LIBCMT ref: 00BBF1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 00BBF1E5
SetCurrentDirectoryW.KERNEL32(00C08920), ref: 00BBF203
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BBF20D
FindClose.KERNEL32(00000000), ref: 00BBF21A
FindClose.KERNEL32(00000000), ref: 00BBF22C

Strings

*.*, xrefs: 00BBF190

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: fb50102ed63f67980684f06a3e2a18d080ebf511ccc7beabeff2e0052c46d35b
Instruction ID: 13a97df6b35d0823ca46f21199c4ada0b3f37d3a1da10626d1225ba958db950d
Opcode Fuzzy Hash: fb50102ed63f67980684f06a3e2a18d080ebf511ccc7beabeff2e0052c46d35b
Instruction Fuzzy Hash: 3131E23650121B6BCB10AFA4EC59AFEB7ECDF45320F1041F2F854A30A0EB70DA45CA54

Function 00BBA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BBA20F
__swprintf.LIBCMT ref: 00BBA231
CreateDirectoryW.KERNEL32(?,00000000), ref: 00BBA26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00BBA293
_memset.LIBCMT ref: 00BBA2B2
_wcsncpy.LIBCMT ref: 00BBA2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00BBA323
CloseHandle.KERNEL32(00000000), ref: 00BBA32E
RemoveDirectoryW.KERNEL32(?), ref: 00BBA337
CloseHandle.KERNEL32(00000000), ref: 00BBA341

Strings

\??\%s, xrefs: 00BBA22B
\, xrefs: 00BBA247
:, xrefs: 00BBA252

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: f4be87ddd25d3d9323d3575d2d4d1da8c6616728d92faf479e65612e5d117361
Instruction ID: 5881a857165c9c2d676ab1b8df6849869d6cc461bd6ac88012b660934d0f8c50
Opcode Fuzzy Hash: f4be87ddd25d3d9323d3575d2d4d1da8c6616728d92faf479e65612e5d117361
Instruction Fuzzy Hash: 8D318DB190410AABDB219FA4DC49FFB77FCEF89740F1041B6F509D2160EBB096448B29

Function 00BDC1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00BDC1FC
GetFocus.USER32 ref: 00BDC20C
GetDlgCtrlID.USER32(00000000), ref: 00BDC217
_memset.LIBCMT ref: 00BDC342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00BDC36D
GetMenuItemCount.USER32(?), ref: 00BDC38D
GetMenuItemID.USER32(?,00000000), ref: 00BDC3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00BDC3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00BDC41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00BDC454
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 00BDC489

Strings

0, xrefs: 00BDC33A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: c35759f9f107af774dccee746c5b58c1471b76e718939d153b21b0b032e38dc3
Instruction ID: 31e855e6206381a086eb85d674d5f8127d07a258baedea12ad1a081a48ec62b8
Opcode Fuzzy Hash: c35759f9f107af774dccee746c5b58c1471b76e718939d153b21b0b032e38dc3
Instruction Fuzzy Hash: D6817B706093029FDB14CF14D894ABABBE8FF89714F0049AEF99597391EB30D905CB92

Function 00BA7CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA8202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00BA821E
Part of subcall function 00BA8202: GetLastError.KERNEL32(?,00BA7CE2,?,?,?), ref: 00BA8228
Part of subcall function 00BA8202: GetProcessHeap.KERNEL32(00000008,?,?,00BA7CE2,?,?,?), ref: 00BA8237
Part of subcall function 00BA8202: RtlAllocateHeap.NTDLL(00000000,?,00BA7CE2), ref: 00BA823E
Part of subcall function 00BA8202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00BA8255

Part of subcall function 00BA829F: GetProcessHeap.KERNEL32(00000008,00BA7CF8,00000000,00000000,?,00BA7CF8,?), ref: 00BA82AB
Part of subcall function 00BA829F: RtlAllocateHeap.NTDLL(00000000,?,00BA7CF8), ref: 00BA82B2
Part of subcall function 00BA829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00BA7CF8,?), ref: 00BA82C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00BA7D13
_memset.LIBCMT ref: 00BA7D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00BA7D47
GetLengthSid.ADVAPI32(?), ref: 00BA7D58
GetAce.ADVAPI32(?,00000000,?), ref: 00BA7D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00BA7DB1
GetLengthSid.ADVAPI32(?), ref: 00BA7DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00BA7DDD
RtlAllocateHeap.NTDLL(00000000), ref: 00BA7DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00BA7E05
CopySid.ADVAPI32(00000000), ref: 00BA7E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00BA7E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00BA7E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00BA7E77

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: e5bc2501b20ecbdabca23ff34c68bf1a4f714b067505b7078364ac32b33a5451
Instruction ID: da5246be21fb1aba21ec7440df51b5ee381ee08e5a8c80437e71a80610424ce0
Opcode Fuzzy Hash: e5bc2501b20ecbdabca23ff34c68bf1a4f714b067505b7078364ac32b33a5451
Instruction Fuzzy Hash: 46611E7190820AAFDF109FA5DC95ABEBBB9FF05300F0481AAE915A7251DB319A05CB60

Function 00B666E1 Relevance: 19.6, Strings: 15, Instructions: 889COMMON

Download Yara Rule

Strings

LIMIT_RECURSION=, xrefs: 00BA11FC
ANYCRLF), xrefs: 00BA12FB
UCP), xrefs: 00BA110D
UTF16), xrefs: 00BA10CF
NO_AUTO_POSSESS), xrefs: 00BA112E
NO_START_OPT), xrefs: 00BA114F
LF), xrefs: 00BA12A4
CR), xrefs: 00BA1287
CRLF), xrefs: 00BA12C1
BSR_UNICODE), xrefs: 00BA1338
UTF), xrefs: 00BA10FA
LIMIT_MATCH=, xrefs: 00BA1170
BSR_ANYCRLF), xrefs: 00BA131E
ANY), xrefs: 00BA12DE
dowp0dowp4dowp2dowp4dowp0dowp5dowpcdowpbdowp2dowpbdowp6dowp5dowpfdowpcdowpfdowpfdowp7dowp5dowpddowp8dowp5dowp9dowpfdowpfdowp7dowp5, xrefs: 00BA1349

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$dowp0dowp4dowp2dowp4dowp0dowp5dowpcdowpbdowp2dowpbdowp6dowp5dowpfdowpcdowpfdowpfdowp7dowp5dowpddowp8dowp5dowp9dowpfdowpfdowp7dowp5
API String ID: 0-3457523301
Opcode ID: 6b08768993bf93741164d4a00ee670c2b7c02c53be94055fb3cc9d9378044832
Instruction ID: 84a8ee8aa1c8e43305f77563b0fe57bb20a7b475170dc2fca9f2c872b165a24e
Opcode Fuzzy Hash: 6b08768993bf93741164d4a00ee670c2b7c02c53be94055fb3cc9d9378044832
Instruction Fuzzy Hash: 58726D71E04219DBDF64CF59C8807AEB7F5FF49310F1485AAE849EB291EB349981CB90

Function 00BB001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00BB0097
SetKeyboardState.USER32(?), ref: 00BB0102
GetAsyncKeyState.USER32(000000A0), ref: 00BB0122
GetKeyState.USER32(000000A0), ref: 00BB0139
GetAsyncKeyState.USER32(000000A1), ref: 00BB0168
GetKeyState.USER32(000000A1), ref: 00BB0179
GetAsyncKeyState.USER32(00000011), ref: 00BB01A5
GetKeyState.USER32(00000011), ref: 00BB01B3
GetAsyncKeyState.USER32(00000012), ref: 00BB01DC
GetKeyState.USER32(00000012), ref: 00BB01EA
GetAsyncKeyState.USER32(0000005B), ref: 00BB0213
GetKeyState.USER32(0000005B), ref: 00BB0221

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: d7ed342c22d929227f56d9a5549e6bdea7fad7563b90d89e4cce48d2a852922d
Instruction ID: 9ac8b69e79fa9050fca53a48fb46d632d329b64a082fa2d3a9063ef13bd1ae64
Opcode Fuzzy Hash: d7ed342c22d929227f56d9a5549e6bdea7fad7563b90d89e4cce48d2a852922d
Instruction Fuzzy Hash: 4651B4209157882BFB35FBA488547FBBFF4DF11380F4845DA99C2561C2EAE49A8CC761

Function 00BD03DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BCFDAD,?,?), ref: 00BD0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BD04AC

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00BD054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00BD05E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00BD0822
RegCloseKey.ADVAPI32(00000000), ref: 00BD082F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: fb1dcebe41d3f290cc017971277db67be779a551c929586f21024e552e093667
Instruction ID: 13fd8f1d7e294898f81d35aee0c39ad15f295d17b151571c49da70359717f208
Opcode Fuzzy Hash: fb1dcebe41d3f290cc017971277db67be779a551c929586f21024e552e093667
Instruction Fuzzy Hash: F4E14F71604205AFCB14EF24C895E6ABBE4FF89714F0485ADF84ADB361DA31ED05CB52

Function 00BC83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

CoInitialize.OLE32 ref: 00BC8403
CoUninitialize.COMBASE ref: 00BC840E
CoCreateInstance.COMBASE(?,00000000,00000017,00BE2BEC,?), ref: 00BC846E
IIDFromString.COMBASE(?,?), ref: 00BC84E1
VariantInit.OLEAUT32(?), ref: 00BC857B
VariantClear.OLEAUT32(?), ref: 00BC85DC

Strings

Invalid parameter, xrefs: 00BC84FA
NULL Pointer assignment, xrefs: 00BC84B3
Failed to create object, xrefs: 00BC8479, 00BC852F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 7e183c18f8552ef990f7241c9bf28a4df1d6359a9af1346aa7382ef4865233e5
Instruction ID: 0a915e8be267b752a2eacfb08a3b77c3d863ad8e05e4b83acbf5ab526cb30b90
Opcode Fuzzy Hash: 7e183c18f8552ef990f7241c9bf28a4df1d6359a9af1346aa7382ef4865233e5
Instruction Fuzzy Hash: 53618970608312AFC714DF64C889F6AB7E8AF49754F04489DF9869B291DB70ED48CB92

Function 00BC4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00BC418B
EmptyClipboard.USER32 ref: 00BC4191
GlobalAlloc.KERNEL32(00000002,?), ref: 00BC41A6
CloseClipboard.USER32 ref: 00BC4245

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 4bcacbc6ed719bf86f51660984f9b9fb871160939af4243db2300cbdca7287ac
Instruction ID: dad28a48c56a6702af1b9da038ba772170d9931429192221b6f6606a6cf39fc1
Opcode Fuzzy Hash: 4bcacbc6ed719bf86f51660984f9b9fb871160939af4243db2300cbdca7287ac
Instruction Fuzzy Hash: 89218D352052119FDB10AF24DC69F6EBBE8EF55751F1480AAF9469B2A1EB30ED00CB54

Function 00BB37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B54750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B54743,?,?,00B537AE,?), ref: 00B54770

Part of subcall function 00BB4A31: GetFileAttributesW.KERNEL32(?,00BB370B), ref: 00BB4A32

FindFirstFileW.KERNEL32(?,?), ref: 00BB38A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00BB394B
MoveFileW.KERNEL32(?,?), ref: 00BB395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00BB397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BB399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00BB39B9

Strings

\*.*, xrefs: 00BB384E, 00BB3857, 00BB386C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 0d7995ebc6b6d3d84bae7a006fdfefa94848e13cfa22e6fdbbe727ddc07f188f
Instruction ID: 03b29317e2158dfe91649dd163af7becab5e3952c603261418037b120a5a9c02
Opcode Fuzzy Hash: 0d7995ebc6b6d3d84bae7a006fdfefa94848e13cfa22e6fdbbe727ddc07f188f
Instruction Fuzzy Hash: 43516D3190514DABCB11EBA0D992AFDB7F9AF15301F6000E9E846771A1EFA16F0DCB61

Function 00BBF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00BBF440
Sleep.KERNEL32(0000000A), ref: 00BBF470
_wcscmp.LIBCMT ref: 00BBF484
_wcscmp.LIBCMT ref: 00BBF49F
FindNextFileW.KERNEL32(?,?), ref: 00BBF53D
FindClose.KERNEL32(00000000), ref: 00BBF553

Strings

*.*, xrefs: 00BBF425

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 26deae6f3979ea7bfd3486e06ab12012c0fdcd9ca8a68eaeea0c2f99851e02f2
Instruction ID: 39e7682a34cf8e2dd4a0fbd717266b625db8158353a298b8e5de050756c024ff
Opcode Fuzzy Hash: 26deae6f3979ea7bfd3486e06ab12012c0fdcd9ca8a68eaeea0c2f99851e02f2
Instruction Fuzzy Hash: 45417C7190421AAFCF24EF64DC55AFEBBF4FF15310F1444A6E815A32A0EB709A58CB50

Function 00BDD43E Relevance: 12.3, APIs: 8, Instructions: 257windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

GetSystemMetrics.USER32(0000000F), ref: 00BDD47C
GetSystemMetrics.USER32(0000000F), ref: 00BDD49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00BDD6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00BDD6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00BDD716
ShowWindow.USER32(00000003,00000000), ref: 00BDD735
InvalidateRect.USER32(?,00000000,00000001), ref: 00BDD75A
NtdllDialogWndProc_W.NTDLL(?,00000005,?,?), ref: 00BDD77D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$DialogInvalidateLongMoveNtdllProc_RectShow
String ID:
API String ID: 830902736-0
Opcode ID: 9cb10c453b93d60f85c939344dec9c44de00bde786c135aa0a86a61646b3bc4b
Instruction ID: 3721af3fac14309b46839b6c91a9b704ef0eef80e718fb9bb4ebb757aedede5b
Opcode Fuzzy Hash: 9cb10c453b93d60f85c939344dec9c44de00bde786c135aa0a86a61646b3bc4b
Instruction Fuzzy Hash: 0AB16A75600216EBDF14CF68C9D57ADBBF1FF04701F0880AAEC899B295E734A950CB90

Function 00B65760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B658A5
_memmove.LIBCMT ref: 00B658F5
_memmove.LIBCMT ref: 00B6595B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c992042c6075735170802f0c0b0665100bd4c0e0efc6d494be00fe29dea6d0b4
Instruction ID: 7e8cfcc25bf7b14118c29c2f057160f94d2a41a0679701a500d877631038095e
Opcode Fuzzy Hash: c992042c6075735170802f0c0b0665100bd4c0e0efc6d494be00fe29dea6d0b4
Instruction Fuzzy Hash: 75128A70A04609DFDF14DFA5D981AAEB7F5FF48300F1085A9E806A7291EB39AD24CB50

Function 00BB3B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B54750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B54743,?,?,00B537AE,?), ref: 00B54770

Part of subcall function 00BB4A31: GetFileAttributesW.KERNEL32(?,00BB370B), ref: 00BB4A32

FindFirstFileW.KERNEL32(?,?), ref: 00BB3B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00BB3BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BB3BEA
FindClose.KERNEL32(00000000), ref: 00BB3C01
FindClose.KERNEL32(00000000), ref: 00BB3C0A

Strings

\*.*, xrefs: 00BB3B5B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 0fa1309a7a14d8a6fd8d4d1fd807326bb4be4ebb6df74fffd497a7275de4b0be
Instruction ID: 1fa729681ff33cb531da707f29e828240684d264959c0e2476244a0a3ffa2f4c
Opcode Fuzzy Hash: 0fa1309a7a14d8a6fd8d4d1fd807326bb4be4ebb6df74fffd497a7275de4b0be
Instruction Fuzzy Hash: A2317E310493859FC201EB64D8A19FFBBE8AE91315F404EADF8D5931A1EF219A0DC763

Function 00BB51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00BA882B
Part of subcall function 00BA87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00BA8858
Part of subcall function 00BA87E1: GetLastError.KERNEL32 ref: 00BA8865

ExitWindowsEx.USER32(?,00000000), ref: 00BB51F9

Strings

SeShutdownPrivilege, xrefs: 00BB51C9
@, xrefs: 00BB51EC
, xrefs: 00BB51E7

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: b85426e5413f449b404dc6253a61313d041e753a0b38118135ef8b57358cbc16
Instruction ID: 5e8e2cb78a9abf6a0d26c51efe020c5d271d9bd2741385e7479ee4e63180f73d
Opcode Fuzzy Hash: b85426e5413f449b404dc6253a61313d041e753a0b38118135ef8b57358cbc16
Instruction Fuzzy Hash: E401F731697A166FE7386668AC9BFFAB3D8DB05740F2404A1F943E20D2EAD11C0085A2

Function 00BC6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00BC62DC
WSAGetLastError.WS2_32(00000000), ref: 00BC62EB
bind.WS2_32(00000000,?,00000010), ref: 00BC6307
listen.WS2_32(00000000,00000005), ref: 00BC6316
WSAGetLastError.WS2_32(00000000), ref: 00BC6330
closesocket.WS2_32(00000000), ref: 00BC6344

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: c2c4517c93e9f8fcbe9d1e9ac2a3e89f8b1bdf0432e8e9e2155baecaebc9c935
Instruction ID: cd9eb14f05561dbbac1bdf68547023fbed6bc53886879386fbc3858c1662b4b3
Opcode Fuzzy Hash: c2c4517c93e9f8fcbe9d1e9ac2a3e89f8b1bdf0432e8e9e2155baecaebc9c935
Instruction Fuzzy Hash: 78219E756002059FCB10EF68C885F7EB7E9EF89721F1481A9E816A72D1DB70AD05CB51

Function 00B65520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00B70DB6: std::exception::exception.LIBCMT ref: 00B70DEC
Part of subcall function 00B70DB6: __CxxThrowException@8.LIBCMT ref: 00B70E01

_memmove.LIBCMT ref: 00BA0258
_memmove.LIBCMT ref: 00BA036D
_memmove.LIBCMT ref: 00BA0414

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 347cbc563faa6f3a392cbfdac8ea53850e0a6220e573557037d094f9439579b8
Instruction ID: 8cf37b27674f3578ca0768e48c20b5b96a662a3f9aa7198e547ab7b9d896aee8
Opcode Fuzzy Hash: 347cbc563faa6f3a392cbfdac8ea53850e0a6220e573557037d094f9439579b8
Instruction Fuzzy Hash: AE02C0B0A14209DBCF14EF64D981AAE7BF5EF49300F5480E9E80AEB251EB35DD54CB91

Function 00B51287 Relevance: 7.9, APIs: 5, Instructions: 379nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 00B519FA
GetSysColor.USER32(0000000F), ref: 00B51A4E
SetBkColor.GDI32(?,00000000), ref: 00B51A61

Part of subcall function 00B51290: NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 00B512D8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ColorDialogNtdllProc_$LongWindow
String ID:
API String ID: 591255283-0
Opcode ID: b9055c05166d6134fa5a5984209f1e3b42b429913d59fc2ba1f7bff097fb176b
Instruction ID: a8dbffa92dc4e20053c4bf2f93b435cb6efddee5e006149c2e21d51a0fa49199
Opcode Fuzzy Hash: b9055c05166d6134fa5a5984209f1e3b42b429913d59fc2ba1f7bff097fb176b
Instruction Fuzzy Hash: B2A15A75106585BAEA2AAB3C8C94FBF25DCDB42343B1409DAFD12D21E2DA249D09D3B1

Function 00BBBCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00BBBCE6
_wcscmp.LIBCMT ref: 00BBBD16
_wcscmp.LIBCMT ref: 00BBBD2B
FindNextFileW.KERNEL32(00000000,?), ref: 00BBBD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00BBBD6C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 3cba8e21fe3fb310a948c5fd9b276975633564cd4d1a37726d00f53a3a75ce4f
Instruction ID: 29fd0b929763af90461c4086537925d2bd0f1c4e3f50598b3c7a7c9eb7c22650
Opcode Fuzzy Hash: 3cba8e21fe3fb310a948c5fd9b276975633564cd4d1a37726d00f53a3a75ce4f
Instruction Fuzzy Hash: 22516E356046029FC714DF68D491EAAB3E4EF49320F1446AEF966873A1DBB4ED04CB91

Function 00BC6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC7D8B: inet_addr.WS2_32(00000000), ref: 00BC7DB6

socket.WS2_32(00000002,00000002,00000011), ref: 00BC679E
WSAGetLastError.WS2_32(00000000), ref: 00BC67C7
bind.WS2_32(00000000,?,00000010), ref: 00BC6800
WSAGetLastError.WS2_32(00000000), ref: 00BC680D
closesocket.WS2_32(00000000), ref: 00BC6821

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 0ba09b17cf2f15fe89ab6d6374c58f4e4d90f3696aeb850bc336d255b0023ad9
Instruction ID: a224b9ecef3d0374be4b2c3a4b5abf5c287ad34550c02198098cd513e0ef4f91
Opcode Fuzzy Hash: 0ba09b17cf2f15fe89ab6d6374c58f4e4d90f3696aeb850bc336d255b0023ad9
Instruction Fuzzy Hash: 5D419D75A00210AFEB10BF248C86F6E77E89B45755F0484EDFD1AAB2D2DA709D048B91

Function 00BD5376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00BD53C5
IsWindowEnabled.USER32 ref: 00BD53D3
GetForegroundWindow.USER32(?,?,00000001), ref: 00BD53E0
IsIconic.USER32 ref: 00BD53EE
IsZoomed.USER32 ref: 00BD53FC

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 58eb10d48aafdb242512adaa2eeece0e01bbaf57b5de13bb844886b903c1e6ee
Instruction ID: 6ff9671fe07c395d85a2638f7208fa9c9b8dd593bc5a55e2524b0e29aee8282e
Opcode Fuzzy Hash: 58eb10d48aafdb242512adaa2eeece0e01bbaf57b5de13bb844886b903c1e6ee
Instruction Fuzzy Hash: B911D0317019116BEB306F269C44B6AFBD8EF443A1B0040AAE847D7341EB70DD018AA8

Function 00BA80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00BA80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00BA80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00BA80D9
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00BA80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00BA80F6

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: fbfb880b4e5806fe84dd6c98a2fee5b2e07ee332648ff41966013ec9de4616f7
Instruction ID: 6e240d5f171be7ceaf8789f93b3591090b795dd8bc73ecac4ea9c0e2fc98d23f
Opcode Fuzzy Hash: fbfb880b4e5806fe84dd6c98a2fee5b2e07ee332648ff41966013ec9de4616f7
Instruction Fuzzy Hash: 37F0C230209206BFEB100FA4EC8DE777BBCEF4A754B000026F906D3150DF609D01DA60

Function 00B63030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 18f3c238f79b49804593693513fb0f512ec8382d50d19a50edaed87bb49c54ff
Instruction ID: 72cd3a0a32067020924cb736e64493ab0f8e7dee43ddb8492cbe5d13b4d82133
Opcode Fuzzy Hash: 18f3c238f79b49804593693513fb0f512ec8382d50d19a50edaed87bb49c54ff
Instruction Fuzzy Hash: E02289716083019FCB24DF24C891B6EB7E4EF85710F1449ADF89A97391DB75EA08CB92

Function 00BCEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00BCEE3D
Process32FirstW.KERNEL32(00000000,?), ref: 00BCEE4B

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Process32NextW.KERNEL32(00000000,?), ref: 00BCEF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00BCEF1A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 1504575f3241c3fc73035573bf9223a4d581d25dec0924897bbc267618c0edc1
Instruction ID: 229eeb0aceca8f13619c60a27eb6843187a9b7ef92bc2644c9df850f144654d6
Opcode Fuzzy Hash: 1504575f3241c3fc73035573bf9223a4d581d25dec0924897bbc267618c0edc1
Instruction Fuzzy Hash: CD515A71508311ABD320EF24DC85F6BB7E8EF94750F1048ADF995972A1EB70E908CB92

Function 00BDC498 Relevance: 6.1, APIs: 4, Instructions: 83nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

GetCursorPos.USER32(?), ref: 00BDC4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00B8B9AB,?,?,?,?,?), ref: 00BDC4E7
GetCursorPos.USER32(?), ref: 00BDC534
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,00B8B9AB,?,?,?), ref: 00BDC56E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: 8c90d1c85285b6c846ff5108c216ae2195b3c097418f5d1491061d962f22566d
Instruction ID: 7fbc241000135038ad5f8dc724c1522b03951703d867499f51a2364b6a4b0498
Opcode Fuzzy Hash: 8c90d1c85285b6c846ff5108c216ae2195b3c097418f5d1491061d962f22566d
Instruction Fuzzy Hash: E731A035600018EFCB158F98D899EEEBFF5EB4A314F0440A6F9058B3A1DB31AD50DBA4

Function 00B51290 Relevance: 6.1, APIs: 4, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 00B512D8
GetClientRect.USER32(?,?), ref: 00B8B5FB
GetCursorPos.USER32(?), ref: 00B8B605
ScreenToClient.USER32(?,?), ref: 00B8B610

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Client$CursorDialogLongNtdllProc_RectScreenWindow
String ID:
API String ID: 1010295502-0
Opcode ID: 6059faa924765350d4718e580211d4eb16eaa756625bd44549b69c6a4499d863
Instruction ID: 31b9e1e43056c6b4cd683374c1fcc8cb351ce029f41caa58a9645e9f6d289da3
Opcode Fuzzy Hash: 6059faa924765350d4718e580211d4eb16eaa756625bd44549b69c6a4499d863
Instruction Fuzzy Hash: 97111935501019FBCB00DF98D885AFEB7F8EB05305F404896E901E7250D731AA55CBA5

Function 00B5FCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 42d7b7d5bf3f8c9f47c12882ba2a38d260db85f65c83bf3f4ae906c25e01fd42
Instruction ID: 133d1a8b40bba1d40241dbc6521b2dd5999847779754aa9a6dec850a18d46ff2
Opcode Fuzzy Hash: 42d7b7d5bf3f8c9f47c12882ba2a38d260db85f65c83bf3f4ae906c25e01fd42
Instruction Fuzzy Hash: 769236706183419FDB24EF15C480B2BB7E1FB89304F1489ADE89A9B362D775EC45CB92

Function 00BAE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00BAE628

Strings

(, xrefs: 00BAE66E
|, xrefs: 00BAE658

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 1d7faa32564c724d331ac05738d62806c0d1340193a3a06efcbd03a931916785
Instruction ID: f3a986dac47a90d9476cbb93ac6e405ee8c54c8299c3357fa155c59bb5743baa
Opcode Fuzzy Hash: 1d7faa32564c724d331ac05738d62806c0d1340193a3a06efcbd03a931916785
Instruction Fuzzy Hash: 26322475A047059FDB28CF59C48196AB7F1FF48320B15C4AEE8AADB3A1E770E941CB40

Function 00BC22EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00BC180A,00000000), ref: 00BC23E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00BC2418

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 036c7eb5e98e211a494fc7f2f9296353b8eb51f837e10a0d42bfb09ab3292d22
Instruction ID: 031299da017675b9bc7607d995de80fccc4303d4bbea2a535dce817f2d3cf9ca
Opcode Fuzzy Hash: 036c7eb5e98e211a494fc7f2f9296353b8eb51f837e10a0d42bfb09ab3292d22
Instruction Fuzzy Hash: 4741E271A04209BFEB209F95DC81FBBB7FCEB80714F1040AEF615A7240EA749E419664

Function 00BBB3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00BBB40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00BBB465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00BBB4B2

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: ddb221b76f5dbf3c028240f3085b5eebe0e10c3a8b72ebbd78ac0b2c9b658e27
Instruction ID: 5f56843f3f2d45db027d8df14923181b0ca9586a466ba5b8fcbd272a43d0d4f9
Opcode Fuzzy Hash: ddb221b76f5dbf3c028240f3085b5eebe0e10c3a8b72ebbd78ac0b2c9b658e27
Instruction Fuzzy Hash: 6D214A75A00518EFCB00EFA5D890AFDBBF8FF49311F1480AAE905AB361DB319919CB51

Function 00BA87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00B70DB6: std::exception::exception.LIBCMT ref: 00B70DEC
Part of subcall function 00B70DB6: __CxxThrowException@8.LIBCMT ref: 00B70E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00BA882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00BA8858
GetLastError.KERNEL32 ref: 00BA8865

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 6dab45450c638d4efdcae50f5228ca30f3ac4ceff36cd7f6c0bcd3e650e53762
Instruction ID: 2e161c6c4d6b07ba67ee330a809a927d5372e2fb7ca59bea94c2b34ba94f69c1
Opcode Fuzzy Hash: 6dab45450c638d4efdcae50f5228ca30f3ac4ceff36cd7f6c0bcd3e650e53762
Instruction Fuzzy Hash: 2B1160B1818305AFD718EF94DC85D6BB7F8EB45710B10856EE45A97641EE34AC408B60

Function 00BA874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00BA8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00BA878B
FreeSid.ADVAPI32(?), ref: 00BA879B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: c3199297661d0ba3b05b91fc02c48cdc14f8a476ab8d46f282da88681596a0ed
Instruction ID: d8ca4e9ae32616991e549c8adb50b1ef13be0524479796e2536d6d164a00e8a9
Opcode Fuzzy Hash: c3199297661d0ba3b05b91fc02c48cdc14f8a476ab8d46f282da88681596a0ed
Instruction Fuzzy Hash: 7AF04F7591530DBFDF00DFF4DC99ABDBBBCEF08201F5044A9A502E3281E6715A048B50

Function 00B516DE Relevance: 3.1, APIs: 2, Instructions: 83nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

Part of subcall function 00B525DB: GetWindowLongW.USER32(?,000000EB), ref: 00B525EC

GetParent.USER32(?), ref: 00B8B7BA
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,00B519B3,?,?,?,00000006,?), ref: 00B8B834

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: 1fd35ef2f26a2460d788d697f3bbabb5f821aa97d3639bd1ac8d9a35adc0342a
Instruction ID: fa86b94eb9f8b89c006c658f7d7b77031c8d76b1512f58c2747ff332f009baa8
Opcode Fuzzy Hash: 1fd35ef2f26a2460d788d697f3bbabb5f821aa97d3639bd1ac8d9a35adc0342a
Instruction Fuzzy Hash: 4721CE78201504AFDB209B2CC884FA93BE6EF4A321F5842D0F9255B2F2C7309E55DB50

Function 00BBC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00BBC6FB
FindClose.KERNEL32(00000000), ref: 00BBC72B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3b6aa9e81d66fb32ea4991fa4b28d88972052944be04de8938a10cde16b4cb42
Instruction ID: 571586f073e2a353af14dff12f3723585fdcec254356e8f3b2677b62bce6e980
Opcode Fuzzy Hash: 3b6aa9e81d66fb32ea4991fa4b28d88972052944be04de8938a10cde16b4cb42
Instruction Fuzzy Hash: E21182716046049FDB10DF29C855A6AF7E5EF45361F04855EF8A58B290DB70AC05CF81

Function 00BDC57D Relevance: 3.0, APIs: 2, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,00B8B93A,?,?,?), ref: 00BDC5F1

Part of subcall function 00B525DB: GetWindowLongW.USER32(?,000000EB), ref: 00B525EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00BDC5D7

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID:
API String ID: 1273190321-0
Opcode ID: c5770ac0f15d1d0b702f60a3e75e3750d2d93eb1f70dc3258738cfc498362e17
Instruction ID: 32a7a22fc7091f3013df0673fb9e6d65f62873b29b12321d061a18bbb55aadeb
Opcode Fuzzy Hash: c5770ac0f15d1d0b702f60a3e75e3750d2d93eb1f70dc3258738cfc498362e17
Instruction Fuzzy Hash: BA01F530201205EBDB255F14EC95F6ABFE6FB96328F0441A6FD051B3E0DB31A801DB90

Function 00BDC93E Relevance: 3.0, APIs: 2, Instructions: 33nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00BDC961
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,00B8BA16,?,?,?,?,?), ref: 00BDC98A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: d9111f54b954b032bedf375cbd584f366b0634c3b5a083e1d0bf90fa333b7f63
Instruction ID: a313dc204252dd78a4876192e73f22025a450e30b9cb7fc13537b7939edef1f0
Opcode Fuzzy Hash: d9111f54b954b032bedf375cbd584f366b0634c3b5a083e1d0bf90fa333b7f63
Instruction Fuzzy Hash: EFF01D72401118FFEB058F45DC19ABEBBB9FB48311F14415AF90152161D7716A51DBA4

Function 00BBA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00BC9468,?,00BDFB84,?), ref: 00BBA097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00BC9468,?,00BDFB84,?), ref: 00BBA0A9

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: ed04976ea06df65f9682e70db53b8cfac670b8530563a5b6152ce333a6966981
Instruction ID: 27391c8ca56d3dcfeb052199035b5e3fe7eb0446323b8ca16cf3642d68163259
Opcode Fuzzy Hash: ed04976ea06df65f9682e70db53b8cfac670b8530563a5b6152ce333a6966981
Instruction Fuzzy Hash: 3EF0823554522EBBDB21AFA4DC48FFA77ACFF08361F0041A6F909D7191DA709944CBA1

Function 00BDCA7C Relevance: 3.0, APIs: 2, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00BDCA84
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,00B8B995,?,?,?,?), ref: 00BDCAB2

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 778f72c1bdc08fd30a972768267d7069ca537684c8fcc3e66bad6457b94c3c6f
Instruction ID: a5634aead97ee2ef954cc44169316523324d44b96cc156f3abafe3029c068fbc
Opcode Fuzzy Hash: 778f72c1bdc08fd30a972768267d7069ca537684c8fcc3e66bad6457b94c3c6f
Instruction Fuzzy Hash: 64E04F7010421ABBEB149F19DC1AFBA7B94EB04751F408216F956DA2E1DA709850D760

Function 00BA81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00BA8309), ref: 00BA81E0
CloseHandle.KERNEL32(?,?,00BA8309), ref: 00BA81F2

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: fd4a486cf92163d7fd0558925026936721683aca615791f54eae5ed89d899881
Instruction ID: 1b2a568df5a99674a2f5f99b3a4cf81dc90baa34e49930d4ffa182a4e62b1d93
Opcode Fuzzy Hash: fd4a486cf92163d7fd0558925026936721683aca615791f54eae5ed89d899881
Instruction Fuzzy Hash: 01E08631015911EFE7212B20EC04D73BBE9EF04310714C86EF46681430DB215C90DB10

Function 00B7A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00BE4178,00B78D57,t of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.,?,?,00000001), ref: 00B7A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00B7A163

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d4fac1d5097ccf6fa3581be1ef32fc67adf02316bfaea93e3d09c5cc3bef95bf
Instruction ID: 2584ae5bdf913aa86908147b3c88ef632a6baba9f28e9309ba3ac1ee7ed2f7ef
Opcode Fuzzy Hash: d4fac1d5097ccf6fa3581be1ef32fc67adf02316bfaea93e3d09c5cc3bef95bf
Instruction Fuzzy Hash: 40B0923105920AABCA002B95EC19BA8BF68EB44AB2F418022F60E86060EF6254508A99

Function 00B5E6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00B93E62

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: e641d32cafeae5e66249e674018e452fbdab950b99b10176c13b24cfaf0709c3
Instruction ID: c73962270b3dc49f4fe5b9f3d542a5e30ff62e523e508ce6c5a4d4e2ab4b60e4
Opcode Fuzzy Hash: e641d32cafeae5e66249e674018e452fbdab950b99b10176c13b24cfaf0709c3
Instruction Fuzzy Hash: 54A24975A00205CBCB28CF54C480BAAB7F2FB59311F6480E9ED25AB351D775EE4ACB91

Function 00B7F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79542cdf30509934ddf3b92c0b137585df5b45b2b333af8b6d80470ca69fc938
Instruction ID: 12f1c9f3d00c3ecbcc202e0f586698c30ad6fefdce1a41a01726d3ba3cc1bdd4
Opcode Fuzzy Hash: 79542cdf30509934ddf3b92c0b137585df5b45b2b333af8b6d80470ca69fc938
Instruction Fuzzy Hash: 2E320522D69F424DD7239634D872335A289AFB73C5F15D737F82ABA9A5EF28C4834104

Function 00B8242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b709bfff5e3ec7d0f6bbc5a3db7d4964b56b49e30ee1a707274cca57882bb1f2
Instruction ID: e325feccdce3a167206744b8a8a2a9410567002dec514bf02e9b0f681019771a
Opcode Fuzzy Hash: b709bfff5e3ec7d0f6bbc5a3db7d4964b56b49e30ee1a707274cca57882bb1f2
Instruction Fuzzy Hash: 26B10330D2AF804DD323A6398871336B69CAFBB2C5F52D71BFC1675D62EB2195834241

Function 00BB8889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00BB889B

Part of subcall function 00B7520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00BB8F6E,00000000,?,?,?,?,00BB911F,00000000,?), ref: 00B75213
Part of subcall function 00B7520A: __aulldiv.LIBCMT ref: 00B75233

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 9ea3f9559c26d80c468621feb7cc531d27ae8b8ac685bab1d660711360dfca5b
Instruction ID: 985e2fc62efd489d4d664fbb590a9031701ab4e65bbceebf7b2906d2664284ca
Opcode Fuzzy Hash: 9ea3f9559c26d80c468621feb7cc531d27ae8b8ac685bab1d660711360dfca5b
Instruction Fuzzy Hash: BD21B4726355108BC729CF25D841BA6B3E5EFA5311B688E6CD0F5CB2D0CA74B905CB54

Function 00BDD78C Relevance: 1.6, APIs: 1, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

NtdllDialogWndProc_W.NTDLL(?,00000112,?,00000000), ref: 00BDD838

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: b8c233b40109bc668e7669e4ad1633df9ea9f1fb5458edcff84788b18cae3f37
Instruction ID: 7234034dbea3f22be669dee21acd89d6cdb625a7bb37931bed812d76d154c923
Opcode Fuzzy Hash: b8c233b40109bc668e7669e4ad1633df9ea9f1fb5458edcff84788b18cae3f37
Instruction Fuzzy Hash: 0B11EB34204215EBEB265A2CCC46FBA7794D742720F204396F5955B7D2EA619D00A395

Function 00BDD3B8 Relevance: 1.5, APIs: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B525DB: GetWindowLongW.USER32(?,000000EB), ref: 00B525EC

NtdllDialogWndProc_W.NTDLL(?,00000115,?,?,?,?,?,?,00B8B952,?,?,?,?,00000000,?), ref: 00BDD432

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 94e91c09718891e8d7d4a8cd65803fe3e6bbd242dfd751e592347e657d110d4c
Instruction ID: 350272583afbe57b843031f886f952494889454b283d8f388f9e9b0dc330b97c
Opcode Fuzzy Hash: 94e91c09718891e8d7d4a8cd65803fe3e6bbd242dfd751e592347e657d110d4c
Instruction Fuzzy Hash: DC01F531600014ABDB148F28D845BF9BBD1EF46321F4441A6F9861B391E730BC119BA0

Function 00B5189B Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

NtdllDialogWndProc_W.NTDLL(?,00000006,00000000,?,?,?,00B51B04,?,?,?,?,?), ref: 00B518E2

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 1b3b7c5ea42011aeff3a696d81e44aee746ee83558007e7f07165482943ac5d4
Instruction ID: 05a1f5aee0daffdc2371d191ff161977207957f0cbf97db1c3477022a14f8258
Opcode Fuzzy Hash: 1b3b7c5ea42011aeff3a696d81e44aee746ee83558007e7f07165482943ac5d4
Instruction Fuzzy Hash: 98F09A30600215DFDB18DF08D891BAA37E2FB85311F5085A9FC524B2E0CB319850AB90

Function 00BDC8BE Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 00BDC8FE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: f774f499d7bb6d53b6b07c9307d5fbfc9741a95c8ff63a3e2beb8e37ea46415b
Instruction ID: a92d417d16b18100004eec1c3f60c656dd303ddf2b8d12d6d316a228c79aef55
Opcode Fuzzy Hash: f774f499d7bb6d53b6b07c9307d5fbfc9741a95c8ff63a3e2beb8e37ea46415b
Instruction Fuzzy Hash: B4F06D31241255EFDF21DF58DC45FD67B95EB1A320F048059BA11672E2CB716920E7A0

Function 00BB4C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00BB4C4A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 28d983e9e5f1ab3b0820d15acd5e755bbfebb5f1a781a0985ddf5b7cdfc75c04
Instruction ID: 92958ad8d03f6777f78cb57c3f8bed4b8b1504fbe9d3f4e4b498aac21c7dcab7
Opcode Fuzzy Hash: 28d983e9e5f1ab3b0820d15acd5e755bbfebb5f1a781a0985ddf5b7cdfc75c04
Instruction Fuzzy Hash: ECD09E9516A61A7BED6C0B209E1FFFA5AC8F340F96FD495C976028A0C3EEE09C445131

Function 00BA87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00BA8389), ref: 00BA87D1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: de5b10b6caec9397273b8378b8170b0d8099b89fb3d83ba1cd7a43b7d6dc2a17
Instruction ID: 32a799f27d911051d639dc5100bf0ad7b0e816b3233fbda4b2517916f45fb872
Opcode Fuzzy Hash: de5b10b6caec9397273b8378b8170b0d8099b89fb3d83ba1cd7a43b7d6dc2a17
Instruction Fuzzy Hash: 2CD05E3226450EABEF018EA4DC01EBE3B69EB04B01F408111FE16C61A1C775D935AB60

Function 00BDC909 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,00B8B9BC,?,?,?,?,?,?), ref: 00BDC934

Part of subcall function 00BDB635: _memset.LIBCMT ref: 00BDB644
Part of subcall function 00BDB635: _memset.LIBCMT ref: 00BDB653
Part of subcall function 00BDB635: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00C16F20,00C16F64), ref: 00BDB682
Part of subcall function 00BDB635: CloseHandle.KERNEL32 ref: 00BDB694

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: be3c843a1d3b238b4b0c7b174e5b02e7adbb990ec01f5044b73c9b36c46ff5a1
Instruction ID: 4016b49eb33dbdb107cfb33fb715e9e40e43b77d996b83ad2d9adee2c1093283
Opcode Fuzzy Hash: be3c843a1d3b238b4b0c7b174e5b02e7adbb990ec01f5044b73c9b36c46ff5a1
Instruction Fuzzy Hash: D0E04632200209EFCB02AF44EC60E99BBB1FB1C304F018092FA06073B2DB31A920EF50

Function 00B5167D Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?,?,00B51AEE,?,?,?), ref: 00B516AB

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 408551426d32053d75f7184b187a7371d5601ad952897ea41a7a22e46535d777
Instruction ID: cdebdd10ec2259ed16aaeec08f6b299c8595bd3c98ce5f05231e8fa65e7253f4
Opcode Fuzzy Hash: 408551426d32053d75f7184b187a7371d5601ad952897ea41a7a22e46535d777
Instruction Fuzzy Hash: B0E0EC35641208FFCF05AF90DC51F683B66FB9A315F508498FA450B2A1CA32A522EB50

Function 00BDC88F Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 00BDC8B4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 57011929ce6335edf7b63f57dfe5238c0de948af24b8820af7c73bb9449e7ecc
Instruction ID: 3c9ef09ecf933672fc291907acbcb5c11a9a6ca36f28b2bfeddd00d589049a78
Opcode Fuzzy Hash: 57011929ce6335edf7b63f57dfe5238c0de948af24b8820af7c73bb9449e7ecc
Instruction Fuzzy Hash: 81E0E235240209EFDB01DF88E884EDA3BA5BB1E300F008054FA0547262CB71A820EBA1

Function 00BDC860 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 00BDC885

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 0acc48ed992d40cab9471dd5a55c873e01e95fef125845d0d2a37324868d73f5
Instruction ID: 67d1579e2cd2f0d1e0a3b74efc2ddfb2f1b8c410a294e677478ffa8fe4d01591
Opcode Fuzzy Hash: 0acc48ed992d40cab9471dd5a55c873e01e95fef125845d0d2a37324868d73f5
Instruction Fuzzy Hash: C7E0E235244209EFDB01DF88E884E9A3BA5BB1E300F004054FA0547262CB71A820EB61

Function 00B516B5 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

Part of subcall function 00B5201B: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00B520D3
Part of subcall function 00B5201B: KillTimer.USER32(-00000001,?,?,?,?,00B516CB,00000000,?,?,00B51AE2,?,?), ref: 00B5216E

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,00B51AE2,?,?), ref: 00B516D4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: 58680f3d70494f5a162eafdf44b2d8cf834e9a8a742237d244c48e4b09dd6417
Instruction ID: 9023519871329960233a7a94a2e3865807d8c1212ca693d49d8148e911910be2
Opcode Fuzzy Hash: 58680f3d70494f5a162eafdf44b2d8cf834e9a8a742237d244c48e4b09dd6417
Instruction Fuzzy Hash: AFD01270142308B7DE113B50DC17F597A599B59751F408061BE05291D3CA716950A598

Function 00B7A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00B7A12A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cca3169ee5d9d4dcf72a566438e974aa8594e39b53ad91a64a7b93fc7464eb7d
Instruction ID: be1d70e7357b9cf8852dec30238f5a4d460c744870e985a17fcbe6ab61f12366
Opcode Fuzzy Hash: cca3169ee5d9d4dcf72a566438e974aa8594e39b53ad91a64a7b93fc7464eb7d
Instruction Fuzzy Hash: 0AA0123000410DA7CA001B45EC04454BF5CD6001A07004021F40D410219B3254104584

Function 00B68808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c446f53b08d84fa4e82cbb76f0c6b6d924838729dac22bc74d39ebd1cff9d299
Instruction ID: 9f2cf382c96c99471667ba67928557e91acd16141424dfc809957550e177d5ff
Opcode Fuzzy Hash: c446f53b08d84fa4e82cbb76f0c6b6d924838729dac22bc74d39ebd1cff9d299
Instruction Fuzzy Hash: 9E223730508606CBDF388AA4C4D477D77E1FF42344F2882EBDA569B592DB789E91CB81

Function 00B721C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 14973e1bfa812320dc693cb107ed92112594c00c3d681847bd641e9a48dd7f91
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: B0C185322051930ADF2D473D847503EFAE19EA27B131A87EDD8BBDB1D5EE20C965D620

Function 00B725FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 24dc4dfc989a72fb6be43480d7d6974a2022f7467a4fb9711f3c4bc231c4de30
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 73C185322051930ADF2D473EC47513EBAE19EA27B131A87EDD4BBDB1D5EE20C925D620

Function 00B71978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: c6b82ca1cf05a7471c543d14db86c40b50865be8e2ded7f27863ea2399583739
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: D8C1733220519309DF2D463D847513EBAE1DEA27B131A9BEDD4BBDB1C4EE20C965DA30

Function 00BC7806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00BC785B
DeleteObject.GDI32(00000000), ref: 00BC786D
DestroyWindow.USER32 ref: 00BC787B
GetDesktopWindow.USER32 ref: 00BC7895
GetWindowRect.USER32(00000000), ref: 00BC789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00BC79DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00BC79ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BC7A35
GetClientRect.USER32(00000000,?), ref: 00BC7A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00BC7A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BC7A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BC7AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BC7ABB
GlobalLock.KERNEL32(00000000), ref: 00BC7AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BC7AD3
GlobalUnlock.KERNEL32(00000000), ref: 00BC7ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BC7AE3
GlobalFree.KERNEL32(00000000), ref: 00BC7AEE
CreateStreamOnHGlobal.COMBASE(00000000,00000001,88C00000), ref: 00BC7B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00BE2CAC,00000000), ref: 00BC7B16
GlobalFree.KERNEL32(00000000), ref: 00BC7B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00BC7B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00BC7B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BC7B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BC7D7A

Strings

DISPLAY, xrefs: 00BC7BDD
static, xrefs: 00BC7A75, 00BC7BCC
AutoIt v3, xrefs: 00BC7A2D
, xrefs: 00BC7D00

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 89ee713a66a7db44dd3abb089f052e0ad23cc225011de5afb4f2f04728a376b1
Instruction ID: ba41fcd744fa0d64080f7f11bf7b8f0b048aa7b63ec934511768fd292f4f3774
Opcode Fuzzy Hash: 89ee713a66a7db44dd3abb089f052e0ad23cc225011de5afb4f2f04728a376b1
Instruction Fuzzy Hash: 12026A71900115EFDB14DFA4CC99EAEBBB9FB49310F1481A9F916AB2A0DB709D01CF60

Function 00BD356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00BDF910), ref: 00BD3627
IsWindowVisible.USER32(?), ref: 00BD364B

Strings

EDITPASTE, xrefs: 00BD395F
GETLINECOUNT, xrefs: 00BD38C6
FINDSTRING, xrefs: 00BD3776
GETCURRENTSELECTION, xrefs: 00BD37E3
DELSTRING, xrefs: 00BD3749
GETLINE, xrefs: 00BD399B
UNCHECK, xrefs: 00BD3883
ISCHECKED, xrefs: 00BD3839
SENDCOMMANDID, xrefs: 00BD39DA
GETCURRENTCOL, xrefs: 00BD3928
SHOWDROPDOWN, xrefs: 00BD36E0
TABLEFT, xrefs: 00BD3687
GETCURRENTLINE, xrefs: 00BD38ED
GETSELECTED, xrefs: 00BD38A3
ISVISIBLE, xrefs: 00BD3637
ISENABLED, xrefs: 00BD366B
CHECK, xrefs: 00BD386D
SELECTSTRING, xrefs: 00BD3806
HIDEDROPDOWN, xrefs: 00BD3700
TABRIGHT, xrefs: 00BD369D
CURRENTTAB, xrefs: 00BD36BD
SETCURRENTSELECTION, xrefs: 00BD37B6
ADDSTRING, xrefs: 00BD3716

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 69a163962d9a3f61504399de29301002fa954c1470f7930e8cdb53f57c711447
Instruction ID: 1203d0394c2abd8baa39a332a360c0a21b234d7abca3e99a4e9f54411ee93462
Opcode Fuzzy Hash: 69a163962d9a3f61504399de29301002fa954c1470f7930e8cdb53f57c711447
Instruction Fuzzy Hash: DCD15E702187019BCA04EF10C456A6EB7E1EF55B54F1484EAF8965B3E3EB31DE0ACB52

Function 00BDA5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00BDA630
GetSysColorBrush.USER32(0000000F), ref: 00BDA661
GetSysColor.USER32(0000000F), ref: 00BDA66D
SetBkColor.GDI32(?,000000FF), ref: 00BDA687
SelectObject.GDI32(?,00000000), ref: 00BDA696
InflateRect.USER32(?,000000FF,000000FF), ref: 00BDA6C1
GetSysColor.USER32(00000010), ref: 00BDA6C9
CreateSolidBrush.GDI32(00000000), ref: 00BDA6D0
FrameRect.USER32(?,?,00000000), ref: 00BDA6DF
DeleteObject.GDI32(00000000), ref: 00BDA6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 00BDA731
FillRect.USER32(?,?,00000000), ref: 00BDA763
GetWindowLongW.USER32(?,000000F0), ref: 00BDA78E

Part of subcall function 00BDA8CA: GetSysColor.USER32(00000012), ref: 00BDA903
Part of subcall function 00BDA8CA: SetTextColor.GDI32(?,?), ref: 00BDA907
Part of subcall function 00BDA8CA: GetSysColorBrush.USER32(0000000F), ref: 00BDA91D
Part of subcall function 00BDA8CA: GetSysColor.USER32(0000000F), ref: 00BDA928
Part of subcall function 00BDA8CA: GetSysColor.USER32(00000011), ref: 00BDA945
Part of subcall function 00BDA8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00BDA953
Part of subcall function 00BDA8CA: SelectObject.GDI32(?,00000000), ref: 00BDA964
Part of subcall function 00BDA8CA: SetBkColor.GDI32(?,00000000), ref: 00BDA96D
Part of subcall function 00BDA8CA: SelectObject.GDI32(?,?), ref: 00BDA97A
Part of subcall function 00BDA8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 00BDA999
Part of subcall function 00BDA8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00BDA9B0
Part of subcall function 00BDA8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 00BDA9C5
Part of subcall function 00BDA8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00BDA9ED

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: e9295c39548670e57be9df4eeac80759faa150c4752098aac771e92af795ffd9
Instruction ID: d2da2d31ec493ff8b467935bbb80c93608f88d355a38ff54984dc53edadb479f
Opcode Fuzzy Hash: e9295c39548670e57be9df4eeac80759faa150c4752098aac771e92af795ffd9
Instruction Fuzzy Hash: 77916F72409302EFC7109F64DC48A6BBBE9FB48325F144A2AF962971A0EB71D944CB52

Function 00BC74AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00BC74DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00BC759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00BC75DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00BC75ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00BC7633
GetClientRect.USER32(00000000,?), ref: 00BC763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00BC7683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00BC7692
GetStockObject.GDI32(00000011), ref: 00BC76A2
SelectObject.GDI32(00000000,00000000), ref: 00BC76A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00BC76B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BC76BF
DeleteDC.GDI32(00000000), ref: 00BC76C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00BC76F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 00BC770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00BC7746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00BC775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 00BC776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00BC779B
GetStockObject.GDI32(00000011), ref: 00BC77A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00BC77B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00BC77BB

Strings

DISPLAY, xrefs: 00BC7688
static, xrefs: 00BC767D, 00BC7795
msctls_progress32, xrefs: 00BC773C
AutoIt v3, xrefs: 00BC762B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 3b0b5645bc2b2cbdf42642936b4edfa10beaf713a417c19f1c0f45e6cc58571e
Instruction ID: b55ae31a7babccc080d319ea2e52a01bc9d1a43ed451d0f42953288dbbddf48e
Opcode Fuzzy Hash: 3b0b5645bc2b2cbdf42642936b4edfa10beaf713a417c19f1c0f45e6cc58571e
Instruction Fuzzy Hash: 44A17EB1A40615FFEB14DBA4DC4AFAEBBB9EB45710F048155FA15A72E0DB70AD00CB60

Function 00BBAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00BBAD1E
GetDriveTypeW.KERNEL32(?,00BDFAC0,?,\\.\,00BDF910), ref: 00BBADFB
SetErrorMode.KERNEL32(00000000,00BDFAC0,?,\\.\,00BDF910), ref: 00BBAF59

Strings

SSD, xrefs: 00BBAE86
SCSI, xrefs: 00BBAEC6
SSA, xrefs: 00BBAEE2
USB, xrefs: 00BBAEF0
Virtual, xrefs: 00BBAF21
RAID, xrefs: 00BBAEF7
RAMDisk, xrefs: 00BBAE25
ATA, xrefs: 00BBAED4
Removable, xrefs: 00BBAE4D
Fixed, xrefs: 00BBAE43
MMC, xrefs: 00BBAF1A
SAS, xrefs: 00BBAF05
Fibre, xrefs: 00BBAEE9
CDROM, xrefs: 00BBAE2F
\\.\, xrefs: 00BBAD70
1394, xrefs: 00BBAEDB
PhysicalDrive, xrefs: 00BBADA7
iSCSI, xrefs: 00BBAEFE
SATA, xrefs: 00BBAF0C
Unknown, xrefs: 00BBAE1B, 00BBAEBF
Network, xrefs: 00BBAE39
ATAPI, xrefs: 00BBAECD
FileBackedVirtual, xrefs: 00BBAF28

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: fc15660b7d4e47194c17c23d5d9b8a90df3e1b6eae02775576673e5172061c01
Instruction ID: 1a89923056b557a92e7978ce2d3c73ea7de2f39d027447d21a34d554fae210ab
Opcode Fuzzy Hash: fc15660b7d4e47194c17c23d5d9b8a90df3e1b6eae02775576673e5172061c01
Instruction Fuzzy Hash: 765142B0A48605DBCB10EB10C9A2DFD73E1EB4871172480E6F847E76D1DEB19D49EB52

Function 00B568DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00B56931
__wcsnicmp.LIBCMT ref: 00B56949
__wcsnicmp.LIBCMT ref: 00B56961
__wcsnicmp.LIBCMT ref: 00B56979
__wcsnicmp.LIBCMT ref: 00B56991
__wcsnicmp.LIBCMT ref: 00B569A9
__wcsnicmp.LIBCMT ref: 00B569C1
__wcsnicmp.LIBCMT ref: 00B569D5
__wcsnicmp.LIBCMT ref: 00B56A16
__wcsnicmp.LIBCMT ref: 00B56A2A
__wcsnicmp.LIBCMT ref: 00B56A3E
__wcsnicmp.LIBCMT ref: 00B56A52

Strings

#comments-end, xrefs: 00B56A38
#ce, xrefs: 00B56A4C
#OnAutoItStartRegister, xrefs: 00B56973
Unterminated group of comments, xrefs: 00B8E403
Bad directive syntax error, xrefs: 00B8E31A
#comments-start, xrefs: 00B569BB, 00B56A10
#notrayicon, xrefs: 00B56943
#cs, xrefs: 00B569CF, 00B56A24
#requireadmin, xrefs: 00B5695B
#include, xrefs: 00B569A3
#include-once, xrefs: 00B5698B
#pragma compile, xrefs: 00B5692B
Cannot parse #include, xrefs: 00B8E3F0

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 09587c1d1db511c23000e8aa8ab6af1a4187a1866c7b9b6a037b2fb086871340
Instruction ID: e4be2d7e57e9fbe91780a8bd294162ec816080e3432789c5375c8a17723cc2a3
Opcode Fuzzy Hash: 09587c1d1db511c23000e8aa8ab6af1a4187a1866c7b9b6a037b2fb086871340
Instruction Fuzzy Hash: 918117B0600206AACB25BB60DC82FBE37E8EF15701F4440E5FD15AB1E2EB60DE49D360

Function 00BD9A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00BD9AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00BD9B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00BD9BA7

Strings

0, xrefs: 00BD9BE4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 381cc0db43800db27a9fc02bb2285f22694c3abc41f398209b112b942d811c58
Instruction ID: 14d7617e66eba9640eea0fde3a00c1d0160ffab5a8398251899a9f885d0e23cc
Opcode Fuzzy Hash: 381cc0db43800db27a9fc02bb2285f22694c3abc41f398209b112b942d811c58
Instruction Fuzzy Hash: FF02DE30109202AFE725CF14C898BAAFBE5FF49314F0485AEF999D63A1E734D944CB52

Function 00BDA8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00BDA903
SetTextColor.GDI32(?,?), ref: 00BDA907
GetSysColorBrush.USER32(0000000F), ref: 00BDA91D
GetSysColor.USER32(0000000F), ref: 00BDA928
CreateSolidBrush.GDI32(?), ref: 00BDA92D
GetSysColor.USER32(00000011), ref: 00BDA945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00BDA953
SelectObject.GDI32(?,00000000), ref: 00BDA964
SetBkColor.GDI32(?,00000000), ref: 00BDA96D
SelectObject.GDI32(?,?), ref: 00BDA97A
InflateRect.USER32(?,000000FF,000000FF), ref: 00BDA999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00BDA9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00BDA9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00BDA9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00BDAA14
InflateRect.USER32(?,000000FD,000000FD), ref: 00BDAA32
DrawFocusRect.USER32(?,?), ref: 00BDAA3D
GetSysColor.USER32(00000011), ref: 00BDAA4B
SetTextColor.GDI32(?,00000000), ref: 00BDAA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00BDAA67
SelectObject.GDI32(?,00BDA5FA), ref: 00BDAA7E
DeleteObject.GDI32(?), ref: 00BDAA89
SelectObject.GDI32(?,?), ref: 00BDAA8F
DeleteObject.GDI32(?), ref: 00BDAA94
SetTextColor.GDI32(?,?), ref: 00BDAA9A
SetBkColor.GDI32(?,?), ref: 00BDAAA4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: a142292cdba9886bd84c8fbb9331dc3666d96c78c85dff52f377bca1d19b158c
Instruction ID: 44a976ad8fe89096131798a4da00953c13a2e5f5dee8c21ea8983322aab8dd1f
Opcode Fuzzy Hash: a142292cdba9886bd84c8fbb9331dc3666d96c78c85dff52f377bca1d19b158c
Instruction Fuzzy Hash: 9D516271905209FFDF109FA4DC48EAEBBB9EF08320F154166F912AB2A1EB759940CF50

Function 00BD89D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00BD8AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BD8AD2
CharNextW.USER32(0000014E), ref: 00BD8B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00BD8B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00BD8B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BD8B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00BD8B86
SetWindowTextW.USER32(?,0000014E), ref: 00BD8BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00BD8BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00BD8C1F
_memset.LIBCMT ref: 00BD8C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00BD8C8D
_memset.LIBCMT ref: 00BD8CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00BD8D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00BD8D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00BD8E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00BD8E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00BD8E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00BD8EB4
DrawMenuBar.USER32(?), ref: 00BD8EC3
SetWindowTextW.USER32(?,0000014E), ref: 00BD8EEB

Strings

0, xrefs: 00BD8E55

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 0e9e518fb71f9f2eaaa599a70a0fa9eb547fffad78ddd61a34c748f9766632a1
Instruction ID: d4e718c8e4e888817265762c4a33794c4ef2f8b9652b7805a936478b4efa176b
Opcode Fuzzy Hash: 0e9e518fb71f9f2eaaa599a70a0fa9eb547fffad78ddd61a34c748f9766632a1
Instruction Fuzzy Hash: 0CE16171905209AFDB219F54CC84EEEBBF9EF05711F1481A7F919AB290EB709980DF60

Function 00BD488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BD49CA
GetDesktopWindow.USER32 ref: 00BD49DF
GetWindowRect.USER32(00000000), ref: 00BD49E6
GetWindowLongW.USER32(?,000000F0), ref: 00BD4A48
DestroyWindow.USER32(?), ref: 00BD4A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00BD4A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BD4ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00BD4AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00BD4AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00BD4B09
IsWindowVisible.USER32(?), ref: 00BD4B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00BD4B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00BD4B58
GetWindowRect.USER32(?,?), ref: 00BD4B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00BD4B96
GetMonitorInfoW.USER32(00000000,?), ref: 00BD4BB0
CopyRect.USER32(?,?), ref: 00BD4BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00BD4C32

Strings

tooltips_class32, xrefs: 00BD4A96
(, xrefs: 00BD4BA3
0, xrefs: 00BD4975

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: a88e865ab056742ad42228cbba01b0928f2b202b3c830c4a1c24666e258004d6
Instruction ID: 7ae8b76c6124896e1e54e35cab04ad176b86c791ea281a2bc6dd30d803911865
Opcode Fuzzy Hash: a88e865ab056742ad42228cbba01b0928f2b202b3c830c4a1c24666e258004d6
Instruction Fuzzy Hash: 82B16C71608341AFDB04DF64C884B6AFBE4FF85314F00899EF9999B291EB71D805CB55

Function 00B527D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B528BC
GetSystemMetrics.USER32(00000007), ref: 00B528C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B528EF
GetSystemMetrics.USER32(00000008), ref: 00B528F7
GetSystemMetrics.USER32(00000004), ref: 00B5291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00B52939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00B52949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00B5297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00B52990
GetClientRect.USER32(00000000,000000FF), ref: 00B529AE
GetStockObject.GDI32(00000011), ref: 00B529CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00B529D5

Part of subcall function 00B52344: GetCursorPos.USER32(?), ref: 00B52357
Part of subcall function 00B52344: ScreenToClient.USER32(00C157B0,?), ref: 00B52374
Part of subcall function 00B52344: GetAsyncKeyState.USER32(00000001), ref: 00B52399
Part of subcall function 00B52344: GetAsyncKeyState.USER32(00000002), ref: 00B523A7

SetTimer.USER32(00000000,00000000,00000028,00B51256), ref: 00B529FC

Strings

AutoIt v3 GUI, xrefs: 00B52974

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 8fc30edeb294e4d48438fe82663f2ae9c883d9bdafb2101c0791ab6fccf9b0d7
Instruction ID: 807b9f7c9a2338729aa9c130df3b4d45543dba7fc3d0a42d4a1f8e909117c6d3
Opcode Fuzzy Hash: 8fc30edeb294e4d48438fe82663f2ae9c883d9bdafb2101c0791ab6fccf9b0d7
Instruction Fuzzy Hash: 63B16C71A0120ADFDB14EFA8DC95BED7BF4FB49311F1081A9FA16A72A0DB749841CB50

Function 00BB449A Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00BB4500
_wcscmp.LIBCMT ref: 00BB450B
_wcscat.LIBCMT ref: 00BB4521
_wcsstr.LIBCMT ref: 00BB452C
751C1560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00BB4548
_wcscat.LIBCMT ref: 00BB4591
_wcscat.LIBCMT ref: 00BB4598
_wcsncpy.LIBCMT ref: 00BB45C3

Strings

\VarFileInfo\Translation, xrefs: 00BB4540
DefaultLangCodepage, xrefs: 00BB45AB
%u.%u.%u.%u, xrefs: 00BB4626
04090000, xrefs: 00BB457E
StringFileInfo\, xrefs: 00BB451B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _wcscat$C1560_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 2258151342-1459072770
Opcode ID: c9f2be280c561059120efa154a243dafc4d921b2c019b7c1ba66324e18935bc3
Instruction ID: 6322ca4e3f171953acfa8d369556025a98217f41446df7c95b11459bbcb71599
Opcode Fuzzy Hash: c9f2be280c561059120efa154a243dafc4d921b2c019b7c1ba66324e18935bc3
Instruction Fuzzy Hash: C741E531A042057BDB10AB748C47EFF77FCEF45710F0480EAF919A6192EF759A0196A5

Function 00BAA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00BAA47A
__swprintf.LIBCMT ref: 00BAA51B
_wcscmp.LIBCMT ref: 00BAA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00BAA583
_wcscmp.LIBCMT ref: 00BAA5BF
GetClassNameW.USER32(?,?,00000400), ref: 00BAA5F6
GetDlgCtrlID.USER32(?), ref: 00BAA648
GetWindowRect.USER32(?,?), ref: 00BAA67E
GetParent.USER32(?), ref: 00BAA69C
ScreenToClient.USER32(00000000), ref: 00BAA6A3
GetClassNameW.USER32(?,?,00000100), ref: 00BAA71D
_wcscmp.LIBCMT ref: 00BAA731
GetWindowTextW.USER32(?,?,00000400), ref: 00BAA757
_wcscmp.LIBCMT ref: 00BAA76B

Part of subcall function 00B7362C: _iswctype.LIBCMT ref: 00B73634

Strings

%s%u, xrefs: 00BAA515

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 8556ea27b6be8e7baa8e3578c828b32896fd122f01b3118a8cfcf328520801bf
Instruction ID: 801f85abfc449bc1c3fe46684ff50a5597f6806648d01d98cd35a45f72c1b10a
Opcode Fuzzy Hash: 8556ea27b6be8e7baa8e3578c828b32896fd122f01b3118a8cfcf328520801bf
Instruction Fuzzy Hash: 36A1B171208706AFDB15DF64C884BAAF7E8FF45314F00856AF999D2190DB30ED55CBA2

Function 00BAAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00BAAF18
_wcscmp.LIBCMT ref: 00BAAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 00BAAF51
CharUpperBuffW.USER32(?,00000000), ref: 00BAAF6E
_wcscmp.LIBCMT ref: 00BAAF8C
_wcsstr.LIBCMT ref: 00BAAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00BAAFD5
_wcscmp.LIBCMT ref: 00BAAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 00BAB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 00BAB055
_wcscmp.LIBCMT ref: 00BAB065
GetClassNameW.USER32(00000010,?,00000400), ref: 00BAB08D
GetWindowRect.USER32(00000004,?), ref: 00BAB0F6

Strings

@, xrefs: 00BAAEF9
ThumbnailClass, xrefs: 00BAAFE0, 00BAB060

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: b589756a205414cd3329a59d2bf61c7d5ce60b64c9a36a860de4e558d7e0b687
Instruction ID: 9dccfa126dd549d34dd74e0bbb285fa6f413af5d459801c5fd2202a8b33528f3
Opcode Fuzzy Hash: b589756a205414cd3329a59d2bf61c7d5ce60b64c9a36a860de4e558d7e0b687
Instruction Fuzzy Hash: CD81B07110C2069FDB15DF10C881FAABBE8EF45714F0484EAFD999A092EB34DD89CB61

Function 00BAABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00BAAC33

Strings

REGEXP=, xrefs: 00BAAC48
[REGEXPTITLE:, xrefs: 00BAAC5B
ACTIVE, xrefs: 00BAAC0E
[CLASS:, xrefs: 00BAAC83
[ACTIVE, xrefs: 00BAAC20
[ALL, xrefs: 00BAACD9
HANDLE=, xrefs: 00BAAC2C
[HANDLE:, xrefs: 00BAAC3F
LAST, xrefs: 00BAABF8
[LAST, xrefs: 00BAACE0
CLASSNAME=, xrefs: 00BAAC70
ALL, xrefs: 00BAACC7

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 06628e620a855ddb900075977b4ae90630e00d891781f32437ea0d5fbb034ae5
Instruction ID: ac64a3d0f356a9190a0e4b0efee890ee15e6f65d07596f9b7f0bbc12e1f18b1d
Opcode Fuzzy Hash: 06628e620a855ddb900075977b4ae90630e00d891781f32437ea0d5fbb034ae5
Instruction Fuzzy Hash: 8D317231B4C209AADA18FB50DE53FAE77E8DB11B21F2005E9B856710D1FF516F08D662

Function 00BC4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00BC5013
LoadCursorW.USER32(00000000,00007F00), ref: 00BC501E
LoadCursorW.USER32(00000000,00007F03), ref: 00BC5029
LoadCursorW.USER32(00000000,00007F8B), ref: 00BC5034
LoadCursorW.USER32(00000000,00007F01), ref: 00BC503F
LoadCursorW.USER32(00000000,00007F81), ref: 00BC504A
LoadCursorW.USER32(00000000,00007F88), ref: 00BC5055
LoadCursorW.USER32(00000000,00007F80), ref: 00BC5060
LoadCursorW.USER32(00000000,00007F86), ref: 00BC506B
LoadCursorW.USER32(00000000,00007F83), ref: 00BC5076
LoadCursorW.USER32(00000000,00007F85), ref: 00BC5081
LoadCursorW.USER32(00000000,00007F82), ref: 00BC508C
LoadCursorW.USER32(00000000,00007F84), ref: 00BC5097
LoadCursorW.USER32(00000000,00007F04), ref: 00BC50A2
LoadCursorW.USER32(00000000,00007F02), ref: 00BC50AD
LoadCursorW.USER32(00000000,00007F89), ref: 00BC50B8
GetCursorInfo.USER32(?), ref: 00BC50C8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: ddcaf1cf5ce3062ab4695065f6c95c1c83b374d2dd5ebd8bf15257bf9626b15c
Instruction ID: 6db2ca095b6768acc542fa88487ca5a28ad0943e043decabe727b121577d9007
Opcode Fuzzy Hash: ddcaf1cf5ce3062ab4695065f6c95c1c83b374d2dd5ebd8bf15257bf9626b15c
Instruction Fuzzy Hash: 6131F4B1D4831A6ADF209FB68C89D6FBFE8FF04750F50456AA50DE7280DA786540CF91

Function 00BDA1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BDA259
DestroyWindow.USER32(?,?), ref: 00BDA2D3

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00BDA34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00BDA36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BDA382
DestroyWindow.USER32(00000000), ref: 00BDA3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00B50000,00000000), ref: 00BDA3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BDA3F4
GetDesktopWindow.USER32 ref: 00BDA40D
GetWindowRect.USER32(00000000), ref: 00BDA414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00BDA42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00BDA444

Part of subcall function 00B525DB: GetWindowLongW.USER32(?,000000EB), ref: 00B525EC

Strings

tooltips_class32, xrefs: 00BDA346, 00BDA3D4
0, xrefs: 00BDA26F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 891c7466b156d5dee7b78dfd46489d34dfb5cf5a3de6ebd7643af8cc640422d5
Instruction ID: 1d9a22c4184d89284d63ee358727484512a5e7cd9c47efdd0b653584138e15dc
Opcode Fuzzy Hash: 891c7466b156d5dee7b78dfd46489d34dfb5cf5a3de6ebd7643af8cc640422d5
Instruction Fuzzy Hash: AB719070144206AFD725CF18CC59FAAB7E9FB89300F04456EF985873A1EBB4E906CB52

Function 00BD4392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00BD4424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00BD446F

Strings

GETTEXT, xrefs: 00BD45C2
SELECT, xrefs: 00BD4620
EXPAND, xrefs: 00BD4521
EXISTS, xrefs: 00BD44D8
GETSELECTED, xrefs: 00BD457F
GETITEMCOUNT, xrefs: 00BD4551
COLLAPSE, xrefs: 00BD44B5
UNCHECK, xrefs: 00BD464B
CHECK, xrefs: 00BD448F
GETTOTALCOUNT, xrefs: 00BD4456
ISCHECKED, xrefs: 00BD45F2

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: d27c8dbc740b937caa6d39d70f7493cb8ef5deaac2fe89c024d4dab420cd504d
Instruction ID: 49448f248c2aadb034b4836a6324bff21b9bc9610f99dbe560281e6a3b4c5dcd
Opcode Fuzzy Hash: d27c8dbc740b937caa6d39d70f7493cb8ef5deaac2fe89c024d4dab420cd504d
Instruction Fuzzy Hash: F5915D746047019FCB04EF10C852A6EB7E1EF95754F0488EAF8965B3A2DB30ED49CB81

Function 00BDB7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00BDB8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00BD91C2), ref: 00BDB910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BDB949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00BDB98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BDB9C3
FreeLibrary.KERNEL32(?), ref: 00BDB9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00BDB9DF
DestroyCursor.USER32(?), ref: 00BDB9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00BDBA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00BDBA17

Part of subcall function 00B72EFD: __wcsicmp_l.LIBCMT ref: 00B72F86

Strings

.icl, xrefs: 00BDB82A
.dll, xrefs: 00BDB86D
.exe, xrefs: 00BDB84A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 3907162815-1154884017
Opcode ID: 3f8a58bba4c87d562627194a13f69d392e08cc290a3a76527006714ab2d24531
Instruction ID: df61ef2f7aee538b5d68982084b2f1be7b8057792ae7e829c82956c8e67315df
Opcode Fuzzy Hash: 3f8a58bba4c87d562627194a13f69d392e08cc290a3a76527006714ab2d24531
Instruction Fuzzy Hash: DF61DF71900219FAEB14DF64CC51FBEBBE8EB08721F108596F915D62C1EB749A80DBA0

Function 00BBA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

CharLowerBuffW.USER32(?,?), ref: 00BBA3CB
GetDriveTypeW.KERNEL32 ref: 00BBA418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BBA460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BBA497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BBA4C5

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

Strings

closed, xrefs: 00BBA3DF, 00BBA3E8
open, xrefs: 00BBA3F2
close cd wait, xrefs: 00BBA4B0
set cd door , xrefs: 00BBA466
wait, xrefs: 00BBA482
close, xrefs: 00BBA3D1
type cdaudio alias cd wait, xrefs: 00BBA443
open , xrefs: 00BBA427

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: bc24af055324f000a6e43a40705d29db8918df427b8ef2a1550400b27eec206d
Instruction ID: 47cadb547917e516cbcea960a0b7b7f6b61ea9cc3ce15bdd23ae4cbcb82cbe99
Opcode Fuzzy Hash: bc24af055324f000a6e43a40705d29db8918df427b8ef2a1550400b27eec206d
Instruction Fuzzy Hash: B2516E716087059FC700EF10C89196AB7F8FF98759F1088ADF89A572A1DB71ED0ACB52

Function 00BAF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,00B8E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00BAF8DF
LoadStringW.USER32(00000000,?,00B8E029,00000001), ref: 00BAF8E8

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

GetModuleHandleW.KERNEL32(00000000,00C15310,?,00000FFF,?,?,00B8E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00BAF90A
LoadStringW.USER32(00000000,?,00B8E029,00000001), ref: 00BAF90D
__swprintf.LIBCMT ref: 00BAF95D
__swprintf.LIBCMT ref: 00BAF96E
_wprintf.LIBCMT ref: 00BAFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00BAFA2E

Strings

Line %d (File "%s"):, xrefs: 00BAF957
Line %d:, xrefs: 00BAF968
^ ERROR, xrefs: 00BAF9C3
Error: , xrefs: 00BAF9E5
%s (%d) : ==> %s: %s %s, xrefs: 00BAFA12

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 0aee8aa983fe2a629f4b537555549b7239fb1a68b0d3f5dfbaba6f63c79c3545
Instruction ID: f327d0e2149f940294675f37ced9e3ad1fd5ac28b1bceea016ff6445651bc14f
Opcode Fuzzy Hash: 0aee8aa983fe2a629f4b537555549b7239fb1a68b0d3f5dfbaba6f63c79c3545
Instruction Fuzzy Hash: BB413D72944209AACB15EBE0DD96EFEB7B8EF19301F1040E5B905760A2EE355F0DCA61

Function 00BDBA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00BD9207,?,?), ref: 00BDBA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00BD9207,?,?,00000000,?), ref: 00BDBA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00BD9207,?,?,00000000,?), ref: 00BDBA78
CloseHandle.KERNEL32(00000000,?,?,?,?,00BD9207,?,?,00000000,?), ref: 00BDBA85
GlobalLock.KERNEL32(00000000), ref: 00BDBA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00BD9207,?,?,00000000,?), ref: 00BDBA9D
GlobalUnlock.KERNEL32(00000000), ref: 00BDBAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,00BD9207,?,?,00000000,?), ref: 00BDBAAD
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00BDBABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00BE2CAC,?), ref: 00BDBAD7
GlobalFree.KERNEL32(00000000), ref: 00BDBAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 00BDBB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00BDBB36
DeleteObject.GDI32(00000000), ref: 00BDBB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00BDBB74

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 1245a71c53b07b65e93383239f715b4b974795b4b0fb00406c41bd8764cfaa9e
Instruction ID: c95c6f259702a9c0d6a156a3dc81a32e1da601c4369a7723254f8e9b69e49a66
Opcode Fuzzy Hash: 1245a71c53b07b65e93383239f715b4b974795b4b0fb00406c41bd8764cfaa9e
Instruction Fuzzy Hash: 65412975601205EFDB119F65DC98EBABBF9EF89711F1140AAF906D7260EB309A01CB60

Function 00BBD899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00BBDA10
_wcscat.LIBCMT ref: 00BBDA28
_wcscat.LIBCMT ref: 00BBDA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BBDA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 00BBDA63
GetFileAttributesW.KERNEL32(?), ref: 00BBDA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00BBDA95
SetCurrentDirectoryW.KERNEL32(?), ref: 00BBDAA7

Strings

*.*, xrefs: 00BBDAE6

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: d3e6562ae35c0095c1a25761320a0b6c172f740d9e905eec6a38102301fac872
Instruction ID: cf91af45a1a93d5a68b0d444675c385baacad6c09f35e5315669da57870180a6
Opcode Fuzzy Hash: d3e6562ae35c0095c1a25761320a0b6c172f740d9e905eec6a38102301fac872
Instruction Fuzzy Hash: CA8191716042419FCB24DF64C884ABAB7E4EF89350F1888AEF8C9C7251F7B8D945CB52

Function 00BC731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BC738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00BC739B
CreateCompatibleDC.GDI32(?), ref: 00BC73A7
SelectObject.GDI32(00000000,?), ref: 00BC73B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00BC7408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00BC7444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00BC7468
SelectObject.GDI32(00000006,?), ref: 00BC7470
DeleteObject.GDI32(?), ref: 00BC7479
DeleteDC.GDI32(00000006), ref: 00BC7480
ReleaseDC.USER32(00000000,?), ref: 00BC748B

Strings

(, xrefs: 00BC7410

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 9b6a6a186eb699cce09e5183bc817abcc938fd8b2b7404d3d6cea50b86238e6f
Instruction ID: 46845caf4d0fa697a80cafa5e186053ac74eaa7de45898e7778f28715931d982
Opcode Fuzzy Hash: 9b6a6a186eb699cce09e5183bc817abcc938fd8b2b7404d3d6cea50b86238e6f
Instruction Fuzzy Hash: BF513875904209EFCB14CFA8CC85EAEBBF9EF88310F14846EF95A97210DB31A941CB50

Function 00B56A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00B70957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00B56B0C,?,00008000), ref: 00B70973

Part of subcall function 00B54750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B54743,?,?,00B537AE,?), ref: 00B54770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00B56BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00B56CFA

Part of subcall function 00B5586D: _wcscpy.LIBCMT ref: 00B558A5

Part of subcall function 00B7363D: _iswctype.LIBCMT ref: 00B73645

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00B8E496
Error opening the file, xrefs: 00B8E43D, 00B8E4B8
AU3!, xrefs: 00B56B61
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00B8E421
Bad directive syntax error, xrefs: 00B8E79D
EA06, xrefs: 00B8E452
Unterminated string, xrefs: 00B8E7E4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: c029238e0cd11a7596859cf4daf24396cebab44d74809c335dce9de8994d25d2
Instruction ID: 48f2924056980deb8df32274284c739893681a648450438c65d1ecccc2c1434a
Opcode Fuzzy Hash: c029238e0cd11a7596859cf4daf24396cebab44d74809c335dce9de8994d25d2
Instruction Fuzzy Hash: A002BC301083419FC724EF24C891AAFBBF5EF99315F5048ADF89A972A1DB30D949CB52

Function 00BB2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB2D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00BB2DDD
GetMenuItemCount.USER32(00C15890), ref: 00BB2E66
DeleteMenu.USER32(00C15890,00000005,00000000,000000F5,?,?), ref: 00BB2EF6
DeleteMenu.USER32(00C15890,00000004,00000000), ref: 00BB2EFE
DeleteMenu.USER32(00C15890,00000006,00000000), ref: 00BB2F06
DeleteMenu.USER32(00C15890,00000003,00000000), ref: 00BB2F0E
GetMenuItemCount.USER32(00C15890), ref: 00BB2F16
SetMenuItemInfoW.USER32(00C15890,00000004,00000000,00000030), ref: 00BB2F4C
GetCursorPos.USER32(?), ref: 00BB2F56
SetForegroundWindow.USER32(00000000), ref: 00BB2F5F
TrackPopupMenuEx.USER32(00C15890,00000000,?,00000000,00000000,00000000), ref: 00BB2F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00BB2F7E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: b4bf8cbb3901e52f328926ecdd00d1373943c0eb89c3e472cf72a14df6d951c6
Instruction ID: f7cee4a5ac52c16bafa013b61ead7d4ba39a09e9ab43f47a0d457dbb64ce4044
Opcode Fuzzy Hash: b4bf8cbb3901e52f328926ecdd00d1373943c0eb89c3e472cf72a14df6d951c6
Instruction Fuzzy Hash: 1A71B270605206BFEB218F55DC85FFABFA4FB04764F1442A6F615AA1E1C7F19820DB90

Function 00BA77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

_memset.LIBCMT ref: 00BA786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00BA78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00BA78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00BA78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00BA7902
CLSIDFromString.COMBASE(?,?), ref: 00BA792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00BA7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00BA793A

Strings

\IPC$, xrefs: 00BA7882
SOFTWARE\Classes\, xrefs: 00BA780C
\CLSID, xrefs: 00BA7822

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 916b17238d59ba13935f5bb8eed23e7481f5042c69887a45105ea26357d76778
Instruction ID: b3352783009413ffa112c7dfdfb65df3c599a1f6bcb94519007a0d58febbcccf
Opcode Fuzzy Hash: 916b17238d59ba13935f5bb8eed23e7481f5042c69887a45105ea26357d76778
Instruction Fuzzy Hash: 1B410A72D58229ABCF11EF94EC55EEEB7B8FF04351F0441AAE905A31A1EE345D09CB90

Function 00BD0E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BCFDAD,?,?), ref: 00BD0E31

Strings

HKCU, xrefs: 00BD0F21
HKEY_CURRENT_USER, xrefs: 00BD0F10
HKEY_USERS, xrefs: 00BD0F32
HKU, xrefs: 00BD0F43
HKEY_CLASSES_ROOT, xrefs: 00BD0EC4
HKCC, xrefs: 00BD0EFF
HKEY_CURRENT_CONFIG, xrefs: 00BD0EEE
HKCR, xrefs: 00BD0ED9
HKLM, xrefs: 00BD0EAF
HKEY_LOCAL_MACHINE, xrefs: 00BD0E9A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 75492e00ee1c53e0e5146e3ee1fe71281a6244580dc7cb9e244c9d5c65efc30f
Instruction ID: 0653afebd4caee8befe6c82a60b690ff1ecae0fd086444778eebc74616056b39
Opcode Fuzzy Hash: 75492e00ee1c53e0e5146e3ee1fe71281a6244580dc7cb9e244c9d5c65efc30f
Instruction Fuzzy Hash: 23414C7152424A8FCF14FF50D8A6BEE77A4EF21700F6444A6FC651B292EB309D1ACB60

Function 00BAF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00B8E2A0,00000010,?,Bad directive syntax error,00BDF910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00BAF7C2
LoadStringW.USER32(00000000,?,00B8E2A0,00000010), ref: 00BAF7C9

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

_wprintf.LIBCMT ref: 00BAF7FC
__swprintf.LIBCMT ref: 00BAF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00BAF88D

Strings

Line %d (File "%s"):, xrefs: 00BAF833
Line %d:, xrefs: 00BAF818
%s (%d) : ==> %s.: %s %s, xrefs: 00BAF7F7
., xrefs: 00BAF873
Error: , xrefs: 00BAF85B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 193bf44c593e42e849101b705d8ff09897830d7eb2ba369d56ec6d4bd158c1d4
Instruction ID: 5ce6fa01ef5fc9aacdbc701e5832bb83bdd579261ec89f428a9663d04c978cc8
Opcode Fuzzy Hash: 193bf44c593e42e849101b705d8ff09897830d7eb2ba369d56ec6d4bd158c1d4
Instruction Fuzzy Hash: BA218D3294421AEBCF12EF90CC5AEFE77B8FF18701F0444E6F915660A2EA319618DB50

Function 00BB52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

Part of subcall function 00B57924: _memmove.LIBCMT ref: 00B579AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00BB5330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00BB5346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BB5357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00BB5369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00BB537A

Strings

play PlayMe, xrefs: 00BB5375
status PlayMe mode, xrefs: 00BB532B
play PlayMe wait, xrefs: 00BB5364
close PlayMe, xrefs: 00BB5341, 00BB536E
alias PlayMe, xrefs: 00BB5309
open , xrefs: 00BB52DF

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 2652c725ad4b64ed1e66cf486c44768767e3f41bd0e0fb8a197247cbcecd0c45
Instruction ID: 7aadb9e0a380cd0c097c76939a7d498d12ea00950aa355dbd11fc8a5da200257
Opcode Fuzzy Hash: 2652c725ad4b64ed1e66cf486c44768767e3f41bd0e0fb8a197247cbcecd0c45
Instruction Fuzzy Hash: 9111C430A901297AD720B765DC4AEFFBBFCEB91B41F0004A9B802A20D1EEA00D08C5B5

Function 00BB46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00BB46D2
gethostname.WS2_32(?,00000100), ref: 00BB46EC
gethostbyname.WS2_32(?), ref: 00BB46F9
_wcscpy.LIBCMT ref: 00BB4721
_memmove.LIBCMT ref: 00BB4734
inet_ntoa.WS2_32(?), ref: 00BB473F
_strcat.LIBCMT ref: 00BB474D
_wcscpy.LIBCMT ref: 00BB4764
WSACleanup.WS2_32 ref: 00BB4772
_wcscpy.LIBCMT ref: 00BB4780

Strings

0.0.0.0, xrefs: 00BB471B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 706e3cf7bacc0657c363aac628bebe1a3d8eba3438b9b05a00d26b84e14c3f52
Instruction ID: fa115367fe49d0bda050ab425e4883147d5ef79e1b1d9c0bd7354b2e53211930
Opcode Fuzzy Hash: 706e3cf7bacc0657c363aac628bebe1a3d8eba3438b9b05a00d26b84e14c3f52
Instruction Fuzzy Hash: 9611A135904115ABCB20AB319C46AFA77F8EB02711F0481F6F45A96192FFB18E81C651

Function 00BB4F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BB4F7A

Part of subcall function 00B7049F: timeGetTime.WINMM(?,7694B400,00B60E7B), ref: 00B704A3

Sleep.KERNEL32(0000000A), ref: 00BB4FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00BB4FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00BB4FEC
SetActiveWindow.USER32 ref: 00BB500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00BB5019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00BB5038
Sleep.KERNEL32(000000FA), ref: 00BB5043
IsWindow.USER32 ref: 00BB504F
EndDialog.USER32(00000000), ref: 00BB5060

Strings

BUTTON, xrefs: 00BB4FDE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: a111bc5987ae75a8e56d71c1e5f26328903b812669a82977be51f29a231ea622
Instruction ID: cb036a3715abc8a16d30c101f69e75f99a370f297fc1303af68f826b578741fb
Opcode Fuzzy Hash: a111bc5987ae75a8e56d71c1e5f26328903b812669a82977be51f29a231ea622
Instruction Fuzzy Hash: 0421A47060A606BFE7206F20EC99BBA7BEAFB57745F049065F106831B1DFB18D00C662

Function 00BBD58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

CoInitialize.OLE32(00000000), ref: 00BBD5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00BBD67D
SHGetDesktopFolder.SHELL32(?), ref: 00BBD691
CoCreateInstance.COMBASE(00BE2D7C,00000000,00000001,00C08C1C,?), ref: 00BBD6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00BBD74C
CoTaskMemFree.COMBASE(?), ref: 00BBD7A4
_memset.LIBCMT ref: 00BBD7E1
SHBrowseForFolderW.SHELL32(?), ref: 00BBD81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00BBD840
CoTaskMemFree.COMBASE(00000000), ref: 00BBD847
CoTaskMemFree.COMBASE(00000000), ref: 00BBD87E
CoUninitialize.COMBASE ref: 00BBD880

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 7e4e027c7fec56acd8592e3886ac65293fd9edfbc645ec94bd048a8429cdd8c2
Instruction ID: 91660e0d525a9f5140464eb1dc15583267e9ca1d5f502f3a0e23e90fca5e12a6
Opcode Fuzzy Hash: 7e4e027c7fec56acd8592e3886ac65293fd9edfbc645ec94bd048a8429cdd8c2
Instruction Fuzzy Hash: 69B10B75A00109EFDB04DFA4C894EAEBBF9FF49304B1484A9E90ADB261DB74ED45CB50

Function 00BAC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00BAC283
GetWindowRect.USER32(00000000,?), ref: 00BAC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00BAC2F3
GetDlgItem.USER32(?,00000002), ref: 00BAC2FE
GetWindowRect.USER32(00000000,?), ref: 00BAC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00BAC364
GetDlgItem.USER32(?,000003E9), ref: 00BAC372
GetWindowRect.USER32(00000000,?), ref: 00BAC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00BAC3C6
GetDlgItem.USER32(?,000003EA), ref: 00BAC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00BAC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00BAC3FE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: c49c7284b9fb677a9b5ef7c22569ccde396626488a8fa162fc298584f38ac0a2
Instruction ID: b0c70ba9592c5390f16ff806ea708c348c804bac766d7e55a22683940cdced0b
Opcode Fuzzy Hash: c49c7284b9fb677a9b5ef7c22569ccde396626488a8fa162fc298584f38ac0a2
Instruction Fuzzy Hash: E2513E71B04205ABDF18CFA9DD99AAEBBF6EB88310F14816DF516D7290DB709D00CB10

Function 00B521A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00B525DB: GetWindowLongW.USER32(?,000000EB), ref: 00B525EC

GetSysColor.USER32(0000000F), ref: 00B521D3

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: e0ff6c919ffadc0ce241e79c9615dc38dd1ea40d68c09c1124b2d483a5f5ff81
Instruction ID: da9e0770cee454b2aa1f6ca3cf508f0e0d2c0f77f83b7ee333b67642ebedd1a2
Opcode Fuzzy Hash: e0ff6c919ffadc0ce241e79c9615dc38dd1ea40d68c09c1124b2d483a5f5ff81
Instruction Fuzzy Hash: BF41A335006540DEDB215F28EC98BB93BA5EB07322F1442E6FD659B1E1DB328C46DB11

Function 00BBA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00BDF910), ref: 00BBA90B
GetDriveTypeW.KERNEL32(00000061,00C089A0,00000061), ref: 00BBA9D5
_wcscpy.LIBCMT ref: 00BBA9FF

Strings

fixed, xrefs: 00BBA953
unknown, xrefs: 00BBA996
cdrom, xrefs: 00BBA927
ramdisk, xrefs: 00BBA97F
network, xrefs: 00BBA969
all, xrefs: 00BBA911
removable, xrefs: 00BBA93D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 15e91e9ec46207c39ddd817e80db763b12729b370c9927048c906aee3ac890aa
Instruction ID: 1a3ec61e54c088f21d70bcd3b0b33f04df75c22ada0c9956bb5e894337afa009
Opcode Fuzzy Hash: 15e91e9ec46207c39ddd817e80db763b12729b370c9927048c906aee3ac890aa
Instruction Fuzzy Hash: 06519A319183019FC710EF14C892ABEB7E5EF94740F5488AEF896572A2DBB19909CA53

Function 00B59837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00B59862
__swprintf.LIBCMT ref: 00B598AC
__i64tow.LIBCMT ref: 00B8F5E6

Strings

%.15g, xrefs: 00B598A6
0x%p, xrefs: 00B8F5C8
True, xrefs: 00B8F5A7
False, xrefs: 00B8F5AE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: f75dcdcda3c826bfb5e9838b576a348ac16a80283e29ade676a475b98f86a0e7
Instruction ID: 041f304e7c98a297dec2dfd0fc52e30dba6d9ad75f7269b44748f8b74e5d7ef2
Opcode Fuzzy Hash: f75dcdcda3c826bfb5e9838b576a348ac16a80283e29ade676a475b98f86a0e7
Instruction Fuzzy Hash: CE41D671614206EFDB24EF74D882BBA73E8EF15300F2484FEE959D7291EA319946CB10

Function 00BD7152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BD716A
CreateMenu.USER32 ref: 00BD7185
SetMenu.USER32(?,00000000), ref: 00BD7194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BD7221
IsMenu.USER32(?), ref: 00BD7237
CreatePopupMenu.USER32 ref: 00BD7241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00BD726E
DrawMenuBar.USER32 ref: 00BD7276

Strings

0, xrefs: 00BD7160
F, xrefs: 00BD7262

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 3048c031edbcbf26977b481ec1e99559d9560d49fcec0b5bd441136a24b265aa
Instruction ID: 36f2face16ecb11fc6e2fc637b16d71ba031e5169cc7b50adb4c454659f81302
Opcode Fuzzy Hash: 3048c031edbcbf26977b481ec1e99559d9560d49fcec0b5bd441136a24b265aa
Instruction Fuzzy Hash: 27412874A05205EFDB14DF64D884BEABBF5FF4A350F1441AAF905A7351EB31A910CB90

Function 00BD74BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00BD755E
CreateCompatibleDC.GDI32(00000000), ref: 00BD7565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00BD7578
SelectObject.GDI32(00000000,00000000), ref: 00BD7580
GetPixel.GDI32(00000000,00000000,00000000), ref: 00BD758B
DeleteDC.GDI32(00000000), ref: 00BD7594
GetWindowLongW.USER32(?,000000EC), ref: 00BD759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00BD75B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00BD75BE

Strings

static, xrefs: 00BD74F6

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: fc46e71acafff161069a16f186bcc81ae5f674a5d0e6fc98b11aa398e4479e3d
Instruction ID: 776f3085788f1a3168f006a1c579c28191331c068179fd6639a5b8e6d9986b2a
Opcode Fuzzy Hash: fc46e71acafff161069a16f186bcc81ae5f674a5d0e6fc98b11aa398e4479e3d
Instruction Fuzzy Hash: 40319231105115BBDF119F64DC19FEBBBA9FF19324F114266FA16922E0EB31D811DB60

Function 00B76E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B76E3E

Part of subcall function 00B78B28: __getptd_noexit.LIBCMT ref: 00B78B28

__gmtime64_s.LIBCMT ref: 00B76ED7
__gmtime64_s.LIBCMT ref: 00B76F0D
__gmtime64_s.LIBCMT ref: 00B76F2A
__allrem.LIBCMT ref: 00B76F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B76F9C
__allrem.LIBCMT ref: 00B76FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B76FD1
__allrem.LIBCMT ref: 00B76FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B77006
__invoke_watson.LIBCMT ref: 00B77077

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 971e340617294d8811cb2ad45ae647be3a8a559877337b8f2cc689f7f1b3ab1d
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 3171E876A40B17ABD714AE78DC81B5AB3E4EF04724F14C5B9F528D7291EB70DE408790

Function 00BB2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB2542
GetMenuItemInfoW.USER32(00C15890,000000FF,00000000,00000030), ref: 00BB25A3
SetMenuItemInfoW.USER32(00C15890,00000004,00000000,00000030), ref: 00BB25D9
Sleep.KERNEL32(000001F4), ref: 00BB25EB
GetMenuItemCount.USER32(?), ref: 00BB262F
GetMenuItemID.USER32(?,00000000), ref: 00BB264B
GetMenuItemID.USER32(?,-00000001), ref: 00BB2675
GetMenuItemID.USER32(?,?), ref: 00BB26BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00BB2700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BB2714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BB2735

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 26e574041c224a572c6329ad1ef1bce2e20974300111ae9fda117d8ca0132fe5
Instruction ID: 3dee1b787c799db79a7ba2e9c1b675e3a956179ba104286d07b894d610e369ad
Opcode Fuzzy Hash: 26e574041c224a572c6329ad1ef1bce2e20974300111ae9fda117d8ca0132fe5
Instruction Fuzzy Hash: A0618D7090024AAFDF21CF64DC98EFEBBF8EB45308F144599E842A7251DBB1AD05DB21

Function 00BD6F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00BD6FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00BD6FA8
GetWindowLongW.USER32(?,000000F0), ref: 00BD6FCC
_memset.LIBCMT ref: 00BD6FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00BD6FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00BD7067

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 7c7372fcf05e9bf527e53ef85c13a35cbff45e7217b15288fd3b7cd6432e3ded
Instruction ID: c7d36b6eb51e5c8602c5d572ff233c49ce0c7f4089db78496b41c8131c1dd829
Opcode Fuzzy Hash: 7c7372fcf05e9bf527e53ef85c13a35cbff45e7217b15288fd3b7cd6432e3ded
Instruction Fuzzy Hash: 86616D75940208AFDB11DFA4CC81FEEB7F8EB49710F14419AFA14AB3A1E771A941DB90

Function 00BA6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00BA6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00BA6C18
VariantInit.OLEAUT32(?), ref: 00BA6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00BA6C4A
VariantCopy.OLEAUT32(?,?), ref: 00BA6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00BA6CB1
VariantClear.OLEAUT32(?), ref: 00BA6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00BA6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00BA6CDC
VariantClear.OLEAUT32(?), ref: 00BA6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00BA6CF9

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 69342fb6e0559363ffd8d9aeba560d0b8c016d6b11b7efb9eb333501a39add19
Instruction ID: 4b845bba5bad86115ddc61230d6f8a5b29c64b39d8dde6f097707dfd42d868d8
Opcode Fuzzy Hash: 69342fb6e0559363ffd8d9aeba560d0b8c016d6b11b7efb9eb333501a39add19
Instruction Fuzzy Hash: 37413F75A04219EFCF00DF68D8549AEBBF9EF09354F0480A9E956E7361DB30A945CFA0

Function 00BC5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00BC5793
inet_addr.WS2_32(?), ref: 00BC57D8
gethostbyname.WS2_32(?), ref: 00BC57E4
IcmpCreateFile.IPHLPAPI ref: 00BC57F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00BC5862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00BC5878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00BC58ED
WSACleanup.WS2_32 ref: 00BC58F3

Strings

Ping, xrefs: 00BC5816

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 6d94967184ac94953e1e58adc0369c91e53942405ce13dd71ec7f38e4baf2cf3
Instruction ID: 4c1018e77bf952599008184b5cad816df8191ce769f7bf3280969b9c4e38f2d5
Opcode Fuzzy Hash: 6d94967184ac94953e1e58adc0369c91e53942405ce13dd71ec7f38e4baf2cf3
Instruction Fuzzy Hash: 46516F316047019FDB209F24DC95F6AB7E4EF48710F0485AAF996DB2A1DB70E844DB51

Function 00BBB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00BBB4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00BBB546
GetLastError.KERNEL32 ref: 00BBB550
SetErrorMode.KERNEL32(00000000,READY), ref: 00BBB5BD

Strings

UNKNOWN, xrefs: 00BBB575
READY, xrefs: 00BBB596
NOTREADY, xrefs: 00BBB57C
INVALID, xrefs: 00BBB58F
READONLY, xrefs: 00BBB588

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 682ef9b26280c19b5901e0164e83ff801582bce68743a8d2c8f41a509aaf96ff
Instruction ID: 2efe9442d699f94626e00bcf5335622845079d8dc4c51f322de4c7b04731d85c
Opcode Fuzzy Hash: 682ef9b26280c19b5901e0164e83ff801582bce68743a8d2c8f41a509aaf96ff
Instruction Fuzzy Hash: 1E316F75A00209DBCB20EB68CCA5FFDB7F4EF14311F1441A6E90597291DBF09A45CB52

Function 00BA8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00BAAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00BAAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00BA9014
GetDlgCtrlID.USER32 ref: 00BA901F
GetParent.USER32 ref: 00BA903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00BA903E
GetDlgCtrlID.USER32(?), ref: 00BA9047
GetParent.USER32(?), ref: 00BA9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00BA9066

Strings

ListBox, xrefs: 00BA8FD1
ComboBox, xrefs: 00BA8F9C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 9368534811273819b0ca38611a47153d20929dbdcb8fb585bb8d5c950b194e6a
Instruction ID: 74143a514924df24d5b739906977eca92bd739069cda8c36cac6b25accbe0439
Opcode Fuzzy Hash: 9368534811273819b0ca38611a47153d20929dbdcb8fb585bb8d5c950b194e6a
Instruction Fuzzy Hash: E9210870A04105BFDF15ABA0CC95EFEB7B4EF49310F0041A6B912972F1DF359818DA20

Function 00BA907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00BAAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00BAAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00BA90FD
GetDlgCtrlID.USER32 ref: 00BA9108
GetParent.USER32 ref: 00BA9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00BA9127
GetDlgCtrlID.USER32(?), ref: 00BA9130
GetParent.USER32(?), ref: 00BA914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 00BA914F

Strings

ListBox, xrefs: 00BA90BC
ComboBox, xrefs: 00BA9087

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 58c38e3b94a2c566ea4e6c94c77fc72febcd95f984abba9b267ab774380d47e0
Instruction ID: d1240ed463ae7a76c0257a659d7c53319cc12bdd524e845f26391371c5fbffc7
Opcode Fuzzy Hash: 58c38e3b94a2c566ea4e6c94c77fc72febcd95f984abba9b267ab774380d47e0
Instruction Fuzzy Hash: 1E21F574A04109BBDF15ABA0CC95EFEBBF4EF49300F0041A6B911A72E1EB759819DB20

Function 00BA9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00BA916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00BA9184
_wcscmp.LIBCMT ref: 00BA9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00BA9211

Strings

SHELLDLL_DefView, xrefs: 00BA9190
details, xrefs: 00BA91BF
largeicons, xrefs: 00BA91A5
smallicons, xrefs: 00BA91D9
list, xrefs: 00BA91F3

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 5e23098a190ade5b5651a4b969f08a5c6dda5fdf708aeb65aaba0ee57ab45e73
Instruction ID: b8e42bb1a85ca20b1b51664281d1897e1ded1e9cbe8bdc0f1732197871014d32
Opcode Fuzzy Hash: 5e23098a190ade5b5651a4b969f08a5c6dda5fdf708aeb65aaba0ee57ab45e73
Instruction Fuzzy Hash: 8111593664C307BAFA182624EC0BEB777DCDB12720B2001A7F914E14D1FE616C51A990

Function 00BC88AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BC88D7
CoInitialize.OLE32(00000000), ref: 00BC8904
CoUninitialize.COMBASE ref: 00BC890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00BC8A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00BC8B3B
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002,?,00000001,00BE2C0C), ref: 00BC8B6F
CoGetObject.OLE32(?,00000000,00BE2C0C,?), ref: 00BC8B92
SetErrorMode.KERNEL32(00000000), ref: 00BC8BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00BC8C25
VariantClear.OLEAUT32(?), ref: 00BC8C35

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: ccc1c9b85c7ea48ccbf364a58e3c086966ad9de36a241899a4d8d72e4f54b989
Instruction ID: 0c9f5600a5026fb0333dcc300edae783c04e64e71ba1fddc3c76e671b864786e
Opcode Fuzzy Hash: ccc1c9b85c7ea48ccbf364a58e3c086966ad9de36a241899a4d8d72e4f54b989
Instruction Fuzzy Hash: 89C1F2B1608305AFD700DF64C884E2AB7E9EF89748F04499DF98A9B261DB71ED05CB52

Function 00BB7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00BB7A6C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 1b28845ebb6005346a347d9440683b472ad38316f2a7969fef85f3f0eb80723c
Instruction ID: 09be4dc35d9350e02e55fd3475957bd547748a19fd82967d936e305294226c9f
Opcode Fuzzy Hash: 1b28845ebb6005346a347d9440683b472ad38316f2a7969fef85f3f0eb80723c
Instruction Fuzzy Hash: 2AB1927194821A9FDB10DFA4C894BFEBBF4EF89321F1044A9E551E7241DBB4E941CB90

Function 00B5FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00B5FAA6
OleUninitialize.OLE32(?,00000000), ref: 00B5FB45
UnregisterHotKey.USER32(?), ref: 00B5FC9C
DestroyWindow.USER32(?), ref: 00B945D6
FreeLibrary.KERNEL32(?), ref: 00B9463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B94668

Strings

close all, xrefs: 00B5FAA1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: cf8ca4653f1826595dec74ed47651c17e4a4e4597592fa5dce12d522677f2966
Instruction ID: c7d8b311f7cfc0b7370d8016466974a411a450a9a78f152c33658022478b1595
Opcode Fuzzy Hash: cf8ca4653f1826595dec74ed47651c17e4a4e4597592fa5dce12d522677f2966
Instruction Fuzzy Hash: BDA11370602212CFCB29EB14C9A5B79F7E4EF05711F5542F9E90AAB261DB30AD1ACF50

Function 00BAA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00BAA439), ref: 00BAA377

Strings

NAME, xrefs: 00BAA1A9
REGEXPCLASS, xrefs: 00BAA13C
INSTANCE, xrefs: 00BAA285
CLASS, xrefs: 00BAA0F6
CLASSNN, xrefs: 00BAA119
TEXT, xrefs: 00BAA2AE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: dd94dac71769379cfa4e857308ec0b53b3873cf81b8797985b5142ae334c4b87
Instruction ID: 704a870bc162f1a3e23f78378d77a0c281f4499fb4bf00646a45721f7e5dcbb5
Opcode Fuzzy Hash: dd94dac71769379cfa4e857308ec0b53b3873cf81b8797985b5142ae334c4b87
Instruction Fuzzy Hash: CE91A470A08605EACF18EFA0C482BEDFBE4FF16300F548199D859A7191DF316999DBB1

Function 00B52E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00B52EAE

Part of subcall function 00B51DB3: GetClientRect.USER32(?,?), ref: 00B51DDC
Part of subcall function 00B51DB3: GetWindowRect.USER32(?,?), ref: 00B51E1D
Part of subcall function 00B51DB3: ScreenToClient.USER32(?,?), ref: 00B51E45

GetDC.USER32 ref: 00B8CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B8CD45
SelectObject.GDI32(00000000,00000000), ref: 00B8CD53
SelectObject.GDI32(00000000,00000000), ref: 00B8CD68
ReleaseDC.USER32(?,00000000), ref: 00B8CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00B8CDFB

Strings

U, xrefs: 00B8CCD0

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 4b8a44da3c9e822ba841305f800ae0a05e554599fc9d81db5412a1362b7f290e
Instruction ID: 2b8883bc735583d9af9a3567b4e49f3482f09d609e2b949d16a0e72916b0bba5
Opcode Fuzzy Hash: 4b8a44da3c9e822ba841305f800ae0a05e554599fc9d81db5412a1362b7f290e
Instruction Fuzzy Hash: 6971BC71800205DFCF21AF64C881AAA7FF5FF49321F1482FAED595A2A6D7309845DFA0

Function 00BC1A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00BC1A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00BC1A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00BC1ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00BC1AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BC1AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00BC1B10
InternetCloseHandle.WININET(00000000), ref: 00BC1B57

Part of subcall function 00BC2483: GetLastError.KERNEL32(?,?,00BC1817,00000000,00000000,00000001), ref: 00BC2498
Part of subcall function 00BC2483: SetEvent.KERNEL32(?,?,00BC1817,00000000,00000000,00000001), ref: 00BC24AD

Strings

, xrefs: 00BC1B01

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: ca5818c1ad9e72adf5af5915f0183d6ead090905b5d78bb96c29904a4344a4f1
Instruction ID: c95d11a47bac214aa49b822c75fd5071b4804a138c6d219a26558d816aebb41f
Opcode Fuzzy Hash: ca5818c1ad9e72adf5af5915f0183d6ead090905b5d78bb96c29904a4344a4f1
Instruction Fuzzy Hash: 7F419FB1501209BFEB119F54CC85FFA7BACEF09350F00816AFA05AA142EB709E409BA0

Function 00BC8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00BDF910), ref: 00BC8D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00BDF910), ref: 00BC8D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00BC8ED6
SysFreeString.OLEAUT32(?), ref: 00BC8F00

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: d1b9f1508401bb9e2732e0bcea904cafa4431250e4c12c3820decdc92a0477a7
Instruction ID: 1b38135954478dfa89f7dbd7b82b263849e5f77edceac3c78668b0f6e9b6f111
Opcode Fuzzy Hash: d1b9f1508401bb9e2732e0bcea904cafa4431250e4c12c3820decdc92a0477a7
Instruction Fuzzy Hash: 3EF12871A00209EFDB14DF94C888EAEB7B9FF45315F10849DF916AB251DB31AE45CBA0

Function 00BCF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BCF6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00BCF848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00BCF86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00BCF8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00BCF8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00BCFA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00BCFA7C
CloseHandle.KERNEL32(?), ref: 00BCFAAB
CloseHandle.KERNEL32(?), ref: 00BCFB22

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: e08e07c4bb168cd0238ae25d58722667eef526224c7ff3e4771c02082de82208
Instruction ID: 5b6a4cd6958ede0fdf0b0847870ab2ea0c6cbd9f7b2918cd2d57d6026b3946ca
Opcode Fuzzy Hash: e08e07c4bb168cd0238ae25d58722667eef526224c7ff3e4771c02082de82208
Instruction Fuzzy Hash: C9E14D31604202DFCB14EF24C891B6ABBE1EF85354F1485EEF8999B2A1DB71DC45CB52

Function 00B5201B Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B51B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B52036,?,00000000,?,?,?,?,00B516CB,00000000,?), ref: 00B51B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00B520D3
KillTimer.USER32(-00000001,?,?,?,?,00B516CB,00000000,?,?,00B51AE2,?,?), ref: 00B5216E
DestroyAcceleratorTable.USER32(00000000), ref: 00B8BCA6
DeleteObject.GDI32(00000000), ref: 00B8BD1C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: 39b6ccda31976c0c26f861f6ea670dbdb7efd4f067134ee3a7b4d441a27eb0f2
Instruction ID: 3edb541e005aa92e5da77c03454b8b466efe1eb6407db80d947d56b7774dda68
Opcode Fuzzy Hash: 39b6ccda31976c0c26f861f6ea670dbdb7efd4f067134ee3a7b4d441a27eb0f2
Instruction Fuzzy Hash: 3161A131502A01DFDB35AF24D999B6AB7F1FF82312F1484E9E94257AB0C770A885DF90

Function 00BB4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00BB3697,?), ref: 00BB468B

Part of subcall function 00BB466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00BB3697,?), ref: 00BB46A4

Part of subcall function 00BB4A31: GetFileAttributesW.KERNEL32(?,00BB370B), ref: 00BB4A32

lstrcmpiW.KERNEL32(?,?), ref: 00BB4D40
_wcscmp.LIBCMT ref: 00BB4D5A
MoveFileW.KERNEL32(?,?), ref: 00BB4D75

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 1edf9fd5968a0c5237b56867dfe05070181edac848808b53f2913aa723191f2f
Instruction ID: 5eacda1c68ede34dcaa6b873b1120073071bd8e07c42d6fde1bad25a9b5b1fdf
Opcode Fuzzy Hash: 1edf9fd5968a0c5237b56867dfe05070181edac848808b53f2913aa723191f2f
Instruction Fuzzy Hash: 325174B20083459BC725DB64D8919EFB3ECEF84351F00496EF589D3152EF74A688C766

Function 00BD8645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00BD86FF

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 69302bfe74497a38ae4514597ceb17100955876a721836f9110ff0df9f6c41b7
Instruction ID: 2268fe482964e829e3e0c9f6799d721db4822c5dbeb53d16097b3e8fb9a84706
Opcode Fuzzy Hash: 69302bfe74497a38ae4514597ceb17100955876a721836f9110ff0df9f6c41b7
Instruction Fuzzy Hash: DF518130501205BEEB209B28CC85FADBBE5EB06722F6041D3F915D63A1EF72E980DB41

Function 00B52B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00B8C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B8C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00B8C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00B8C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00B8C370
DestroyCursor.USER32(00000000), ref: 00B8C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B8C39C
DestroyCursor.USER32(?), ref: 00B8C3AB

Part of subcall function 00BDA4AF: DeleteObject.GDI32(00000000), ref: 00BDA4E8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2975913752-0
Opcode ID: 38093b45580305cbb1e887f775b2f09051f9230f9f2b705de58e8864c6948e70
Instruction ID: cc4ff804aa6763a11e5df7d8bfa93db8d13afac251427719a3d6e61d1ef52248
Opcode Fuzzy Hash: 38093b45580305cbb1e887f775b2f09051f9230f9f2b705de58e8864c6948e70
Instruction Fuzzy Hash: 98516970A01205EFDB24DF24CC85BAA7BE5FB49311F1085A9F902972E0DB70ED95DB60

Function 00BA966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BAA84C
Part of subcall function 00BAA82C: GetCurrentThreadId.KERNEL32 ref: 00BAA853
Part of subcall function 00BAA82C: AttachThreadInput.USER32(00000000,?,00BA9683,?,00000001), ref: 00BAA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 00BA968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00BA96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00BA96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 00BA96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00BA96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00BA96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 00BA96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00BA96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00BA96FB

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 0f3dca4c9efcd398462dfdf0f92ae47303a167d4061e4de699fe726b1604e95d
Instruction ID: fd71f6d52f6208bcee904fc237b9b63ec752c25990fb40a936cda6da0804f4d2
Opcode Fuzzy Hash: 0f3dca4c9efcd398462dfdf0f92ae47303a167d4061e4de699fe726b1604e95d
Instruction Fuzzy Hash: 5011CEB1914219BEFA106B649C89F7ABB6DEB4D750F100426F355AB0A0DEF25C10DAA4

Function 00BA8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00BA853C,00000B00,?,?), ref: 00BA892A
RtlAllocateHeap.NTDLL(00000000,?,00BA853C), ref: 00BA8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00BA853C,00000B00,?,?), ref: 00BA8946
GetCurrentProcess.KERNEL32(?,00000000,?,00BA853C,00000B00,?,?), ref: 00BA894E
DuplicateHandle.KERNEL32(00000000,?,00BA853C,00000B00,?,?), ref: 00BA8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00BA853C,00000B00,?,?), ref: 00BA8961
GetCurrentProcess.KERNEL32(00BA853C,00000000,?,00BA853C,00000B00,?,?), ref: 00BA8969
DuplicateHandle.KERNEL32(00000000,?,00BA853C,00000B00,?,?), ref: 00BA896C
CreateThread.KERNEL32(00000000,00000000,00BA8992,00000000,00000000,00000000), ref: 00BA8986

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
String ID:
API String ID: 1422014791-0
Opcode ID: bbc97939b5e4787b1da0ab862a3f040179c28691913f54e28760f869849a6b93
Instruction ID: 9150b2fd776df510984915bac86dc0567d8fd0f3419fbd26a06be974fae8e102
Opcode Fuzzy Hash: bbc97939b5e4787b1da0ab862a3f040179c28691913f54e28760f869849a6b93
Instruction Fuzzy Hash: 8B01BBB5245309FFEB10ABA5DC4DF6B7BACEB89711F408421FA05DB1A1DA709800CB60

Function 00BC9B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00BC9B7B
NULL Pointer assignment, xrefs: 00BC9BA4, 00BC9EC8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 2fc9872176be775d68d4b441feb8247e4f32cf6c65a44cddf5559ba9bebcc7ce
Instruction ID: ac06626bac59ef6d4b5d4bff63ed29e1398026c5cd538995db3b908c8602549c
Opcode Fuzzy Hash: 2fc9872176be775d68d4b441feb8247e4f32cf6c65a44cddf5559ba9bebcc7ce
Instruction Fuzzy Hash: F9C18371A0021AABEF10DF98D888FAEB7F5FB58314F1584ADE915A7280E770DD45CB90

Function 00BC9113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC9167
VariantInit.OLEAUT32(?), ref: 00BC9238
VariantInit.OLEAUT32(?), ref: 00BC9339
VariantClear.OLEAUT32(?), ref: 00BC9343
VariantClear.OLEAUT32(?), ref: 00BC93A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00BC931C
Null Object assignment in FOR..IN loop, xrefs: 00BC91C8, 00BC92F6, 00BC93AE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 74e27b150f7c088c7a490cab3ee64613456daf05293e3043ce0aaa4135755383
Instruction ID: b02c120ad03f297e1af7d3279ccfe29ae0900379f005dea4c28cfb3b233f5ab6
Opcode Fuzzy Hash: 74e27b150f7c088c7a490cab3ee64613456daf05293e3043ce0aaa4135755383
Instruction Fuzzy Hash: EA915E71A00219EBEF24DFA5C888FAEB7F8EF85710F10859DF515AB280D7709945CBA4

Function 00BC975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00BA710A: CLSIDFromProgID.COMBASE ref: 00BA7127
Part of subcall function 00BA710A: ProgIDFromCLSID.COMBASE(?,00000000), ref: 00BA7142
Part of subcall function 00BA710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BA7044,80070057,?,?), ref: 00BA7150
Part of subcall function 00BA710A: CoTaskMemFree.COMBASE(00000000), ref: 00BA7160

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00BC9806
_memset.LIBCMT ref: 00BC9813
_memset.LIBCMT ref: 00BC9956
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000000), ref: 00BC9982
CoTaskMemFree.COMBASE(?), ref: 00BC998D

Strings

NULL Pointer assignment, xrefs: 00BC99DB

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: a062cfbf9b24e98e2efb0d357dabc7bc96511ab412fc473348b4146cbaa9e823
Instruction ID: e220e46b6ca720f2399616ba46ca968407f4e3c98e6427bbd3bb53a240d3846d
Opcode Fuzzy Hash: a062cfbf9b24e98e2efb0d357dabc7bc96511ab412fc473348b4146cbaa9e823
Instruction Fuzzy Hash: 93911771D00229EBDB10DFA5DC85EDEBBB9EF09350F20419AF419A7291DB719A44CFA0

Function 00BD6D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00BD6E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00BD6E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00BD6E52
_wcscat.LIBCMT ref: 00BD6EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00BD6EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00BD6EF2

Strings

SysListView32, xrefs: 00BD6DF6

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: cb4bbc19a8e63b6e992eae49b9111cdc8440aa379bd2c5f9a200c4fc2d2b7b5c
Instruction ID: 54435105c8d705264a2a95915483222ea2d25cffa07e8da99b247ccd58f8900e
Opcode Fuzzy Hash: cb4bbc19a8e63b6e992eae49b9111cdc8440aa379bd2c5f9a200c4fc2d2b7b5c
Instruction Fuzzy Hash: 61419171A00349ABEB21DF64CC85BEEB7E9EF08350F1044AAF585E72D1E6719D84CB60

Function 00BCE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00BB3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00BB3C7A
Part of subcall function 00BB3C55: Process32FirstW.KERNEL32(00000000,?), ref: 00BB3C88
Part of subcall function 00BB3C55: CloseHandle.KERNEL32(00000000), ref: 00BB3D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BCE9A4
GetLastError.KERNEL32 ref: 00BCE9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BCE9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 00BCEA63
GetLastError.KERNEL32(00000000), ref: 00BCEA6E
CloseHandle.KERNEL32(00000000), ref: 00BCEAA3

Strings

SeDebugPrivilege, xrefs: 00BCE9C2

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ad5fd41ceb5a81f72ffd472ad1f3be7f760b4862ed6feed055bc34268219fc21
Instruction ID: 2c52e6d997bf8662f19e17aa5353e2a21a35734eef7b36b86a60e74455294348
Opcode Fuzzy Hash: ad5fd41ceb5a81f72ffd472ad1f3be7f760b4862ed6feed055bc34268219fc21
Instruction Fuzzy Hash: B44176716042019FDB14EF24C8A5F6ABBE5AF41310F0884A9F9169B2D2DBB5E908CF95

Function 00BB2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00BB3033

Strings

blank, xrefs: 00BB2FB5
info, xrefs: 00BB2FD4
warning, xrefs: 00BB301C
stop, xrefs: 00BB3004
question, xrefs: 00BB2FEC

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: eb63b832bf55f156e2493d9bad6061e106f14535279d4e1329078d0dc91556ee
Instruction ID: 279671bcd3049b663961749dc22a7862fc5ed97b8ff513e96bda0c3e07e1bf67
Opcode Fuzzy Hash: eb63b832bf55f156e2493d9bad6061e106f14535279d4e1329078d0dc91556ee
Instruction Fuzzy Hash: 9711053124C386BFE714AB14DC82EFB67DCDF19760B6080AAF904A61C1EAE06F4456A4

Function 00BB42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00BB4312
LoadStringW.USER32(00000000), ref: 00BB4319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00BB432F
LoadStringW.USER32(00000000), ref: 00BB4336
_wprintf.LIBCMT ref: 00BB435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00BB437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00BB4357

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 3a1ccdc2e7fb3b5d32026e597e78ee804d3e264cd3244780e599d53550b35dda
Instruction ID: 20859626d56e952e0f7fbd7b6383b2f0537a4cb310b7a21ea06ab51e6c0d136f
Opcode Fuzzy Hash: 3a1ccdc2e7fb3b5d32026e597e78ee804d3e264cd3244780e599d53550b35dda
Instruction Fuzzy Hash: 3A0162F2905209BFE71197A4DD89EF6B7ACEB08700F0045B2B74AE3051FA749E858B74

Function 00B52A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00B8C1C7,00000004,00000000,00000000,00000000), ref: 00B52ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00B8C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00B52B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00B8C1C7,00000004,00000000,00000000,00000000), ref: 00B8C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00B8C1C7,00000004,00000000,00000000,00000000), ref: 00B8C286

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 0f7febb737811cfc351f27f8d2c7ef838b86785a774296f0308e27d689f3b71c
Instruction ID: de069cde4ea2fa0b9d9a658cdb92d8343ab329911117e22a3638f6d3a93df752
Opcode Fuzzy Hash: 0f7febb737811cfc351f27f8d2c7ef838b86785a774296f0308e27d689f3b71c
Instruction Fuzzy Hash: DD41DB7160AA80DAD7399F28CCD8B7A7FD2EB8B311F1484D9E847475B1C671984DD720

Function 00BB70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00BB70DD

Part of subcall function 00B70DB6: std::exception::exception.LIBCMT ref: 00B70DEC
Part of subcall function 00B70DB6: __CxxThrowException@8.LIBCMT ref: 00B70E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00BB7114
RtlEnterCriticalSection.NTDLL(?), ref: 00BB7130
_memmove.LIBCMT ref: 00BB717E
_memmove.LIBCMT ref: 00BB719B
RtlLeaveCriticalSection.NTDLL(?), ref: 00BB71AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00BB71BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 00BB71DE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 5ec9a9c7ada74b4f6dc09e5f4215797e4919fc08cbaaeeaeeed45f7f800d37c0
Instruction ID: 8e6dc94807faaa4660b303ef2cf182f9d24d7464a7e41fe4f9779cac4e0941c8
Opcode Fuzzy Hash: 5ec9a9c7ada74b4f6dc09e5f4215797e4919fc08cbaaeeaeeed45f7f800d37c0
Instruction Fuzzy Hash: C2316F31904205EBCF10EFA4DC85AAFB7B8EF45710F1481B6F904AB256EB709E10CBA0

Function 00BD61D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00BD61EB
GetDC.USER32(00000000), ref: 00BD61F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BD61FE
ReleaseDC.USER32(00000000,00000000), ref: 00BD620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00BD6246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00BD6257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00BD902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00BD6291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00BD62B1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 5a63fc2033b27f4c374de811e75b9f3f1545a6a95e47f1fbe4d2f5725050be3e
Instruction ID: 58320627a38f12c6b31a765718c09a6c68eb357c8a950cf35cfc0ee56b52f80b
Opcode Fuzzy Hash: 5a63fc2033b27f4c374de811e75b9f3f1545a6a95e47f1fbe4d2f5725050be3e
Instruction Fuzzy Hash: D5319F72101214BFEB108F10CC8AFFA7BA9EF49761F044066FE099B291EA759C41CB60

Function 00BABBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00BABBC4
_memcmp.LIBCMT ref: 00BABBE6
_memcmp.LIBCMT ref: 00BABBFE
_memcmp.LIBCMT ref: 00BABC11
_memcmp.LIBCMT ref: 00BABC2B
_memcmp.LIBCMT ref: 00BABC3E
_memcmp.LIBCMT ref: 00BABC56
_memcmp.LIBCMT ref: 00BABC71

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b036e3cbf9fc5c00411bc4e1491a8b980a2c1ce9b9d79ca864571c81e3eb486b
Instruction ID: b65070f8860553911351b269b4db5a90976c6b27e3f48c14b463a08817441a34
Opcode Fuzzy Hash: b036e3cbf9fc5c00411bc4e1491a8b980a2c1ce9b9d79ca864571c81e3eb486b
Instruction Fuzzy Hash: 0C21D4716092057BA304672A9D82FBF73DDEE12358F0884E0FD28A6783FB24DE1185B1

Function 00B51424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e604f0e3fd85da4e6adbfd466010a07f93b6798e7be2d3f8387d6bed3311909
Instruction ID: 31349031bf218e576fdf863db0cd4d532f5827a5a06894e70f0980a4d669c65d
Opcode Fuzzy Hash: 2e604f0e3fd85da4e6adbfd466010a07f93b6798e7be2d3f8387d6bed3311909
Instruction Fuzzy Hash: 4A716734901109EFCB049F98CC89FBEBBB9FF85311F148599E916AB251D730AA15CFA4

Function 00BDB351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00F921C0), ref: 00BDB3EB
IsWindowEnabled.USER32(00F921C0), ref: 00BDB3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00BDB4DB
SendMessageW.USER32(00F921C0,000000B0,?,?), ref: 00BDB512
IsDlgButtonChecked.USER32(?,?), ref: 00BDB54F
GetWindowLongW.USER32(00F921C0,000000EC), ref: 00BDB571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00BDB589

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 6d5a0d81774d741a465316b5c8d49f10df51f5a72bdade9f56227a57bcf04638
Instruction ID: c6be3d1cce2d41069dcd5b7f4d45ac0a43607b947e9b5e9c17488becd6f784f7
Opcode Fuzzy Hash: 6d5a0d81774d741a465316b5c8d49f10df51f5a72bdade9f56227a57bcf04638
Instruction Fuzzy Hash: 3271AB34605204EFDB21DF54C8A0FBAFBE9EF4A310F15809AE946973A2E731A940DB54

Function 00BCF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BCF448
_memset.LIBCMT ref: 00BCF511
ShellExecuteExW.SHELL32(?), ref: 00BCF556

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

Part of subcall function 00B6FC86: _wcscpy.LIBCMT ref: 00B6FCA9

GetProcessId.KERNEL32(00000000), ref: 00BCF5CD
CloseHandle.KERNEL32(00000000), ref: 00BCF5FC

Strings

@, xrefs: 00BCF525

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 9fd82213bc7993b3e2c8526c6120d52c30a18e8228f499a6417c97d51cd609f6
Instruction ID: c0b4cffb1eb7b2d52941c3b529eb73159014e9ac9d2a368a7d9f24cf754d9e2c
Opcode Fuzzy Hash: 9fd82213bc7993b3e2c8526c6120d52c30a18e8228f499a6417c97d51cd609f6
Instruction Fuzzy Hash: 91614D75A0061ADFCB14EF64C891AAEBBF5FF49310F1480E9E859AB351CB30AD45CB94

Function 00BB0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00BB0F8C
GetKeyboardState.USER32(?), ref: 00BB0FA1
SetKeyboardState.USER32(?), ref: 00BB1002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00BB1030
PostMessageW.USER32(?,00000101,00000011,?), ref: 00BB104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00BB1095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00BB10B8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2e2ba70bf6ddba93b79906c9fe52a5f8a27e4d9b7ebf2fa3b0d30386695719db
Instruction ID: be495988ebda31f124995857444d65172b9dcf9e0d419ded5810f03ca79939b9
Opcode Fuzzy Hash: 2e2ba70bf6ddba93b79906c9fe52a5f8a27e4d9b7ebf2fa3b0d30386695719db
Instruction Fuzzy Hash: B351F1606186D53FFB3652388C25BFABEE9DB06304F4889C9E1D5968C2C2D8DCC4D751

Function 00BB0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00BB0DA5
GetKeyboardState.USER32(?), ref: 00BB0DBA
SetKeyboardState.USER32(?), ref: 00BB0E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00BB0E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00BB0E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00BB0EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00BB0EC9

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: fb9cb1994bc50dd47b6bd15be8a30795ccc14f8920695abe7cd36b9caa30fac9
Instruction ID: b9f968ba8fdb896456753bb4bb81b65a448379ac7cad453febe58552f62e2b36
Opcode Fuzzy Hash: fb9cb1994bc50dd47b6bd15be8a30795ccc14f8920695abe7cd36b9caa30fac9
Instruction Fuzzy Hash: 8B51E3A09286D63EFB3266648855BFBBEE99B06300F0888C9E1D5468C2D3D5EC94D750

Function 00BB55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00BB560A
_wcsncpy.LIBCMT ref: 00BB563F
_wcsncpy.LIBCMT ref: 00BB5671
_wcsncpy.LIBCMT ref: 00BB56A4
_wcsncpy.LIBCMT ref: 00BB56E6
_wcsncpy.LIBCMT ref: 00BB5720
_wcsncpy.LIBCMT ref: 00BB574F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6e012f3b3e8b819db34ca5e173bdae881f7be7f56a0ed907bfb84cbbdd0e9ed1
Instruction ID: 325e347a746706c763f58740923263ac5d26590f6f523c0e286005c31e4c1110
Opcode Fuzzy Hash: 6e012f3b3e8b819db34ca5e173bdae881f7be7f56a0ed907bfb84cbbdd0e9ed1
Instruction Fuzzy Hash: 19419365C1061476CB11EBB48C86ADFB3FC9F04310F50C9A6E52DE3221FB74A655C7AA

Function 00B52344 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B52357
ScreenToClient.USER32(00C157B0,?), ref: 00B52374
GetAsyncKeyState.USER32(00000001), ref: 00B52399
GetAsyncKeyState.USER32(00000002), ref: 00B523A7

Strings

dowp0dowp4dowp2dowp4dowp0dowp5dowpcdowpbdowp2dowpbdowp6dowp5dowpfdowpcdowpfdowpfdowp7dowp5dowpddowp8dowp5dowp9dowpfdowpfdowp7dowp5, xrefs: 00B8BFF9

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID: dowp0dowp4dowp2dowp4dowp0dowp5dowpcdowpbdowp2dowpbdowp6dowp5dowpfdowpcdowpfdowpfdowp7dowp5dowpddowp8dowp5dowp9dowpfdowpfdowp7dowp5
API String ID: 4210589936-3861665079
Opcode ID: df8276897e8c58b3ddee55f37eafa6adeebec124cb3564a150cce2b8c4987032
Instruction ID: 34de76a36a9653a3d1949844d0818f7a3f38d73ac9e56505eaf24f78a4df0ab7
Opcode Fuzzy Hash: df8276897e8c58b3ddee55f37eafa6adeebec124cb3564a150cce2b8c4987032
Instruction Fuzzy Hash: 68419075608105FFCF159F68C884BE9FBB4FB05360F20439AF829A22A0CB309954DFA0

Function 00BB3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00BB3697,?), ref: 00BB468B

Part of subcall function 00BB466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00BB3697,?), ref: 00BB46A4

lstrcmpiW.KERNEL32(?,?), ref: 00BB36B7
_wcscmp.LIBCMT ref: 00BB36D3
MoveFileW.KERNEL32(?,?), ref: 00BB36EB
_wcscat.LIBCMT ref: 00BB3733
SHFileOperationW.SHELL32(?), ref: 00BB379F

Strings

\*.*, xrefs: 00BB372D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: cb55970d3392d51311f00d91df5b89731fe2e93cd7724862ac3585ac5dc65fc9
Instruction ID: 81bbbd0a6ab3e973f586ad8948192c6ea9a804f7b25b267e07f56bb40caa97c5
Opcode Fuzzy Hash: cb55970d3392d51311f00d91df5b89731fe2e93cd7724862ac3585ac5dc65fc9
Instruction Fuzzy Hash: 31416E7150C344ABC751EF64C451AEFB7E8EF89780F0008AEB49AC3251EB75D689C752

Function 00BD7291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BD72AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BD7351
IsMenu.USER32(?), ref: 00BD7369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00BD73B1
DrawMenuBar.USER32 ref: 00BD73C4

Strings

0, xrefs: 00BD729E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: e15077e76c61787ddd98631213bf8b3e91db14375f50b1894df39eba58814e4c
Instruction ID: 7c8740a8079c0afba7cdc8abd8af2ef53c24e2cccb79cfbf200087ae21b52cc9
Opcode Fuzzy Hash: e15077e76c61787ddd98631213bf8b3e91db14375f50b1894df39eba58814e4c
Instruction Fuzzy Hash: CE414675A44209EFDB20DF50D884AEABBF8FB05324F1480AAFD0597350EB30AD41DB50

Function 00BD0FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00BD0FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BD0FFE
FreeLibrary.KERNEL32(00000000), ref: 00BD10B5

Part of subcall function 00BD0FA5: RegCloseKey.ADVAPI32(?), ref: 00BD101B
Part of subcall function 00BD0FA5: FreeLibrary.KERNEL32(?), ref: 00BD106D
Part of subcall function 00BD0FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00BD1090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00BD1058

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: a4e53ee8ec877378ebe64fee81d9d7dff4e8f1dac65b85f784e673ad0c1f2f11
Instruction ID: 57899ea33dcd88a3855f36bc5d09bc71557dd39f7aee35602385e4960ec6be23
Opcode Fuzzy Hash: a4e53ee8ec877378ebe64fee81d9d7dff4e8f1dac65b85f784e673ad0c1f2f11
Instruction Fuzzy Hash: E9311B71901109BFDB15AF94DC99AFFF7BCEF08300F1045AAE512E3241EA749E859BA0

Function 00BD62CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00BD62EC
GetWindowLongW.USER32(00F921C0,000000F0), ref: 00BD631F
GetWindowLongW.USER32(00F921C0,000000F0), ref: 00BD6354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00BD6386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00BD63B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00BD63C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00BD63DB

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 0cdbf995a83d0dbeda71f1ff3199adf1fb59c220f91831d258889ff3688430f2
Instruction ID: 2eb160856e515153fbe271aa3c3fae70c8737c8d3fa0e78928fa5001d6f6265d
Opcode Fuzzy Hash: 0cdbf995a83d0dbeda71f1ff3199adf1fb59c220f91831d258889ff3688430f2
Instruction Fuzzy Hash: B231F030644251EFEB20CF5CDC84F68BBE1FB5A724F1941A6F5018B2B2EB71A840DB54

Function 00BADAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BADB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BADB54
SysAllocString.OLEAUT32(00000000), ref: 00BADB57
SysAllocString.OLEAUT32(?), ref: 00BADB75
SysFreeString.OLEAUT32(?), ref: 00BADB7E
StringFromGUID2.COMBASE(?,?,00000028), ref: 00BADBA3
SysAllocString.OLEAUT32(?), ref: 00BADBB1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 3a3fcdcca4b9d6747d73b40d712284443ec5d67b12719a1ea104480bd77b4f63
Instruction ID: 9ef745d3364a93069a6f7367d29df0f00425115586eb5aae76e6c701b5c9b178
Opcode Fuzzy Hash: 3a3fcdcca4b9d6747d73b40d712284443ec5d67b12719a1ea104480bd77b4f63
Instruction Fuzzy Hash: 6B21A736609219AFDF10DFA8DC84CBB77ECEB09360B458566F916DB250EA70DC418BB0

Function 00BC6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC7D8B: inet_addr.WS2_32(00000000), ref: 00BC7DB6

socket.WS2_32(00000002,00000001,00000006), ref: 00BC61C6
WSAGetLastError.WS2_32(00000000), ref: 00BC61D5
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00BC620E
connect.WSOCK32(00000000,?,00000010), ref: 00BC6217
WSAGetLastError.WS2_32 ref: 00BC6221
closesocket.WS2_32(00000000), ref: 00BC624A
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00BC6263

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: b6046678d95fe47423da856f5048d5e351418960eb22b56a3553c7238ce26669
Instruction ID: b4228cd161dbc4249e94f19292177a9e210a6ae10d61459673ae8db7f28addeb
Opcode Fuzzy Hash: b6046678d95fe47423da856f5048d5e351418960eb22b56a3553c7238ce26669
Instruction Fuzzy Hash: 00317071604118ABDF10AF64CC85FBAB7E9EF45751F0440ADFD06AB291DB70AD049AA1

Function 00BAF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00BAF671
__wcsnicmp.LIBCMT ref: 00BAF692
__wcsnicmp.LIBCMT ref: 00BAF6AC

Strings

#requireadmin, xrefs: 00BAF68C
#OnAutoItStartRegister, xrefs: 00BAF6A6
#notrayicon, xrefs: 00BAF669

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 93a8e02b5dfad1db4ba92ee5a87ad6bc7bce6b856298de58573c80957e6d04d6
Instruction ID: 2a78f73e9c63b105f414ea306bb2a712d365d4ec06a9ad1e21b68433ab9669e0
Opcode Fuzzy Hash: 93a8e02b5dfad1db4ba92ee5a87ad6bc7bce6b856298de58573c80957e6d04d6
Instruction Fuzzy Hash: CE2134722086127AD220AB78AC02EF773DCEF5A740F1484BAF85A860A1EB509D81D395

Function 00BADBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BADC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BADC2F
SysAllocString.OLEAUT32(00000000), ref: 00BADC32
SysAllocString.OLEAUT32 ref: 00BADC53
SysFreeString.OLEAUT32 ref: 00BADC5C
StringFromGUID2.COMBASE(?,?,00000028), ref: 00BADC76
SysAllocString.OLEAUT32(?), ref: 00BADC84

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 1c27dc3676424c69a87a67642d1eb7c59609a57eb2a734492cd17bfdcc87b411
Instruction ID: bab932414a9f8dbb026fa119a0ac5cf441280d4a6e889c584923d8636a01a1e2
Opcode Fuzzy Hash: 1c27dc3676424c69a87a67642d1eb7c59609a57eb2a734492cd17bfdcc87b411
Instruction Fuzzy Hash: D1217935609105BF9B10DFA8DC88DBB77ECEB093607508166F916CB660EA70DC41CB64

Function 00BD75CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B51D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B51D73
Part of subcall function 00B51D35: GetStockObject.GDI32(00000011), ref: 00B51D87
Part of subcall function 00B51D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B51D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00BD7632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00BD763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00BD764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00BD7659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00BD7665

Strings

Msctls_Progress32, xrefs: 00BD7603

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 01bee5a52cc59dacc1c45217c30d40014079b9ecc12cd37c507ff5100f9cb156
Instruction ID: 2d32113ed6addb12c686b7694d425f546c0dc11412e87eeaac5f96aa251d762b
Opcode Fuzzy Hash: 01bee5a52cc59dacc1c45217c30d40014079b9ecc12cd37c507ff5100f9cb156
Instruction Fuzzy Hash: 6E11B6B1150119BFEF158F64CC85EE7BF6DEF08798F014115BA04A21A0EB72DC21DBA4

Function 00B79AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00B79AE6

Part of subcall function 00B73187: RtlEncodePointer.NTDLL(00000000), ref: 00B7318A
Part of subcall function 00B73187: __initp_misc_winsig.LIBCMT ref: 00B731A5
Part of subcall function 00B73187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00B79EA0
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00B79EB4
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00B79EC7
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00B79EDA
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00B79EED
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00B79F00
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00B79F13
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00B79F26
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00B79F39
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00B79F4C
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00B79F5F
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00B79F72
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00B79F85
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00B79F98
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00B79FAB
Part of subcall function 00B73187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00B79FBE

__mtinitlocks.LIBCMT ref: 00B79AEB
__mtterm.LIBCMT ref: 00B79AF4

Part of subcall function 00B79B5C: RtlDeleteCriticalSection.NTDLL(00000000), ref: 00B79C56
Part of subcall function 00B79B5C: _free.LIBCMT ref: 00B79C5D
Part of subcall function 00B79B5C: RtlDeleteCriticalSection.NTDLL(00C0EC00), ref: 00B79C7F

__calloc_crt.LIBCMT ref: 00B79B19
__initptd.LIBCMT ref: 00B79B3B
GetCurrentThreadId.KERNEL32 ref: 00B79B42

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: fe6b3a0605a95e3c503b06c467115b59ed7865f46a842d7f9f61f738295545c9
Instruction ID: a3d792a3b8cbd202e7dd9321490c9b3a74dea6172018385965d7f73cd02ae927
Opcode Fuzzy Hash: fe6b3a0605a95e3c503b06c467115b59ed7865f46a842d7f9f61f738295545c9
Instruction Fuzzy Hash: C7F0903254A7126AE6347B74BC07B8A27D1DF02730F20CAEAF57CD61D2FF20884141A0

Function 00B7406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00B73F85), ref: 00B74085
GetProcAddress.KERNEL32(00000000), ref: 00B7408C
RtlEncodePointer.NTDLL(00000000), ref: 00B74097
RtlDecodePointer.NTDLL(00B73F85), ref: 00B740B2

Strings

combase.dll, xrefs: 00B74080
RoUninitialize, xrefs: 00B74074

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: c0223a6653b44cd07f40a51653a4fe846a0f4fccdec8b3977a19951b56508483
Instruction ID: 8bd2a7d5c656f4c1964015e0843eded6867060b0f8d315b13a3ae295781b98b4
Opcode Fuzzy Hash: c0223a6653b44cd07f40a51653a4fe846a0f4fccdec8b3977a19951b56508483
Instruction Fuzzy Hash: 65E09A7058A241ABEA119F61EC19B597AE5B705746F208075F112E21E0DFB64604DA14

Function 00BC6B03 Relevance: 9.2, APIs: 6, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32(00000000,?), ref: 00BC6C00
WSAGetLastError.WS2_32(00000000), ref: 00BC6C34
htons.WS2_32(?), ref: 00BC6CEA
inet_ntoa.WS2_32(?), ref: 00BC6CA7

Part of subcall function 00BAA7E9: _strlen.LIBCMT ref: 00BAA7F3
Part of subcall function 00BAA7E9: _memmove.LIBCMT ref: 00BAA815

_strlen.LIBCMT ref: 00BC6D44
_memmove.LIBCMT ref: 00BC6DAD

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 1c14edc99f526f8a03a67dd0f1fcb7054acb750315bde6b03376ad3e48fb12e4
Instruction ID: 433bfdc74c12be102462d37a90cfcad9a6b5e07748f2c6317b605d096bf1c2e6
Opcode Fuzzy Hash: 1c14edc99f526f8a03a67dd0f1fcb7054acb750315bde6b03376ad3e48fb12e4
Instruction Fuzzy Hash: 6181A071208300ABD710EB24CC96F6AB7E8EF84714F1449ADF9569B2E2DB70DD05CB62

Function 00BB64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BB660B
_memmove.LIBCMT ref: 00BB6546

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

_memmove.LIBCMT ref: 00BB65B9
_memmove.LIBCMT ref: 00BB66A0
_memmove.LIBCMT ref: 00BB66B9
_memmove.LIBCMT ref: 00BB66D5

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: e2a829fb8478e28b87f82a18d603bb5082bfab9ba9f422072b5fb86ac937802f
Instruction ID: 03a47184b5b677349ac2893860b8ba8029d34e5e6635e66b296bfce904642b00
Opcode Fuzzy Hash: e2a829fb8478e28b87f82a18d603bb5082bfab9ba9f422072b5fb86ac937802f
Instruction Fuzzy Hash: 1A616A3090065A9BDF11EF64CC82BFE37E5AF05308F0445E9FC5A6B192DA78AD19CB51

Function 00BD01E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00BD0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BCFDAD,?,?), ref: 00BD0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BD02BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BD02FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00BD0320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00BD0349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00BD038C
RegCloseKey.ADVAPI32(00000000), ref: 00BD0399

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: fb65013afe229c407330b7a39b42212039927fd69b5570a292e6092b87b516db
Instruction ID: 858f21f1ad90d822d41cdb45ea28fd9af1bc3b8770543e994d5c15d16c08f31b
Opcode Fuzzy Hash: fb65013afe229c407330b7a39b42212039927fd69b5570a292e6092b87b516db
Instruction Fuzzy Hash: 96516C71218304AFC710EF64D895E6EBBE8FF89314F04499EF855872A1EB31E909CB52

Function 00BD5799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00BD57FB
GetMenuItemCount.USER32(00000000), ref: 00BD5832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00BD585A
GetMenuItemID.USER32(?,?), ref: 00BD58C9
GetSubMenu.USER32(?,?), ref: 00BD58D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00BD5928

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 7f7cc3b23fa69d1d63ff2848f84ea2da718efdd7efbea276a6873dde56b5934a
Instruction ID: 7cce33a29f35f4ff8ec84fe43652345d46e20d68a9371a00950ac53c53fde9a1
Opcode Fuzzy Hash: 7f7cc3b23fa69d1d63ff2848f84ea2da718efdd7efbea276a6873dde56b5934a
Instruction Fuzzy Hash: 00517C31E01A15EFCF10EF64C855AAEB7F4EF48310F1040A6E816AB351DB75AE419B90

Function 00BAEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BAEF06
VariantClear.OLEAUT32(00000013), ref: 00BAEF78
VariantClear.OLEAUT32(00000000), ref: 00BAEFD3
_memmove.LIBCMT ref: 00BAEFFD
VariantClear.OLEAUT32(?), ref: 00BAF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00BAF078

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 11c6a21bff0d86b316f446e421ed542d0ecdec8cadcb875e931a4136a308133e
Instruction ID: 151b5b3d21c36c2ced26e2406ecbed2465667615c015f0d03595d6d50ca0bb78
Opcode Fuzzy Hash: 11c6a21bff0d86b316f446e421ed542d0ecdec8cadcb875e931a4136a308133e
Instruction Fuzzy Hash: 67516D75A0020AEFDB24CF58C890AAAB7F8FF4D314B15856AE959DB301E735E911CF90

Function 00BB220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB2258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BB22A3
IsMenu.USER32(00000000), ref: 00BB22C3
CreatePopupMenu.USER32 ref: 00BB22F7
GetMenuItemCount.USER32(000000FF), ref: 00BB2355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00BB2386

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 642f937eaf146de231839f02788fc9cd2e763ed1a4e9c72e33a26c36b2c0eaba
Instruction ID: d2949a4e5c03a4deef456a96bd5b2231885b887a12d9fd4ad03d315efd809fc0
Opcode Fuzzy Hash: 642f937eaf146de231839f02788fc9cd2e763ed1a4e9c72e33a26c36b2c0eaba
Instruction Fuzzy Hash: 9E51CF30A0120ADFDF21CF68D888BFEBBF5EF45318F1041A9E811972A0D7B48944CB55

Function 00B51765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00B5179A
GetWindowRect.USER32(?,?), ref: 00B517FE
ScreenToClient.USER32(?,?), ref: 00B5181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00B5182C
EndPaint.USER32(?,?), ref: 00B51876

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 9b449d45fa41c0ce08efccdf4a7c26d55db787b5b185721cba39531e1975f957
Instruction ID: 994753b922fc0c7c573be4b91f44f0a20729186e6ce03f2249413325237545f7
Opcode Fuzzy Hash: 9b449d45fa41c0ce08efccdf4a7c26d55db787b5b185721cba39531e1975f957
Instruction Fuzzy Hash: 11419C71504601EFD720DF28CC84FBA7BE8FB4A725F044AA9F9A5872B1D7309849DB61

Function 00BDB69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00C157B0,00000000,00F921C0,?,?,00C157B0,?,00BDB5A8,?,?), ref: 00BDB712
EnableWindow.USER32(00000000,00000000), ref: 00BDB736
ShowWindow.USER32(00C157B0,00000000,00F921C0,?,?,00C157B0,?,00BDB5A8,?,?), ref: 00BDB796
ShowWindow.USER32(00000000,00000004,?,00BDB5A8,?,?), ref: 00BDB7A8
EnableWindow.USER32(00000000,00000001), ref: 00BDB7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00BDB7EF

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 048f46d94350afee4b01a53d37d848d5d5012028064a5b3df595478a03a2a2dd
Instruction ID: 24b4aa5bd017cf438fa5b8801036aff1153e06d18c52c2ce31e9b2ced28d00ce
Opcode Fuzzy Hash: 048f46d94350afee4b01a53d37d848d5d5012028064a5b3df595478a03a2a2dd
Instruction Fuzzy Hash: F9416A34605241EFDB26CF24C499FA4BBE0FB45310F1981EAE9598F7A2DB31AC56CB50

Function 00BC709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00BC4E41,?,?,00000000,00000001), ref: 00BC70AC

Part of subcall function 00BC39A0: GetWindowRect.USER32(?,?), ref: 00BC39B3

GetDesktopWindow.USER32 ref: 00BC70D6
GetWindowRect.USER32(00000000), ref: 00BC70DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00BC710F

Part of subcall function 00BB5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00BB52BC

GetCursorPos.USER32(?), ref: 00BC713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00BC7199

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 82ceb8e8579bbc831f4d01ebc284cd034b60272532362d23219618507de3f6ae
Instruction ID: 14b8dd306c441d4070de01a8206e67ee89597a4700b4b1520d330903d0c6ce9e
Opcode Fuzzy Hash: 82ceb8e8579bbc831f4d01ebc284cd034b60272532362d23219618507de3f6ae
Instruction Fuzzy Hash: F231C472509306ABD720DF14D849FABB7E9FF88314F04095EF585A7191DB70EA09CB92

Function 00BBEB23 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

Part of subcall function 00B6FC86: _wcscpy.LIBCMT ref: 00B6FCA9

_wcstok.LIBCMT ref: 00BBEC94
_wcscpy.LIBCMT ref: 00BBED23
_memset.LIBCMT ref: 00BBED56

Strings

X, xrefs: 00BBED93

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 418e0eb40a6cac5524f8abdf77fb18aab1a83404657d081344a87459ba26ff2a
Instruction ID: 67d0dc75a47dbaf4c1cd542a69943d46c80cbc713d4ee4d5b67083b182488180
Opcode Fuzzy Hash: 418e0eb40a6cac5524f8abdf77fb18aab1a83404657d081344a87459ba26ff2a
Instruction Fuzzy Hash: B4C19271608700DFC764EF24D891AAAB7E0EF45311F0449ADF899972A1DB70EC49CB92

Function 00BA8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00BA80C0
Part of subcall function 00BA80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00BA80CA
Part of subcall function 00BA80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00BA80D9
Part of subcall function 00BA80A9: RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00BA80E0
Part of subcall function 00BA80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00BA80F6

GetLengthSid.ADVAPI32(?,00000000,00BA842F), ref: 00BA88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00BA88D6
RtlAllocateHeap.NTDLL(00000000), ref: 00BA88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 00BA88F6
GetProcessHeap.KERNEL32(00000000,00000000,00BA842F), ref: 00BA890A
HeapFree.KERNEL32(00000000), ref: 00BA8911

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Heap$Process$AllocateInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 169236558-0
Opcode ID: 1f8a43ba19a3bc3c149f74988447ae0e60dc23925732f2c160f6fc74a02a0c86
Instruction ID: 203ebe502f0785d35cdb45d5ffb0c1906cc150bf8c878c3a1b4829b3f3d635b0
Opcode Fuzzy Hash: 1f8a43ba19a3bc3c149f74988447ae0e60dc23925732f2c160f6fc74a02a0c86
Instruction Fuzzy Hash: A511A271506206FFDB109F94DC19BBFB7B8EB46311F148069E846A7110DB369E00DB60

Function 00BAB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BAB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 00BAB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BAB7CD
ReleaseDC.USER32(00000000,00000000), ref: 00BAB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00BAB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 00BAB7FE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 69162850d5efe96e1cc321cc3e7b622cf659ff3e22550330525815040dfbb9cf
Instruction ID: afeb44e84722435d4eb4d0c5ddeaef77f87916c628a9951d075e4f943cea4660
Opcode Fuzzy Hash: 69162850d5efe96e1cc321cc3e7b622cf659ff3e22550330525815040dfbb9cf
Instruction Fuzzy Hash: 84018475E05209BBEB109FA69C45E5EBFB8EB49311F0040B6FA08A7291EA709D00CF90

Function 00B70162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B70193
MapVirtualKeyW.USER32(00000010,00000000), ref: 00B7019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B701A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B701B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00B701B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B701C1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c7bf2a588459a5419f1edeb0cc022c8c56ff51cff8b920a1c612fd41fe1c6a61
Instruction ID: 1804d7f480039527574f53bbc24694e7e5885ed3ba8313c06904336b7b48e158
Opcode Fuzzy Hash: c7bf2a588459a5419f1edeb0cc022c8c56ff51cff8b920a1c612fd41fe1c6a61
Instruction Fuzzy Hash: 65016CB090275A7DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CBE5

Function 00BB53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00BB53F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00BB540F
GetWindowThreadProcessId.USER32(?,?), ref: 00BB541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BB542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BB5437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BB543E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 0c2b8cbc6ba7358daacf6b40115a410e89ed3f21cbb1d3400ba53ea7800920bc
Instruction ID: c07c7708ed7d7451ef13a22d4ac9cad6f1b79ffe28fab458b4f8abfbf48e3292
Opcode Fuzzy Hash: 0c2b8cbc6ba7358daacf6b40115a410e89ed3f21cbb1d3400ba53ea7800920bc
Instruction Fuzzy Hash: 32F06231146159BBD7205B929C1DEFBBB7CEBC6B11F00016AF905D2050AAA05A01C6B5

Function 00BB7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00BB7243
RtlEnterCriticalSection.NTDLL(?), ref: 00BB7254
TerminateThread.KERNEL32(00000000,000001F6,?,00B60EE4,?,?), ref: 00BB7261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00B60EE4,?,?), ref: 00BB726E

Part of subcall function 00BB6C35: CloseHandle.KERNEL32(00000000,?,00BB727B,?,00B60EE4,?,?), ref: 00BB6C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00BB7281
RtlLeaveCriticalSection.NTDLL(?), ref: 00BB7288

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 699d3309991fdd05b713a39ce147e79ef8bfdcdd7f3a6eaca73c677aeb812cc7
Instruction ID: 72c8298a8768d64e399a1792c620931461bc1d53ba075f0919ca95f33c475e43
Opcode Fuzzy Hash: 699d3309991fdd05b713a39ce147e79ef8bfdcdd7f3a6eaca73c677aeb812cc7
Instruction Fuzzy Hash: A1F05E3654A613EBDB112B64ED5CAFAB769EF45702B100572F543A20A0EFB65901CB50

Function 00BC85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BC8613
CharUpperBuffW.USER32(?,?), ref: 00BC8722
VariantClear.OLEAUT32(?), ref: 00BC889A

Part of subcall function 00BB7562: VariantInit.OLEAUT32(00000000), ref: 00BB75A2
Part of subcall function 00BB7562: VariantCopy.OLEAUT32(00000000,?), ref: 00BB75AB
Part of subcall function 00BB7562: VariantClear.OLEAUT32(00000000), ref: 00BB75B7

Strings

Incorrect Parameter format, xrefs: 00BC864B, 00BC880D
AUTOIT.ERROR, xrefs: 00BC8728

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: da3d0d8eec90c04c6524677eff4d0c45f1e1af4397195abe1e232ad0798ca0f6
Instruction ID: 403c6fb07d8c3c190f8e02b73c9679427244cf13de8c9ce76bcc0865db14b3d5
Opcode Fuzzy Hash: da3d0d8eec90c04c6524677eff4d0c45f1e1af4397195abe1e232ad0798ca0f6
Instruction Fuzzy Hash: D0914D75608301DFC710DF24C485E6AB7E4EF89754F1489AEF89A8B361DB31E909CB91

Function 00BB2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6FC86: _wcscpy.LIBCMT ref: 00B6FCA9

_memset.LIBCMT ref: 00BB2B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00BB2BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00BB2C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00BB2C97

Strings

0, xrefs: 00BB2B73

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 308ef93af66dfe93477f28803f9bfbe842c9bd3437900ba4cb8418a2ec72ea1c
Instruction ID: 73612c81f6251382197dc05823bbbc8130b4e4e6190a9e75cd17ffd4c472859b
Opcode Fuzzy Hash: 308ef93af66dfe93477f28803f9bfbe842c9bd3437900ba4cb8418a2ec72ea1c
Instruction Fuzzy Hash: 9C51BF716083019BD7249F28D845ABFBBE8EF99310F044AAEF895D7290DBB0CD44D792

Function 00BAD56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 00BAD5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00BAD60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00BAD61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00BAD69D

Strings

DllGetClassObject, xrefs: 00BAD610

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 36641da74a6549b4a24d665fdbfdcbc80af15184a994c381ee03de441564c012
Instruction ID: 97e2ff5268dd370ef54419e3cbd90e3cced3c6a465b3373172cacce1faca31b1
Opcode Fuzzy Hash: 36641da74a6549b4a24d665fdbfdcbc80af15184a994c381ee03de441564c012
Instruction Fuzzy Hash: FF416CB1604205EFDF05CF68C884AAABBF9EF45310B1581E9AD0A9F615D7B1DE44CBA0

Function 00BB2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB27C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00BB27DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00BB2822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C15890,00000000), ref: 00BB286B

Strings

0, xrefs: 00BB27B5

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: ae99d1a32519b63c7124d9b16e4d80b432748c204f762b2ca2ec75a34f79916b
Instruction ID: 3e4d6623034b5098a32d66aa98a6b5cc475148b2caf3fbda75072e12f2b6dc7b
Opcode Fuzzy Hash: ae99d1a32519b63c7124d9b16e4d80b432748c204f762b2ca2ec75a34f79916b
Instruction Fuzzy Hash: 3841B1702043019FD720DF24DC85BAABBE4EF85314F044AADF866972D1DBB0E905CB52

Function 00BB0AD6 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00BB0B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00BB0B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00BB0BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00BB0BFB

Strings

dowp0dowp4dowp2dowp4dowp0dowp5dowpcdowpbdowp2dowpbdowp6dowp5dowpfdowpcdowpfdowpfdowp7dowp5dowpddowp8dowp5dowp9dowpfdowpfdowp7dowp5, xrefs: 00BB0B5D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID: dowp0dowp4dowp2dowp4dowp0dowp5dowpcdowpbdowp2dowpbdowp6dowp5dowpfdowpcdowpfdowpfdowp7dowp5dowpddowp8dowp5dowp9dowpfdowpfdowp7dowp5
API String ID: 432972143-3861665079
Opcode ID: 0b6350990623ef6f3f2788a1c4a71c1e65f08c0a87c36f5859e2c7909f538a4b
Instruction ID: 48109fb24797549817fd45d59ea7f7cf3139a1f1ee535f7170efba4231213ccd
Opcode Fuzzy Hash: 0b6350990623ef6f3f2788a1c4a71c1e65f08c0a87c36f5859e2c7909f538a4b
Instruction Fuzzy Hash: 98314630D64208AFFB30AB658C05BFFBBE9EB45318F0842DAE491521E1D7F58940D751

Function 00BB0C11 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 00BB0C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00BB0C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00BB0CE1
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 00BB0D33

Strings

dowp0dowp4dowp2dowp4dowp0dowp5dowpcdowpbdowp2dowpbdowp6dowp5dowpfdowpcdowpfdowpfdowp7dowp5dowpddowp8dowp5dowp9dowpfdowpfdowp7dowp5, xrefs: 00BB0C9F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID: dowp0dowp4dowp2dowp4dowp0dowp5dowpcdowpbdowp2dowpbdowp6dowp5dowpfdowpcdowpfdowpfdowp7dowp5dowpddowp8dowp5dowp9dowpfdowpfdowp7dowp5
API String ID: 432972143-3861665079
Opcode ID: 1288ab0ba291cbce82373cea05a582886ac141b6ee44f6697c2fc0087a9f08ec
Instruction ID: 832100f5e7d7f930f71154d310cc0199997c4eeb5d8abadb01d496cd5de36c72
Opcode Fuzzy Hash: 1288ab0ba291cbce82373cea05a582886ac141b6ee44f6697c2fc0087a9f08ec
Instruction Fuzzy Hash: 513146309642086FFF30AA658814BFFBFE6EB45320F0443ABE881521D1D7B599558751

Function 00BCD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00BCD7C5

Part of subcall function 00B5784B: _memmove.LIBCMT ref: 00B57899

Strings

none, xrefs: 00BCD8A0
stdcall, xrefs: 00BCD847
winapi, xrefs: 00BCD836
cdecl, xrefs: 00BCD81C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 1af40037b8fc7a5b70512e058ff3ce4bdfe89f1db6f561ea14dbf5ce5506c128
Instruction ID: 1209f61f1aeef86fa9b874192a678fc8fa7c7f5e7e75e55c3df83074adaf7339
Opcode Fuzzy Hash: 1af40037b8fc7a5b70512e058ff3ce4bdfe89f1db6f561ea14dbf5ce5506c128
Instruction Fuzzy Hash: 37319075A04619AFCF00EF54CC51EAEB3F5FF14720B1086AAE825976D1DB31A905CB80

Function 00BA8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00BAAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00BAAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00BA8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00BA8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00BA8F57

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

Strings

ListBox, xrefs: 00BA8ED3
ComboBox, xrefs: 00BA8E9E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 1ab1cd22bd91de0764f5d8488685d0a3ab6059e96d26fc20fe5d444092c38c59
Instruction ID: af8f9b5f362586127d920dbf8581cebd56de332e8ec3281d8c46f5f3884b576c
Opcode Fuzzy Hash: 1ab1cd22bd91de0764f5d8488685d0a3ab6059e96d26fc20fe5d444092c38c59
Instruction Fuzzy Hash: E921F571A08105BEDB14ABB0DC95DFEB7F9DF06320F0485AAF825571E0DF3A4809D620

Function 00BC182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00BC184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BC1872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00BC18A2
InternetCloseHandle.WININET(00000000), ref: 00BC18E9

Part of subcall function 00BC2483: GetLastError.KERNEL32(?,?,00BC1817,00000000,00000000,00000001), ref: 00BC2498
Part of subcall function 00BC2483: SetEvent.KERNEL32(?,?,00BC1817,00000000,00000000,00000001), ref: 00BC24AD

Strings

, xrefs: 00BC1893

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: c5393edbfca1024514f6a4ec7ce4e8fbd9663c87d8c4d1e35fdfe474647f2a8e
Instruction ID: 241ad89fb8f05e0850a344ac31c1f99b09c7253521ad94824f7122e9ca64a3b1
Opcode Fuzzy Hash: c5393edbfca1024514f6a4ec7ce4e8fbd9663c87d8c4d1e35fdfe474647f2a8e
Instruction Fuzzy Hash: 3B21BEB1508209BFEB11AB68CC85FBB77EDEB49744F10456EF906A7241EB208D0597B0

Function 00BD63E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B51D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B51D73
Part of subcall function 00B51D35: GetStockObject.GDI32(00000011), ref: 00B51D87
Part of subcall function 00B51D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B51D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00BD6461
LoadLibraryW.KERNEL32(?), ref: 00BD6468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00BD647D
DestroyWindow.USER32(?), ref: 00BD6485

Strings

SysAnimate32, xrefs: 00BD643C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 7bd4f44632b74005eacbb51e0bb6a7abfaa6108c53e439e3506be2fe1659e95a
Instruction ID: 29c40d73d9da27f96f33938ba8f1a609f85ef3d209e316afab08b738295d2dc4
Opcode Fuzzy Hash: 7bd4f44632b74005eacbb51e0bb6a7abfaa6108c53e439e3506be2fe1659e95a
Instruction Fuzzy Hash: 7F215B71200205AFEF108F64DC91EBBB7E9EB59368F10866AFA5093390EB71DC519B60

Function 00BB6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00BB6DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00BB6DEF
GetStdHandle.KERNEL32(0000000C), ref: 00BB6E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00BB6E3B

Strings

nul, xrefs: 00BB6E36

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: f4274e01a57529327977d6d8a07e6cba1bf1a0f6b8be5c7141892a3bc861ebab
Instruction ID: f36396093677caeabfa429cf8a194711374b5b90543468cb8efc912f61174b1a
Opcode Fuzzy Hash: f4274e01a57529327977d6d8a07e6cba1bf1a0f6b8be5c7141892a3bc861ebab
Instruction Fuzzy Hash: 9821837460020AABDB209F29DC44AF9BBE4EF44720F204A69FCA1D72D0EBB4DD50CB50

Function 00BB6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00BB6E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00BB6EBB
GetStdHandle.KERNEL32(000000F6), ref: 00BB6ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00BB6F06

Strings

nul, xrefs: 00BB6F01

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 5fe2ecd8d4ce92411b8543b5851e921d9145028d129131959d7eef20dd4b8e8a
Instruction ID: a9f29f380e78b85402e79fa229611ef02716904f37e950940b41bbd360de12b4
Opcode Fuzzy Hash: 5fe2ecd8d4ce92411b8543b5851e921d9145028d129131959d7eef20dd4b8e8a
Instruction Fuzzy Hash: DB2192755003069BDB209F69DC44AFAB7E8EF45720F200A59F9A1D72D0EBB4EC50CB50

Function 00BBAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00BBAC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00BBACA8
__swprintf.LIBCMT ref: 00BBACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,00BDF910), ref: 00BBACFF

Strings

%lu, xrefs: 00BBACBB

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 0aa3912d246f53dd5615eb86e629f5a0191a06d5d743e51701ede60d2c0ae53d
Instruction ID: e077656c7554d7e48ecaa0b1fbcf18932779a22748b1594c79dd29201348ccba
Opcode Fuzzy Hash: 0aa3912d246f53dd5615eb86e629f5a0191a06d5d743e51701ede60d2c0ae53d
Instruction Fuzzy Hash: 22217170A00109EFCB10DF64CD85EEEBBF8EF49715B0040E9F909AB261DA71EA45CB21

Function 00BB1AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00BB1B19

Strings

EXISTS, xrefs: 00BB1B41
APPEND, xrefs: 00BB1B52
KEYS, xrefs: 00BB1B30
REMOVE, xrefs: 00BB1B1F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 33fe4d1fbdcb6689bca0d9a0358116349a6025c8d4ec6b339509fad44f0a740a
Instruction ID: 62705b149c8d524d7f3e1972a5cb798f64ab68b785e72021af22a9cc65b57549
Opcode Fuzzy Hash: 33fe4d1fbdcb6689bca0d9a0358116349a6025c8d4ec6b339509fad44f0a740a
Instruction Fuzzy Hash: 7F113C709102099FCF10EF98D8629FEB7F4FF25704F5088E5D86567695EB32990ACB50

Function 00BCEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00BCEC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00BCEC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00BCED6A
CloseHandle.KERNEL32(?), ref: 00BCEDEB

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: fc4e78a609f2ccaa543551182b7d9b94a8860e388a4554518a12aa440f5f4516
Instruction ID: 51b2b4f1a95f94c2c1215edcb9abc5d0269b6c3fb8ed0d567ab3b890472004a3
Opcode Fuzzy Hash: fc4e78a609f2ccaa543551182b7d9b94a8860e388a4554518a12aa440f5f4516
Instruction Fuzzy Hash: 29815F716047019FD720EF28C886F2AB7E5AF44750F1488ADF96ADB2D2DBB0ED448B51

Function 00BD0037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00BD0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BCFDAD,?,?), ref: 00BD0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BD00FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BD013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00BD0183
RegCloseKey.ADVAPI32(?,?), ref: 00BD01AF
RegCloseKey.ADVAPI32(00000000), ref: 00BD01BC

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: c216ac56a39e07f9a126923b1f6a177c58247170ab9cdd6a0ac3b5b2a60585a7
Instruction ID: 266d85fa75bb4f09f2f382e473766fdd2c573288a45c68372f14d48820ef6cbe
Opcode Fuzzy Hash: c216ac56a39e07f9a126923b1f6a177c58247170ab9cdd6a0ac3b5b2a60585a7
Instruction Fuzzy Hash: 42518F71218204AFC714EF64CC91F6AB7E9FF84304F4449AEF955972A1EB31E909CB52

Function 00BCD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00BCD927
GetProcAddress.KERNEL32(00000000,?), ref: 00BCD9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00BCD9C6
GetProcAddress.KERNEL32(00000000,?), ref: 00BCDA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00BCDA21

Part of subcall function 00B55A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00BB7896,?,?,00000000), ref: 00B55A2C
Part of subcall function 00B55A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00BB7896,?,?,00000000,?,?), ref: 00B55A50

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 29ad0d0cade7176c8e594abd185ca7d51594a62c1ceabcd6ac06a9e29e336e24
Instruction ID: b35dcd2790b90e576e24c887e1d70285aeecce45ba40f21efc01c42e733da825
Opcode Fuzzy Hash: 29ad0d0cade7176c8e594abd185ca7d51594a62c1ceabcd6ac06a9e29e336e24
Instruction Fuzzy Hash: 20510979A04209DFCB10EFA8C494EADB7F5EF09311B1480A9E956AB312DB31ED45CB51

Function 00BBE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00BBE61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00BBE648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00BBE687

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00BBE6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00BBE6B4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 1e8c29daf7834bcd4c1a13f6836a33e8c870c9de51db38f2345a77574bf96f7d
Instruction ID: 0dbc1dddae5b4f5edfe6d729659bc166eed39fee89411fd3c29819a9e56fae4a
Opcode Fuzzy Hash: 1e8c29daf7834bcd4c1a13f6836a33e8c870c9de51db38f2345a77574bf96f7d
Instruction Fuzzy Hash: CE510A35A00609DFCB01EF64C981AADBBF5EF09355B1480E9E819AB361DB31ED15DF50

Function 00BDA056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0238ca337e9c70d8ef8cdc54246b2d9dd9db627a003b39a151d3614606b20de5
Instruction ID: 837725c2ec30b1cecbb31c3bc513095c6eea42b0c8d3c7bd931b189cb6fb3923
Opcode Fuzzy Hash: 0238ca337e9c70d8ef8cdc54246b2d9dd9db627a003b39a151d3614606b20de5
Instruction Fuzzy Hash: D0419035905104AFD724DF28CC99FA9FBE4EB0A310F1542A6E916B73E1EB30AD41DA51

Function 00BA63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00BA6433
TranslateMessage.USER32(?), ref: 00BA645C
DispatchMessageW.USER32(?), ref: 00BA6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA6475

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: e98b99383d11a2473011f624ddae0c05b3b8154dc8ff9dcf3b9a8541c89e93d4
Instruction ID: b3d3e32ba7d05e0493b568a9955c54ddb4ec59e9f23509ddaa17dbf6249b4fd2
Opcode Fuzzy Hash: e98b99383d11a2473011f624ddae0c05b3b8154dc8ff9dcf3b9a8541c89e93d4
Instruction Fuzzy Hash: 603194B1909646DFDB248F749C84BFABBE8EB07300F1841A5E425C72A1EB359859D750

Function 00BA8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BA8A30
PostMessageW.USER32(?,00000201,00000001), ref: 00BA8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00BA8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00BA8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00BA8AF8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: c4c15caa46fb10a0c87f0c9b9384f4fc55a417c8c1e73d9c0514b13c7bb7f596
Instruction ID: 99f2ac96d5d9ad2996b14af6d9e6d281a1c5b1138d1f6b41153782fc9b3efe1f
Opcode Fuzzy Hash: c4c15caa46fb10a0c87f0c9b9384f4fc55a417c8c1e73d9c0514b13c7bb7f596
Instruction Fuzzy Hash: 8A31E071504219EBDF14CFA8D94CAAE7BB5EB05315F10826AF925E75D0DBB09910CB90

Function 00BAB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00BAB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00BAB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00BAB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00BAB27F
_wcsstr.LIBCMT ref: 00BAB289

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 9ae71a9975a04bc0e5c1cf2b58b21b2ef9f8e5f6704f5926294c019ef91798f7
Instruction ID: 5ab9bb711509fe66688db91bd34c57863d562ac779ede417a65db95340fc3519
Opcode Fuzzy Hash: 9ae71a9975a04bc0e5c1cf2b58b21b2ef9f8e5f6704f5926294c019ef91798f7
Instruction Fuzzy Hash: 5321D332609201BAEB255B759C49E7FBFD8DB4A710F0081BBF819DA1A2EF61DC409660

Function 00BDB14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00B52612: GetWindowLongW.USER32(?,000000EB), ref: 00B52623

GetWindowLongW.USER32(?,000000F0), ref: 00BDB192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00BDB1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00BDB1CF
GetSystemMetrics.USER32(00000004), ref: 00BDB1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00BC0E90,00000000), ref: 00BDB216

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: fa247c44497478bdf09c5234582ed670d8a03641aaa3b092fb31b576f3cf0844
Instruction ID: de97e543382c44f8ff237782b3f357a31f9c46cd3093634d832838ca2d77f79d
Opcode Fuzzy Hash: fa247c44497478bdf09c5234582ed670d8a03641aaa3b092fb31b576f3cf0844
Instruction Fuzzy Hash: 96217171924251EFCB109F389C54F6ABBE4FB06361B16477AA926D72E0F73098108B90

Function 00BA9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00BA9320

Part of subcall function 00B57BCC: _memmove.LIBCMT ref: 00B57C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00BA9352
__itow.LIBCMT ref: 00BA936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00BA9392
__itow.LIBCMT ref: 00BA93A3

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: a6bb677a85f8173cd4dde3bf5b1433ce5d1da7e55d84a2f21c7b919c07e31f53
Instruction ID: 5d5e5aa2c79838977157d133af85896c7851c2d665f8e905aba186da1a06f67c
Opcode Fuzzy Hash: a6bb677a85f8173cd4dde3bf5b1433ce5d1da7e55d84a2f21c7b919c07e31f53
Instruction Fuzzy Hash: A2210731709208ABDF109A609C89EAE7BFCEF4AB10F0480A5FD05D72D0DAB0CD45A795

Function 00BC5A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00BC5A6E
GetForegroundWindow.USER32 ref: 00BC5A85
GetDC.USER32(00000000), ref: 00BC5AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00BC5ACD
ReleaseDC.USER32(00000000,00000003), ref: 00BC5B08

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 2417f32e834050247d7ce600ef6cbcbf85e3948e1f78e674e969b26108d97a4c
Instruction ID: b6779ba382c50132d251980f2f63fae786167ec92b0f9adc63b83d7c35860843
Opcode Fuzzy Hash: 2417f32e834050247d7ce600ef6cbcbf85e3948e1f78e674e969b26108d97a4c
Instruction Fuzzy Hash: B5219F35A01104AFD710EF65D884AAABBE9EF48310F1480B9F80A97362DE70ED41CB90

Function 00B512F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00B5134D
SelectObject.GDI32(?,00000000), ref: 00B5135C
BeginPath.GDI32(?), ref: 00B51373
SelectObject.GDI32(?,00000000), ref: 00B5139C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: c9137ea1a4a31e85cfcd6b719106ccedc578dbfbae7fd53f9d31763fa03200c0
Instruction ID: d2250bdebbea5a3b3ae303cf63a0962f9b57108ff75f7bbb29f38047b5192839
Opcode Fuzzy Hash: c9137ea1a4a31e85cfcd6b719106ccedc578dbfbae7fd53f9d31763fa03200c0
Instruction Fuzzy Hash: EA219D30841608EFEB109F29DC54BAD7BE9FB42322F1486A6F811971F0D770989ACF94

Function 00BABC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00BABCB3
_memcmp.LIBCMT ref: 00BABCD1
_memcmp.LIBCMT ref: 00BABCE4
_memcmp.LIBCMT ref: 00BABCFC
_memcmp.LIBCMT ref: 00BABD14

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 780f00db40c7ccc75fcebc4349589304cced828d9261438f2d2dbad9b4b988f9
Instruction ID: 12a45b54ab33a10c3d9ce708e4caf34370626f5c5107e7ebdc4e724541c028a5
Opcode Fuzzy Hash: 780f00db40c7ccc75fcebc4349589304cced828d9261438f2d2dbad9b4b988f9
Instruction Fuzzy Hash: 7501B5716081497BD7046B1A9D82FBBB3DCDE12398F1484A1FD29A7343FB50EE1096B0

Function 00BB4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BB4ABA
__beginthreadex.LIBCMT ref: 00BB4AD8
MessageBoxW.USER32(?,?,?,?), ref: 00BB4AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00BB4B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00BB4B0A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 0420907f10fcae8d61a8a985e86577c83e93221c888ba9316243087eb93a1ffe
Instruction ID: 132aa4f4a1f29f5dfdcbddccefdf0279074c0d79684ca02f6d48535d049de43e
Opcode Fuzzy Hash: 0420907f10fcae8d61a8a985e86577c83e93221c888ba9316243087eb93a1ffe
Instruction Fuzzy Hash: 2D11A576909615BBC7119FA89C04BEE7FECFB86320F1482A6F925D3251D7B5C90487A0

Function 00BA8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00BA821E
GetLastError.KERNEL32(?,00BA7CE2,?,?,?), ref: 00BA8228
GetProcessHeap.KERNEL32(00000008,?,?,00BA7CE2,?,?,?), ref: 00BA8237
RtlAllocateHeap.NTDLL(00000000,?,00BA7CE2), ref: 00BA823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00BA8255

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: 3c9e05aff23b10ad6d010a793d2c43d8be760d9d45786a86d0f3ca2f4bf9dc5f
Instruction ID: 291fa26f7870a52a92be68aa57c6798e7b0324fbd62b13b0b1ac2809fdb1a288
Opcode Fuzzy Hash: 3c9e05aff23b10ad6d010a793d2c43d8be760d9d45786a86d0f3ca2f4bf9dc5f
Instruction Fuzzy Hash: 4C016D71609205FFDB204FA5DC58D7BBBACEF8A754B50047AF90AC3220EE318D00CA60

Function 00BA710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 00BA7127
ProgIDFromCLSID.COMBASE(?,00000000), ref: 00BA7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BA7044,80070057,?,?), ref: 00BA7150
CoTaskMemFree.COMBASE(00000000), ref: 00BA7160
CLSIDFromString.COMBASE(?,?), ref: 00BA716C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: b11a965a8a49d6ca3124b2f20864b8c90e6547b1cef79e9b6998584b405a6b80
Instruction ID: 75355857a1ce1a812e6dff0b5c09efad2f4284e202aca33413784c3a799def40
Opcode Fuzzy Hash: b11a965a8a49d6ca3124b2f20864b8c90e6547b1cef79e9b6998584b405a6b80
Instruction Fuzzy Hash: 22017C7260E205ABDB118F64DC44AAABBEDEB457A1F1440A5FD05E3220EF32DD409BA0

Function 00BB5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00BB5260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00BB526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00BB5276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00BB5280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00BB52BC

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 8ed7e89d3828c7c539ebb5ed314295a4840e7859bea778464ccd1d03788ebcbe
Instruction ID: 89ca889db6e182335684be5c70bb861e6eb580bba4dac037cc5e94aabc344114
Opcode Fuzzy Hash: 8ed7e89d3828c7c539ebb5ed314295a4840e7859bea778464ccd1d03788ebcbe
Instruction Fuzzy Hash: 22010931D06A1ADBCF10AFA8E959AFDFBB8FB09711F40019AE942B3140DFB0555087A6

Function 00BA810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00BA8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00BA812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BA813A
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00BA8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BA8157

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 97837ef28578f18ed119426e51b10abc9f42a7c0b6b926fca76b56b19d9de6af
Instruction ID: 3d508210f185a69b73c17bd1cba52a68b96073fcd073a212e829c9bd476dcce1
Opcode Fuzzy Hash: 97837ef28578f18ed119426e51b10abc9f42a7c0b6b926fca76b56b19d9de6af
Instruction Fuzzy Hash: D5F04F71209306AFEB110FA5EC98E777BACFF4A754B040076F986D7150EE719941DA60

Function 00BAC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00BAC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 00BAC20E
MessageBeep.USER32(00000000), ref: 00BAC226
KillTimer.USER32(?,0000040A), ref: 00BAC242
EndDialog.USER32(?,00000001), ref: 00BAC25C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 0a610ce7894ba54bf8f4edd96990b8b704d43c3802a9bf4b9f551b80cb53e484
Instruction ID: 9bb2afc92dd7d7ef74bc07fdc58db34242fb5ebe20644024cfc32bd308bc35e1
Opcode Fuzzy Hash: 0a610ce7894ba54bf8f4edd96990b8b704d43c3802a9bf4b9f551b80cb53e484
Instruction Fuzzy Hash: 4F01A73050830597EB205B50ED5EBA6BBF8FB01706F0002AAA553914E0DBF0A944CB50

Function 00B513B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00B513BF
StrokeAndFillPath.GDI32(?,?,00B8B888,00000000,?), ref: 00B513DB
SelectObject.GDI32(?,00000000), ref: 00B513EE
DeleteObject.GDI32 ref: 00B51401
StrokePath.GDI32(?), ref: 00B5141C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 87aaa66d105584e6f3557aa1b8070836cc5eb1ad891475f498ddea1d7263f31e
Instruction ID: 32babe898353d879cdd5c37cde2479c19b8ac6be91221b97454e4fa8721bfa68
Opcode Fuzzy Hash: 87aaa66d105584e6f3557aa1b8070836cc5eb1ad891475f498ddea1d7263f31e
Instruction Fuzzy Hash: 6CF01D30045609EBEB115F1AEC5C7AC7BE5F742326F08C265E82A4A1F1D7304596DF10

Function 00BA8992 Relevance: 7.5, APIs: 5, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BA899D
CloseHandle.KERNEL32(?), ref: 00BA89B2
CloseHandle.KERNEL32(?), ref: 00BA89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 00BA89C3
HeapFree.KERNEL32(00000000), ref: 00BA89CA

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessSingleWait
String ID:
API String ID: 3751786701-0
Opcode ID: ea81ed0f726fd5edc4ed5ebeae8c593a516f9ff1556702d0e9ec81ccda5c30ad
Instruction ID: 341d611e0a86edba22e0d17ebb44c939e63ba326027c6d80f442ddd1d802631c
Opcode Fuzzy Hash: ea81ed0f726fd5edc4ed5ebeae8c593a516f9ff1556702d0e9ec81ccda5c30ad
Instruction Fuzzy Hash: C7E0C936109002FBDA011FE5EC1C965FF69FB893227108232F21692170DF325420DB50

Function 00BBC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00BBC432
CoCreateInstance.COMBASE(00BE2D6C,00000000,00000001,00BE2BDC,?), ref: 00BBC44A

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

CoUninitialize.COMBASE ref: 00BBC6B7

Strings

.lnk, xrefs: 00BBC3C6, 00BBC3EE, 00BBC3F8

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: b32710ddd11a1da3915c2752c43cc73f9b016ae84a39041c4ef8e770f2224ba3
Instruction ID: 96d25ce5618c715777dba571ad4481e3b629da5d18b50ee6519955c117ffe56d
Opcode Fuzzy Hash: b32710ddd11a1da3915c2752c43cc73f9b016ae84a39041c4ef8e770f2224ba3
Instruction Fuzzy Hash: 84A14DB1108205AFD700EF54C891EAFB7E8EF89345F0049ACF5559B1A2DB71E909CB52

Function 00B62CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00B70DB6: std::exception::exception.LIBCMT ref: 00B70DEC
Part of subcall function 00B70DB6: __CxxThrowException@8.LIBCMT ref: 00B70E01

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00B57A51: _memmove.LIBCMT ref: 00B57AAB

__swprintf.LIBCMT ref: 00B62ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00B62D66

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: a6e003d1ad53c40f6eabb097a2b6937bd0ca2c6eddbca06a44588cad4b61c288
Instruction ID: f7a018c85978409d920cc69128658c042c34ab53d4545215014eb1fa21cc26b2
Opcode Fuzzy Hash: a6e003d1ad53c40f6eabb097a2b6937bd0ca2c6eddbca06a44588cad4b61c288
Instruction Fuzzy Hash: 40919E712086019FDB14EF24D896D6EB7E8EF85711F0048EDF8559B2A1EB34ED48CB62

Function 00BBB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B54750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B54743,?,?,00B537AE,?), ref: 00B54770

CoInitialize.OLE32(00000000), ref: 00BBB9BB
CoCreateInstance.COMBASE(00BE2D6C,00000000,00000001,00BE2BDC,?), ref: 00BBB9D4
CoUninitialize.COMBASE ref: 00BBB9F1

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

Strings

.lnk, xrefs: 00BBB99D, 00BBB9AB

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: b816279266d01b4d3e1a3089e711e9018ab3e5a8305a328bc950aeac211ed4a3
Instruction ID: 366f0ebcb969bbbe5a4274d319f0fae481aecda34b48948335192f71be741723
Opcode Fuzzy Hash: b816279266d01b4d3e1a3089e711e9018ab3e5a8305a328bc950aeac211ed4a3
Instruction Fuzzy Hash: F3A166756043019FCB10DF14C894E6ABBE5FF89314F148998F89A9B3A2CB71EC49CB91

Function 00B7501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00B750AD

Part of subcall function 00B800F0: __87except.LIBCMT ref: 00B8012B

Strings

pow, xrefs: 00B75085, 00B750A2

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 2c468d2eca5b99200ed587ef8bc9704e306b61b7370e081457e3801984ee1244
Instruction ID: 31d1a51c79c1af23fe5d4efa5cf1fc56d1fb1c18a15fcc8439d52f06f6a00a47
Opcode Fuzzy Hash: 2c468d2eca5b99200ed587ef8bc9704e306b61b7370e081457e3801984ee1244
Instruction Fuzzy Hash: 84515A2192C60186DB617B24C84536E2BD4EB41790F30CDD9F4E9862B9DFB489D8DB86

Function 00B66192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B66248
_memmove.LIBCMT ref: 00B662E4
_memset.LIBCMT ref: 00B66308

Strings

ERCP, xrefs: 00B661B3

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 15e4e9ad24aed05673a023cab396152b124b0b2878114927e4803bd828a5b0a1
Instruction ID: b3f22c91f5a50c8d084488386683625b3cd80e936139b3f2b96bb2570f400acd
Opcode Fuzzy Hash: 15e4e9ad24aed05673a023cab396152b124b0b2878114927e4803bd828a5b0a1
Instruction Fuzzy Hash: 2F51A171900305DBDB24DF69C881BAAB7E4EF44304F2085BEE95AD7291E774EA44CB40

Function 00BA97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00BA9296,?,?,00000034,00000800,?,00000034), ref: 00BB14E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00BA983F

Part of subcall function 00BB1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00BA92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00BB14B1

Part of subcall function 00BB13DE: GetWindowThreadProcessId.USER32(?,?), ref: 00BB1409
Part of subcall function 00BB13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00BA925A,00000034,?,?,00001004,00000000,00000000), ref: 00BB1419
Part of subcall function 00BB13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00BA925A,00000034,?,?,00001004,00000000,00000000), ref: 00BB142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00BA98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00BA98F9

Strings

@, xrefs: 00BA9911

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: c9e8b59e43d1e5195fe949a867c957a5d0f6f8220bb6e70614252269541fadb1
Instruction ID: dd9fc8ce328a927a6e325164ee9a9d4aea107a5927c62c1f26b395bed1f9315b
Opcode Fuzzy Hash: c9e8b59e43d1e5195fe949a867c957a5d0f6f8220bb6e70614252269541fadb1
Instruction Fuzzy Hash: B7415E76901218BFCB10DFA4CC91AEEBBB8EB4A300F004099FA45B7181DA706E45DFA0

Function 00BD7946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00BDF910,00000000,?,?,?,?), ref: 00BD79DF
GetWindowLongW.USER32 ref: 00BD79FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BD7A0C

Strings

SysTreeView32, xrefs: 00BD79B1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a15309a198abc8e252ea6879365d2220ace69ea9a51811b49ac5eb439ca4ff50
Instruction ID: 5101f1b6e48fde0a9a2a7e80d0997dadb1b46dfb2ea8d3cf988a6908cefe8b82
Opcode Fuzzy Hash: a15309a198abc8e252ea6879365d2220ace69ea9a51811b49ac5eb439ca4ff50
Instruction Fuzzy Hash: FA31D032245606AFDB118F38CC55BEABBE9EB05324F244766F875932E0FB34E9508B50

Function 00BD73D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00BD7461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00BD7475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00BD7499

Strings

SysMonthCal32, xrefs: 00BD742C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: d341b71204918a275d8c6e73dd7fe0c8a818b7a24855a2d3fa00c176781f69fb
Instruction ID: 374f026e74393a4684ad241af2259846ac52cfbbe69f840a0befdebc89360c77
Opcode Fuzzy Hash: d341b71204918a275d8c6e73dd7fe0c8a818b7a24855a2d3fa00c176781f69fb
Instruction Fuzzy Hash: 3521B132540219ABDF228E54CC42FEA7BA9EB48724F110155FE156B2D0EAB5AC50CBA0

Function 00BD7B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00BD7C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00BD7C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00BD7C5F

Strings

msctls_updown32, xrefs: 00BD7BC4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: b2edff2eb0675c252e78caf759205ecf1338c47cdbd68b4b6c380d34d2643f38
Instruction ID: 1d5a301672e4ea536bbeef4e9993a2a94425109c286d9a6451fa7d5c3e3da091
Opcode Fuzzy Hash: b2edff2eb0675c252e78caf759205ecf1338c47cdbd68b4b6c380d34d2643f38
Instruction Fuzzy Hash: 782181B1644109AFDB10DF28DCD1DAA77ECEF4A354B14409AF9019B3A1EB31EC01CB60

Function 00BD6CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00BD6D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00BD6D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00BD6D70

Strings

Listbox, xrefs: 00BD6D08

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: c0add64a4fd5ece4c5b6a378f99d5a39c621864b91d541d9bd7bd0b5a185c05a
Instruction ID: 8b3e0d7425d947483f8a90e35f773cb15e71805d41bf2fa73329912e9458e007
Opcode Fuzzy Hash: c0add64a4fd5ece4c5b6a378f99d5a39c621864b91d541d9bd7bd0b5a185c05a
Instruction Fuzzy Hash: 1B21FF32611118BFDF118F54DC81FBB7BBAEF89760F01817AF9459B2A0DA719C518BA0

Function 00BD770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00BD7772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00BD7787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00BD7794

Strings

msctls_trackbar32, xrefs: 00BD7749

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 0eab540b05734c8d98a05b64351b7b64d3f079864e08f200cdb70d505f098050
Instruction ID: b7585adfff18779a87cc83b030cf1d1bded16ba2ccbfb5fa9af40968050eaa0a
Opcode Fuzzy Hash: 0eab540b05734c8d98a05b64351b7b64d3f079864e08f200cdb70d505f098050
Instruction Fuzzy Hash: 6C113A32244208BFEF209F64CC01FEBB7ACEF88B54F014529FA45921D0E671E811CB10

Function 00B54B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00B54AD0), ref: 00B54B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00B54B57

Strings

GetNativeSystemInfo, xrefs: 00B54B51
kernel32.dll, xrefs: 00B54B40

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: a502e4d6270b15bd2afff9ca21b4ae6444f007f17d0c360e6337944c2f1e0a92
Instruction ID: 98cb5ba76f63fb4fb231ce95fea04c8512b2a12d62cc54742b1eaab546ee70f8
Opcode Fuzzy Hash: a502e4d6270b15bd2afff9ca21b4ae6444f007f17d0c360e6337944c2f1e0a92
Instruction Fuzzy Hash: 30D01234A14713CFD7209F31D868B16B6D4EF05355B1588BB9897D6260FB70D4C0C654

Function 00B54C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00B54B83,?), ref: 00B54C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B54C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 00B54C50
kernel32.dll, xrefs: 00B54C3F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: f0731d1644abdba0c589e7530e9ea670c041fa9ab541a08bc87a844837b37390
Instruction ID: c34a280f92bc41490b39c5d1ba6565619c14217f32d2cbf9dfe6ab48e21a7112
Opcode Fuzzy Hash: f0731d1644abdba0c589e7530e9ea670c041fa9ab541a08bc87a844837b37390
Instruction Fuzzy Hash: ECD01730515713CFD7209F31D91876AB7E4EF05356B1588BB99A6E62A8FB70D8C0CA50

Function 00B54C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00B54BD0,?,00B54DEF,?,00C152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00B54C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B54C23

Strings

kernel32.dll, xrefs: 00B54C0C
Wow64DisableWow64FsRedirection, xrefs: 00B54C1D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 55f980cfe092f9e9cdcdf006ab5fa5af7ea13e688167a23095e177028297eba6
Instruction ID: 8e9b605322e2deee92dc4a21e08d3de061364cb300e0839cd43ee792fd3bc8a8
Opcode Fuzzy Hash: 55f980cfe092f9e9cdcdf006ab5fa5af7ea13e688167a23095e177028297eba6
Instruction Fuzzy Hash: 88D0E23051A713CFD720AB75D918716BAE5EF09356B1588BA9896E62A0EBB0D880CA50

Function 00BD0DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00BD1039), ref: 00BD0DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00BD0E07

Strings

RegDeleteKeyExW, xrefs: 00BD0E01
advapi32.dll, xrefs: 00BD0DF0

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 7285ba4fde11712f8d245c7565a91b3bace92bc7c311b296c8560b785034bdeb
Instruction ID: f16e1c854a46aefbf71fbcea9758d87530029ceca0d95306f9e17867c57a5dbc
Opcode Fuzzy Hash: 7285ba4fde11712f8d245c7565a91b3bace92bc7c311b296c8560b785034bdeb
Instruction Fuzzy Hash: E9D0E270920723CFD720AB76C80879AB7E9EF05352F158C7E9496E2291EAB0D890CB55

Function 00BC90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00BC8CF4,?,00BDF910), ref: 00BC90EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00BC9100

Strings

kernel32.dll, xrefs: 00BC90E9
GetModuleHandleExW, xrefs: 00BC90FA

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 24886207c0776fc3784951df306c2451fde32d3dd8da85126bbfd0110f170639
Instruction ID: 408f08244ae180e28812bb7fcd559b90964d8554315b4c8402260c5a775e79a0
Opcode Fuzzy Hash: 24886207c0776fc3784951df306c2451fde32d3dd8da85126bbfd0110f170639
Instruction Fuzzy Hash: E8D0E234514713DFEB209B71D82EA16B6E5AF05391B1A887E9496E66A0FA70C880CA90

Function 00B91714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B91718
__swprintf.LIBCMT ref: 00B91749

Strings

%.3d, xrefs: 00B91723
WIN_XPe, xrefs: 00B91788

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: d0fd03971af4a4d79072ab53e0fa16e253737b71d0220265ade060464a98d096
Instruction ID: 5cc1f600550b080715ba3f69ea6ad365b285f45175cf917994d6b8e5704a80e7
Opcode Fuzzy Hash: d0fd03971af4a4d79072ab53e0fa16e253737b71d0220265ade060464a98d096
Instruction Fuzzy Hash: 2DD012F180910BEACF0097D498D89B977FCA708701F5008F2B506A3090E6398F54F621

Function 00BA717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4f3bdc08197bd41849ae9ccec9c3507daca1aa930c13246b1f068288b0907a
Instruction ID: b942e7c42c7d116a0d68ac9b7b14216c748dfce02ae8281af500d7588edb0ed2
Opcode Fuzzy Hash: 3a4f3bdc08197bd41849ae9ccec9c3507daca1aa930c13246b1f068288b0907a
Instruction Fuzzy Hash: 55C13875A0C216AFCB14CFA4C884AAEBBF5FF49714B158598E805EB351DB30ED81DB90

Function 00BCE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00BCE0BE
CharLowerBuffW.USER32(?,?), ref: 00BCE101

Part of subcall function 00BCD7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00BCD7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00BCE301
_memmove.LIBCMT ref: 00BCE314

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: e9a8053213897237a320edbe461afb0e9ec4c5ce26aa6211a49bddfa6d897e1d
Instruction ID: 0fa2c1c6b4ddf5a84ce3be9ed35011938ac0c929ed66de728885e94e8b574c93
Opcode Fuzzy Hash: e9a8053213897237a320edbe461afb0e9ec4c5ce26aa6211a49bddfa6d897e1d
Instruction Fuzzy Hash: DEC15871608301DFC715DF28C480A6ABBE4FF89714F1489AEF8A99B351D731E946CB82

Function 00BC8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00BC80C3
CoUninitialize.COMBASE ref: 00BC80CE

Part of subcall function 00BAD56C: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 00BAD5D4

VariantInit.OLEAUT32(?), ref: 00BC80D9
VariantClear.OLEAUT32(?), ref: 00BC83AA

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: ba6899e1fb5c1b524507d28b1347df271f9f09575ffd4d95f4cec339f1e368c3
Instruction ID: b3aef4d8c8c5cb34c891ba2f78ff768a7318005d9ef0e2f8e3e04cf15c04ff22
Opcode Fuzzy Hash: ba6899e1fb5c1b524507d28b1347df271f9f09575ffd4d95f4cec339f1e368c3
Instruction Fuzzy Hash: 42A12535604B019FDB10DF54C885B2AB7E4BF89354F18449DF99A9B3A1CB30ED05CB96

Function 00BA7530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.COMBASE(?,00000000), ref: 00BA76EA
CoTaskMemFree.COMBASE(00000000), ref: 00BA7702
CLSIDFromProgID.COMBASE(?,?), ref: 00BA7727
_memcmp.LIBCMT ref: 00BA7748

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 8c9fefb23eeb8064c33767f370e4e6b4fd7a3a38f20496df21988c23d397f2aa
Instruction ID: 118b39d4911b12451cf4d12a3895e5e3d396e898b8d255729370bd90f0abf7af
Opcode Fuzzy Hash: 8c9fefb23eeb8064c33767f370e4e6b4fd7a3a38f20496df21988c23d397f2aa
Instruction Fuzzy Hash: D7811E75A04109EFCB04DFA8C984EEEB7F9FF89315F204599E505AB250DB71AE05CB60

Function 00BA687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BA688E
SysAllocString.OLEAUT32(00000000), ref: 00BA6937
VariantCopy.OLEAUT32 ref: 00BA6966
VariantClear.OLEAUT32(?), ref: 00BA698D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 287c084694bb247acd395f90c408112840f2c020f0794be161b91b00589d918d
Instruction ID: 422887f989117446de1478ec2cfbcaf4b503272c12ba7526fc137160fc9febdd
Opcode Fuzzy Hash: 287c084694bb247acd395f90c408112840f2c020f0794be161b91b00589d918d
Instruction Fuzzy Hash: 9751B7B47083019ADB24AF65D89173AB3E5EF56310F28C89FE596D7291DB74D8408B01

Function 00BB955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00B54EE5: _fseek.LIBCMT ref: 00B54EFD

Part of subcall function 00BB9734: _wcscmp.LIBCMT ref: 00BB9824
Part of subcall function 00BB9734: _wcscmp.LIBCMT ref: 00BB9837

_free.LIBCMT ref: 00BB96A2
_free.LIBCMT ref: 00BB96A9
_free.LIBCMT ref: 00BB9714

Part of subcall function 00B72D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00B79A24), ref: 00B72D69
Part of subcall function 00B72D55: GetLastError.KERNEL32(00000000,?,00B79A24), ref: 00B72D7B

_free.LIBCMT ref: 00BB971C

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 464ebd311e0b84417835fdca97f39b05a871d491f27d7685db559b23c3b03983
Instruction ID: 3cd9946dd38b378b7dbcecea6b77675e0c77df7cf9095d83fc755e65d5618c96
Opcode Fuzzy Hash: 464ebd311e0b84417835fdca97f39b05a871d491f27d7685db559b23c3b03983
Instruction Fuzzy Hash: 09514CB1904218AFDF259F65CC85AEEBBB9EF48304F1044EEB61DA3241DB715A81CF58

Function 00BD97F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00F9F808,?), ref: 00BD9863
ScreenToClient.USER32(00000002,00000002), ref: 00BD9896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00BD9903

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 95b859bba75e903bdad6bcd69e8a00679b12e7a70f8ef912eb9e674c9a394c2b
Instruction ID: ce2576db004739cd302633c6bd95ee27cdf058ad6ac1f17b6d70ab8013d48aef
Opcode Fuzzy Hash: 95b859bba75e903bdad6bcd69e8a00679b12e7a70f8ef912eb9e674c9a394c2b
Instruction Fuzzy Hash: 4B512E34A01205EFDF14CF58C890AAEBBF5FB46760F14819AF8559B3A0E731AD41DB90

Function 00BA9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00BA9AD2
__itow.LIBCMT ref: 00BA9B03

Part of subcall function 00BA9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00BA9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00BA9B6C
__itow.LIBCMT ref: 00BA9BC3

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: e29dedd417d2e7a07adf6d2ae059d8b3d75dfc90ca17e22f1f041e2312e75518
Instruction ID: 41de0057ec24aceab37786a28a768c0fba53756b935982b183fe03873a0931fa
Opcode Fuzzy Hash: e29dedd417d2e7a07adf6d2ae059d8b3d75dfc90ca17e22f1f041e2312e75518
Instruction Fuzzy Hash: 2941AE70A04208ABDF25EF54D885BEE7BF9EF49711F0040E9F905A7291DB709A48DBA1

Function 00BBB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00BBB89E
GetLastError.KERNEL32(?,00000000), ref: 00BBB8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00BBB8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00BBB915

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: bec12549fd1a91f05d0e8130838dc64f4a4369cdbcbed99725f2e4f1e9383f56
Instruction ID: 4d4629bc6db0578237c1f6a490fcc52da41b01307c79b6c992d4d18068d3ad8b
Opcode Fuzzy Hash: bec12549fd1a91f05d0e8130838dc64f4a4369cdbcbed99725f2e4f1e9383f56
Instruction Fuzzy Hash: 8241F839600A11DFCB11EF15C495A69BBE1EF8A350F1980D9ED4AAB362CB70FD05CB91

Function 00BD8851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00BD88DE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 46bebe05d0d62edfb1480d6a916f5a1da238e919cbb657ea147ce00ad358ea97
Instruction ID: 68229a53e27b7bf606957fde51e477739ad15f4f812edd1f6b514f7773ec30df
Opcode Fuzzy Hash: 46bebe05d0d62edfb1480d6a916f5a1da238e919cbb657ea147ce00ad358ea97
Instruction Fuzzy Hash: 1031E534604108EFEB249A18DCA5FBCFBE5EB06312F944193F991D63E1EE35D9409752

Function 00BDAB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00BDAB60
GetWindowRect.USER32(?,?), ref: 00BDABD6
PtInRect.USER32(?,?,00BDC014), ref: 00BDABE6
MessageBeep.USER32(00000000), ref: 00BDAC57

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: f15e12474e69360b45f19a398f47dfd5c0908aed430e2e98e54a5243a1f5f248
Instruction ID: 92b4b032e3bafa4b72fd330bccd9e358a208f52caffe11d4d3bbc1a6dd1515d8
Opcode Fuzzy Hash: f15e12474e69360b45f19a398f47dfd5c0908aed430e2e98e54a5243a1f5f248
Instruction Fuzzy Hash: BC416E30610119DFDB11DF58D894BA9FBF5FB4A320F1880EAE8159B361E730E941CB92

Function 00B861C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B861FB
__isleadbyte_l.LIBCMT ref: 00B86229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00B86257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00B8628D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e9759f2d23affa7b0a741bd051cdb290a9a325a7dc31c1656b480a45e855da7f
Instruction ID: 2f965c09303f10921f210a15c93e872f26a801f390f14849dea16f97f2f2ecd0
Opcode Fuzzy Hash: e9759f2d23affa7b0a741bd051cdb290a9a325a7dc31c1656b480a45e855da7f
Instruction Fuzzy Hash: 9A31CD30604246AFDF22AF64CC48BBA7BE9FF41310F1540E9E824971A1EB31E950DB90

Function 00BD4EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00BD4F02

Part of subcall function 00BB3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00BB365B
Part of subcall function 00BB3641: GetCurrentThreadId.KERNEL32 ref: 00BB3662
Part of subcall function 00BB3641: AttachThreadInput.USER32(00000000,?,00BB5005), ref: 00BB3669

GetCaretPos.USER32(?), ref: 00BD4F13
ClientToScreen.USER32(00000000,?), ref: 00BD4F4E
GetForegroundWindow.USER32 ref: 00BD4F54

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: a21059fe620662ef6173b96d31cd446aed25acff390b252ac2b5522ed045dd6b
Instruction ID: ef64bbb4fdb1a28e3a18758f6777d5c4b9de4b8078e82128a75678d479eb71ed
Opcode Fuzzy Hash: a21059fe620662ef6173b96d31cd446aed25acff390b252ac2b5522ed045dd6b
Instruction Fuzzy Hash: A4310171D00108AFDB00EFA5C885AEFB7F9EF58300F1044AAE815E7251EB719E058BA0

Function 00BA8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00BA8121
Part of subcall function 00BA810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00BA812B
Part of subcall function 00BA810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BA813A
Part of subcall function 00BA810A: RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00BA8141
Part of subcall function 00BA810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BA8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00BA86A3
_memcmp.LIBCMT ref: 00BA86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BA86FC
HeapFree.KERNEL32(00000000), ref: 00BA8703

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocateErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 2182266621-0
Opcode ID: 6b18ad5e18c4b435df752357e812ce088897064609b0811100afc636d27520e7
Instruction ID: c8cac99c2fa3c07f7cfedddd4996b497d776d812b0d5ef0d7f6439acc3feffbd
Opcode Fuzzy Hash: 6b18ad5e18c4b435df752357e812ce088897064609b0811100afc636d27520e7
Instruction Fuzzy Hash: D8219071E45109EFEB10DFA8CA49BEEB7F8EF45305F158099E455A7240EB30AE09CB90

Function 00B7098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00B709AE

Part of subcall function 00B55A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00BB7896,?,?,00000000), ref: 00B55A2C
Part of subcall function 00B55A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00BB7896,?,?,00000000,?,?), ref: 00B55A50

_fprintf.LIBCMT ref: 00B709E5
OutputDebugStringW.KERNEL32(?), ref: 00BA5DBB

Part of subcall function 00B74AAA: _flsall.LIBCMT ref: 00B74AC3

__setmode.LIBCMT ref: 00B70A1A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: daa0cb0f8198a74a5480821b5da4d452e5d06cbefefb993592f8eea8537b2ac3
Instruction ID: d5466c657344e2b6bcc742b1407544c368ca661b81b24687dd849c669a6f48d5
Opcode Fuzzy Hash: daa0cb0f8198a74a5480821b5da4d452e5d06cbefefb993592f8eea8537b2ac3
Instruction Fuzzy Hash: EB113A31908608BFDB04B7B49C86AFE77E8DF42322F2481E6F52957192EF705D4687A1

Function 00BC1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00BC17A3

Part of subcall function 00BC182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00BC184C
Part of subcall function 00BC182D: InternetCloseHandle.WININET(00000000), ref: 00BC18E9

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: a5603b7b2e016a81f07e2f16b6e9678bb91c32f6b58a5670da90aa10ae08702a
Instruction ID: fb625cca2fc04c7cb31271128541144cf6e72ff9b7e8103ce747f40803c95701
Opcode Fuzzy Hash: a5603b7b2e016a81f07e2f16b6e9678bb91c32f6b58a5670da90aa10ae08702a
Instruction Fuzzy Hash: FD212371208601BFEB128F64CC40FBABBE9FF4A701F10442EFA01A7652DB31D810A7A0

Function 00BB3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00BDFAC0), ref: 00BB3A64
GetLastError.KERNEL32 ref: 00BB3A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00BB3A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00BDFAC0), ref: 00BB3ADF

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 6bcd18dbd0f621efa23a95c0c1d6af14d175efdcbd0ff1e882a6296109f1fe8d
Instruction ID: b0674166f028431dc7099248bb3d81a7e60a11efe3d5398fd25da0e80cc2ef74
Opcode Fuzzy Hash: 6bcd18dbd0f621efa23a95c0c1d6af14d175efdcbd0ff1e882a6296109f1fe8d
Instruction Fuzzy Hash: 9B21D8745082019F8310DF24D8918BEB7E4EF55764F244AAEF4D9C72A1EB71DE09CB42

Function 00BADCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAF0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00BADCD3,?,?,?,00BAEAC6,00000000,000000EF,00000119,?,?), ref: 00BAF0CB
Part of subcall function 00BAF0BC: lstrcpyW.KERNEL32(00000000,?,?,00BADCD3,?,?,?,00BAEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00BAF0F1
Part of subcall function 00BAF0BC: lstrcmpiW.KERNEL32(00000000,?,00BADCD3,?,?,?,00BAEAC6,00000000,000000EF,00000119,?,?), ref: 00BAF122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00BAEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00BADCEC
lstrcpyW.KERNEL32(00000000,?,?,00BAEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00BADD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,00BAEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00BADD46

Strings

cdecl, xrefs: 00BADD3D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 4bde18c0d8caad9d8ac8705cd8aae8e7680afd9648cf674a8e294a88895a6e94
Instruction ID: ee9fdd17f1f90df0d15e94ef4235979443c608137007e54e5d80360c7df0ae29
Opcode Fuzzy Hash: 4bde18c0d8caad9d8ac8705cd8aae8e7680afd9648cf674a8e294a88895a6e94
Instruction Fuzzy Hash: C011D03A204306EFCB25AF74C845DBA77E9FF46350B4080BAF856CB2A0EB719941C790

Function 00B850E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B85101

Part of subcall function 00B7571C: __FF_MSGBANNER.LIBCMT ref: 00B75733
Part of subcall function 00B7571C: __NMSG_WRITE.LIBCMT ref: 00B7573A
Part of subcall function 00B7571C: RtlAllocateHeap.NTDLL(00F80000,00000000,00000001), ref: 00B7575F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 73efa3f737f6e7ac4a0564615d638254f67314280d06ab595802819d8916cab1
Instruction ID: cad78512df26f50d9c17c8967276d05957e7182fc2c7d309c93c47644335fd87
Opcode Fuzzy Hash: 73efa3f737f6e7ac4a0564615d638254f67314280d06ab595802819d8916cab1
Instruction Fuzzy Hash: 9D11E372905A12AECB313F70EC4D76D37D8EB00361B1085AAF919AA260DF31C940D794

Function 00B544A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B544CF

Part of subcall function 00B5407C: _memset.LIBCMT ref: 00B540FC
Part of subcall function 00B5407C: _wcscpy.LIBCMT ref: 00B54150
Part of subcall function 00B5407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B54160

KillTimer.USER32(?,00000001,?,?), ref: 00B54524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B54533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B8D4B9

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 98e9529d2a7efed903f105bc4c826c80fdb97a4a40fdc8e8ac6c2e8cb8dd261c
Instruction ID: 97f5a9dc25798cc3a40629b7449d7e4da601bf7907d6368109a1aea3dd41290a
Opcode Fuzzy Hash: 98e9529d2a7efed903f105bc4c826c80fdb97a4a40fdc8e8ac6c2e8cb8dd261c
Instruction Fuzzy Hash: 03210770908784AFE7329B249895BE6BBECEF11319F0800DEE69E57291D7746988CB41

Function 00BA85B1 Relevance: 6.1, APIs: 4, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00BA85E2
OpenProcessToken.ADVAPI32(00000000), ref: 00BA85E9
CloseHandle.KERNEL32(00000004), ref: 00BA8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00BA8632

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: dfe7802f39bfbcdbe891c756ca2a994e0ab09d724810c75fd28e20e6d3551263
Instruction ID: 1bfe341ee254715ef8de3e5abc73d6d5afe43301f8d3da12bd57127e74387e6e
Opcode Fuzzy Hash: dfe7802f39bfbcdbe891c756ca2a994e0ab09d724810c75fd28e20e6d3551263
Instruction Fuzzy Hash: 97115C7250520AABDF01CFA8DD49BEEBBE9EF09304F044065FE05A2160DB718D60DB60

Function 00BC6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B55A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00BB7896,?,?,00000000), ref: 00B55A2C
Part of subcall function 00B55A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00BB7896,?,?,00000000,?,?), ref: 00B55A50

gethostbyname.WS2_32(?), ref: 00BC6399
WSAGetLastError.WS2_32(00000000), ref: 00BC63A4
_memmove.LIBCMT ref: 00BC63D1
inet_ntoa.WS2_32(?), ref: 00BC63DC

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 8de27c33b297f3e504bbf63a6f894cb87ecabdc1d4d2be1a665034a7800233b5
Instruction ID: 911e22a4bd592f9e4c35cff9dc8a0ef09b3264ec5c433e9906e25b92a9602068
Opcode Fuzzy Hash: 8de27c33b297f3e504bbf63a6f894cb87ecabdc1d4d2be1a665034a7800233b5
Instruction Fuzzy Hash: 7B112171904109EFCB04FBA4DD96EAEB7F8AF04311B1441E9F906A7261EF319E18DB61

Function 00BA8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00BA8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BA8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BA8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BA8BA4

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fea92ee234b7880881fa19a8d47ee16deb1074d1352682b6e03bef8d653fd212
Instruction ID: 8ca97d6eaef61a8f83bbf630862339404cb4a96d21e3f517b596e377c169aadd
Opcode Fuzzy Hash: fea92ee234b7880881fa19a8d47ee16deb1074d1352682b6e03bef8d653fd212
Instruction Fuzzy Hash: DB113A79901218BFDB10DB95C884EADBBB4EB48310F204095E900B7290DA716E10DBA4

Function 00BB1142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00BAFCED,?,00BB0D40,?,00008000), ref: 00BB115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00BAFCED,?,00BB0D40,?,00008000), ref: 00BB1184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00BAFCED,?,00BB0D40,?,00008000), ref: 00BB118E
Sleep.KERNEL32(?,?,?,?,?,?,?,00BAFCED,?,00BB0D40,?,00008000), ref: 00BB11C1

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: ec3477b2a2052f948105a7bc4b61a8e4ad4e081de9a20dc7a983ebe9b4210742
Instruction ID: 6fcc191a99c5175a8ad09bb1ac0bafa4106ef16b4cdf1efc6efa9d40c7e5b25d
Opcode Fuzzy Hash: ec3477b2a2052f948105a7bc4b61a8e4ad4e081de9a20dc7a983ebe9b4210742
Instruction Fuzzy Hash: 18115A31C0551DE7CF009FA9D898AFEBBB8FF09751F404496EA41B6240DBB09550CBA1

Function 00BAD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00BAD84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00BAD864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00BAD879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00BAD897

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: e446b4dca297c5f031df9475874f42152a5017f1e4695e3266937342e45c93f3
Instruction ID: 4cee9ab03568ad9095fab0dac93962cc471de50711340d5854a94266fa1be779
Opcode Fuzzy Hash: e446b4dca297c5f031df9475874f42152a5017f1e4695e3266937342e45c93f3
Instruction Fuzzy Hash: 16118E7160A305DBE7208F50EC48FA7BBFCEB01B00F1085AAA517D7990D7B8E5099FA1

Function 00B86FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00B86FDB

Part of subcall function 00B876C2: __fltout2.LIBCMT ref: 00B876EB

__cftog_l.LIBCMT ref: 00B87001
__cftoe_l.LIBCMT ref: 00B87033

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 3418e9e1c4ef3e24c7146e4c22f9312883afc4e8e79c0491643a41ce0d32e664
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 2B014E7248814ABBCF176E84CC45CED3FA2FB18359B688495FA1858031DA36C9B1EB81

Function 00BDB2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BDB2E4
ScreenToClient.USER32(?,?), ref: 00BDB2FC
ScreenToClient.USER32(?,?), ref: 00BDB320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BDB33B

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 7e15b873f28402051adb76d81d99923945748c3659b729b4f7530323f749fb9b
Instruction ID: 1c6bd5756cc05913fd16eb27bab3170c3cc61474fdd64abfc55e9453be99b01f
Opcode Fuzzy Hash: 7e15b873f28402051adb76d81d99923945748c3659b729b4f7530323f749fb9b
Instruction Fuzzy Hash: CD112375D0420AEFDB41CF99C4449AEFBB5FB08310F108166E915A3620E735AA55DB50

Function 00BDB635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BDB644
_memset.LIBCMT ref: 00BDB653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00C16F20,00C16F64), ref: 00BDB682
CloseHandle.KERNEL32 ref: 00BDB694

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: e5739ddd76a4a19f6123e0db27a096e0ad7b31321068da5a53461731925c6b6b
Instruction ID: 5a626a0c0fee26fb10ac685b5bb05f1673e9f115696f014a545f4be66c1626df
Opcode Fuzzy Hash: e5739ddd76a4a19f6123e0db27a096e0ad7b31321068da5a53461731925c6b6b
Instruction Fuzzy Hash: D2F05EF2541300BEE61027A5BC06FFB7A9DEB0A395F008031BA09E6192E7718C02C7A8

Function 00BB6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00BB6BE6

Part of subcall function 00BB76C4: _memset.LIBCMT ref: 00BB76F9

_memmove.LIBCMT ref: 00BB6C09
_memset.LIBCMT ref: 00BB6C16
RtlLeaveCriticalSection.NTDLL(?), ref: 00BB6C26

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 9b00dad0e93b82ade1ba19d23feb713cae30a8b1e173f03e691ff34a9d888619
Instruction ID: b5bd35111403df36aed76332fecf3f316cc8171415854bd8f878a314e6bc4e1d
Opcode Fuzzy Hash: 9b00dad0e93b82ade1ba19d23feb713cae30a8b1e173f03e691ff34a9d888619
Instruction Fuzzy Hash: BFF05E3A204100ABCF016F95DC85A9ABB69EF45320F04C0A1FE099F227DB71E911CBB4

Function 00B52218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00B52231
SetTextColor.GDI32(?,000000FF), ref: 00B5223B
SetBkMode.GDI32(?,00000001), ref: 00B52250
GetStockObject.GDI32(00000005), ref: 00B52258
GetWindowDC.USER32(?,00000000), ref: 00B8BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 00B8BE90
GetPixel.GDI32(00000000,?,00000000), ref: 00B8BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 00B8BEC2
GetPixel.GDI32(00000000,?,?), ref: 00B8BEE2
ReleaseDC.USER32(?,00000000), ref: 00B8BEED

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: e26c204da0ddaa659df6d943303abfe45cdfe3ea83c32d6691b16b314793af4c
Instruction ID: 7da435155b0d254b053f0a4daccae55eb9145244d1f716a18ad64891270bd946
Opcode Fuzzy Hash: e26c204da0ddaa659df6d943303abfe45cdfe3ea83c32d6691b16b314793af4c
Instruction Fuzzy Hash: 0DE03932109245AADF215FA4FC0DBE87B50EB15336F0483A7FA6A580F19B728980DB12

Function 00BA8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00BA871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,00BA82E6), ref: 00BA8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00BA82E6), ref: 00BA872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,00BA82E6), ref: 00BA8736

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: d9c06e316a894be712f710db8bdea588c01021c96e492f230b8791f45da3ea69
Instruction ID: 3b6046166361b8c0491f4ee9ed911b1b930273916512fdb888be166b631da968
Opcode Fuzzy Hash: d9c06e316a894be712f710db8bdea588c01021c96e492f230b8791f45da3ea69
Instruction Fuzzy Hash: BAE0863661A2129BD7205FF05D0CB66BBECEF51791F158869B246CB040FE348841C750

Function 00BAB2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00BAB4BE

Strings

Container, xrefs: 00BAB43B
AutoIt3GUI, xrefs: 00BAB436

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: f4597f1626e60dd7c340e8c282b618fb013c57aeec37e6df6e7ac401e8e76751
Instruction ID: b2dafc0de4b592ba236d81e6bc5c7682f9f7202ed8eb534811dbb1c8f7265abd
Opcode Fuzzy Hash: f4597f1626e60dd7c340e8c282b618fb013c57aeec37e6df6e7ac401e8e76751
Instruction Fuzzy Hash: A2915970604601AFDB14DF64C894E6AB7F9FF49700F2485AEE95ACB3A2DB71E841CB50

Function 00BBAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6FC86: _wcscpy.LIBCMT ref: 00B6FCA9

Part of subcall function 00B59837: __itow.LIBCMT ref: 00B59862
Part of subcall function 00B59837: __swprintf.LIBCMT ref: 00B598AC

__wcsnicmp.LIBCMT ref: 00BBB02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00BBB0F6

Strings

LPT, xrefs: 00BBB027

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 6447083e2e4324ceaececfd80d2dd20077d8a724d55827597c9e5d2389a3079b
Instruction ID: 5ddd50e1576a1d45483681608d5f04f161dec2ca3adae5a4e68338c1adc44c03
Opcode Fuzzy Hash: 6447083e2e4324ceaececfd80d2dd20077d8a724d55827597c9e5d2389a3079b
Instruction Fuzzy Hash: 03613C75A10219AFCB14EF98C891EFEB7F4EB09710F1440A9F956AB291D7B0AE44CB50

Function 00B62957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00B62968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00B62981

Strings

@, xrefs: 00B62975

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 943f2a2cc9b28e1e9cecdf5deaa5469e528a2c157a67883f8e84dbce0726019e
Instruction ID: 98bb8d7a6d1f628836663cba2e255096d602cf4398d5f92825640ac3058f915c
Opcode Fuzzy Hash: 943f2a2cc9b28e1e9cecdf5deaa5469e528a2c157a67883f8e84dbce0726019e
Instruction Fuzzy Hash: B75137715087449BD320EF10D886BAFBBE8FB85345F41889DF6D8520A1DF71852DCB66

Function 00BB9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00B54F0B: __fread_nolock.LIBCMT ref: 00B54F29

_wcscmp.LIBCMT ref: 00BB9824
_wcscmp.LIBCMT ref: 00BB9837

Strings

FILE, xrefs: 00BB9770

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 5cf7354c7ed0bc95bd8a7aa3d333347544f90907cda6870c0d07208bcca9dc82
Instruction ID: 4d8f2a1c969d5c018ec2dc8628d1e22a5d5dd091499e4de9f69331b860eea55a
Opcode Fuzzy Hash: 5cf7354c7ed0bc95bd8a7aa3d333347544f90907cda6870c0d07208bcca9dc82
Instruction Fuzzy Hash: A041A771A00209BBDF219AA4CC86FEFBBF9DF85714F0044E9FA05A7181DBB199458B61

Function 00BC258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00BC25D4

Strings

|, xrefs: 00BC25A5

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 8479df644e3f2bd9fd0d416ebbdf45a6ffaef2e5a0709bb201b9e8b663e4c46a
Instruction ID: ba7e153ac77f96cd844b93e29dd6b7aa97e422f9740e94972b472a0a68c6d8c1
Opcode Fuzzy Hash: 8479df644e3f2bd9fd0d416ebbdf45a6ffaef2e5a0709bb201b9e8b663e4c46a
Instruction Fuzzy Hash: 68310771900119ABCF11EFA4DC85EEEBFB9FF08310F1040A9FD15A6162EA315A56DB60

Function 00BD7A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00BD7B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00BD7B76

Strings

', xrefs: 00BD7ACA

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: fb179769f7145fcb260a652d21938c86bdf875bc1afb45240eac448090361244
Instruction ID: fcd08ca8be205e14b70a1c108980abb88bd4a4dfe248e958f3563e61abce90b6
Opcode Fuzzy Hash: fb179769f7145fcb260a652d21938c86bdf875bc1afb45240eac448090361244
Instruction Fuzzy Hash: C0410874A4520A9FDB14CF64D891BEABBF5FB09304F1041AAE904AB391FB70A951CF90

Function 00BD6A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00BD6B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00BD6B53

Strings

static, xrefs: 00BD6AB3

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 228adba1ea41778561a42907ba75e8d4c75221d7fd9b3861b8962cf53816bf4f
Instruction ID: a0cb687115e5efad7e0cac0757cc80d166c39a5dd111deb3d2bae66114882b7a
Opcode Fuzzy Hash: 228adba1ea41778561a42907ba75e8d4c75221d7fd9b3861b8962cf53816bf4f
Instruction Fuzzy Hash: A4316E71100604AEDB109F64CC91BFBB7E9FF48760F10856AF9A5D7290EA35AC51C760

Function 00BB28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB2911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00BB294C

Strings

0, xrefs: 00BB290A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 3507484d982dbb9153eac9dbea749fdd0555b033cb62916e3a5514fce7ae9474
Instruction ID: f64b5d9b2f178cf08e294511170e92a3c9342414f440a12902875c83c03271dc
Opcode Fuzzy Hash: 3507484d982dbb9153eac9dbea749fdd0555b033cb62916e3a5514fce7ae9474
Instruction Fuzzy Hash: 1931C131A003059BEB24DF58DD85BFEBBF8EF46350F1440B9E9D9A61A0D7B09940CB51

Function 00BC39E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00BC3A66

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Strings

, $, xrefs: 00BC3AA6
AUTOITCALLVARIABLE%d, xrefs: 00BC3A58

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 6a380eda821be52862eabbdf852cc0561d31c75f265d88b1ce22227728f8a5fa
Instruction ID: 926ce9b5aba25c0c330b4996a621f99b9cc593c0b07114f68c574f9f1cc37ac8
Opcode Fuzzy Hash: 6a380eda821be52862eabbdf852cc0561d31c75f265d88b1ce22227728f8a5fa
Instruction Fuzzy Hash: ED218C71700219AACF14EF64CC82FAE77F5EF48700F4084E9F945AB281DA30EA59CB61

Function 00BD66D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00BD6761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BD676C

Strings

Combobox, xrefs: 00BD672E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 0cde7445c740b3113027285d1cb2c28290cfefa86b43c0cc0570061d2ab66f51
Instruction ID: f37654120aac28c6a340181e563cbef4a07a85dd992ffa248dba4cb516abaa8c
Opcode Fuzzy Hash: 0cde7445c740b3113027285d1cb2c28290cfefa86b43c0cc0570061d2ab66f51
Instruction Fuzzy Hash: 4F119071300209AFEF15CF54CC81EABB7AAEB983A8F10416AF91497391E635DC5187A0

Function 00BD6C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00B51D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B51D73
Part of subcall function 00B51D35: GetStockObject.GDI32(00000011), ref: 00B51D87
Part of subcall function 00B51D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B51D91

GetWindowRect.USER32(00000000,?), ref: 00BD6C71
GetSysColor.USER32(00000012), ref: 00BD6C8B

Strings

static, xrefs: 00BD6C4E

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: bc81ecbc88c7368ff073d5ea03b33a5aa191c6513b6fb3a203e946ba13cb9b14
Instruction ID: 466386e1cace4c381d7fc4a2fe2c88c3ad7024bc50b04fc2b8711d2447821327
Opcode Fuzzy Hash: bc81ecbc88c7368ff073d5ea03b33a5aa191c6513b6fb3a203e946ba13cb9b14
Instruction Fuzzy Hash: 4B211A7262020AAFDB04DFA8CC45AFABBE8FB08315F044569FD55D3250E635E850DB60

Function 00BD6920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00BD69A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00BD69B1

Strings

edit, xrefs: 00BD6986

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 2673d650f51f1f12aa7e4ed911aeff428096bf8294fceca37710ddcfd3f879e1
Instruction ID: db45d9faa89389073e63347dcfaec7434a9e2891f5eaf764d512495cfe36dd8c
Opcode Fuzzy Hash: 2673d650f51f1f12aa7e4ed911aeff428096bf8294fceca37710ddcfd3f879e1
Instruction Fuzzy Hash: F9119D71100109ABEB108E649C60AFBB7A9EB19378F504766F9A1972E0E739DC509760

Function 00BB29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB2A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00BB2A41

Strings

0, xrefs: 00BB2A18

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e5fa24d8b16200bf6359a011e8c6e1a966022f97092022c0fc64035b1b668513
Instruction ID: 7e2c00222a29e0f5276e1f26d8530223b34ac3ef30a97d4928e4d6b0e729e693
Opcode Fuzzy Hash: e5fa24d8b16200bf6359a011e8c6e1a966022f97092022c0fc64035b1b668513
Instruction Fuzzy Hash: D9119072901114EBDB35EB98DC44BFE77E8EB86314F1440A1E859E7290D7B0AD0ACB92

Function 00BC21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00BC222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00BC2255

Strings

<local>, xrefs: 00BC221D

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 7f81a6045521b15a2027f6f98b5a4047911bc91a814b4494825d127dc1312507
Instruction ID: 7e543f8c405227b18426c216c04ec2b434db76804af2c48ad099cb98ba4e1d4e
Opcode Fuzzy Hash: 7f81a6045521b15a2027f6f98b5a4047911bc91a814b4494825d127dc1312507
Instruction Fuzzy Hash: AE11CE70501226BADB298F118C84FFAFBE8FB06361F10826EF9059A000E2705D80D6F0

Function 00BA8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00BAAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00BAAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00BA8E73

Strings

ListBox, xrefs: 00BA8E3D
ComboBox, xrefs: 00BA8E12

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: ef028c78aacb7baf6cac9d3f29ea0c62af09764b6934bb3ca892b19e5cfe5428
Instruction ID: bf7f5557e49c6cace960f772e058fa56a64f5481f94ab5ad0401f0794fc61e5d
Opcode Fuzzy Hash: ef028c78aacb7baf6cac9d3f29ea0c62af09764b6934bb3ca892b19e5cfe5428
Instruction Fuzzy Hash: 9B01F5B1A49219EBCB15EBA0CC919FE73E8EF06320B0046A9BC21672E1DE35580CC660

Function 00BA8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00BAAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00BAAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00BA8D6B

Strings

ListBox, xrefs: 00BA8D35
ComboBox, xrefs: 00BA8D0A

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f73d6cc4103e42e58f911f6834a7dd0a1473d1443485ac5bbbc020f34eba2661
Instruction ID: 296a4ebf55f41b78ca4582888f35d796164f0de5b4b232a48e7111c88aa3d984
Opcode Fuzzy Hash: f73d6cc4103e42e58f911f6834a7dd0a1473d1443485ac5bbbc020f34eba2661
Instruction Fuzzy Hash: F001D4B1B45109ABCB15EBA0C996AFE73E8DF16300F1041B9B842672E1DE255E0CD271

Function 00BA8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B57DE1: _memmove.LIBCMT ref: 00B57E22

Part of subcall function 00BAAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00BAAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00BA8DEE

Strings

ListBox, xrefs: 00BA8DBA
ComboBox, xrefs: 00BA8D8F

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 5d664bc712452af02411774c74a77029d1fc76992dcabac93f0708f3e3f706fc
Instruction ID: d000c5a8d6399b993819b24f87c94642722d2523dfab1dd73b17bb7539049d9c
Opcode Fuzzy Hash: 5d664bc712452af02411774c74a77029d1fc76992dcabac93f0708f3e3f706fc
Instruction Fuzzy Hash: 6201F2B1B49109A7CB25EAA4C992AFE77E8CF16300F1041A9BC42772E2DE255E0CD271

Function 00BB4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00BB4F46
_wcscmp.LIBCMT ref: 00BB4F58

Strings

#32770, xrefs: 00BB4F52

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 9d5588cc54a79ba0b28fa21a96282c491df56c430ffa6975f09b84fc2333f48f
Instruction ID: 628a162c51e579d7371e2d40d5c8919743a72f94ae03802b84c1a15a9c0a0d34
Opcode Fuzzy Hash: 9d5588cc54a79ba0b28fa21a96282c491df56c430ffa6975f09b84fc2333f48f
Instruction Fuzzy Hash: DCE09232A042292BE7209A99AC4ABF7FBECEB55B60F004067FD44D3051EA709A45C7E0

Function 00B8B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B8B314: _memset.LIBCMT ref: 00B8B321

Part of subcall function 00B70940: InitializeCriticalSectionAndSpinCount.KERNEL32(00C14158,00000000,00C14144,00B8B2F0,?,?,?,00B5100A), ref: 00B70945

IsDebuggerPresent.KERNEL32(?,?,?,00B5100A), ref: 00B8B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00B5100A), ref: 00B8B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B8B2FE

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 3f75a0ec547363a3bd2b709e4d4155d8461b2403fe3b2b2d549ceb32d9e7a6f5
Instruction ID: 102c37c2372bfff6491d8dc6aabe280b960b9cb8df58230c8d3c8ba750d8b383
Opcode Fuzzy Hash: 3f75a0ec547363a3bd2b709e4d4155d8461b2403fe3b2b2d549ceb32d9e7a6f5
Instruction Fuzzy Hash: C4E06D71600702CBD720AF38E814756BBE4BF04314F0489ADF856C76A1EBB4D408CBA1

Function 00B91935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00B91775

Part of subcall function 00BCBFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,00B9195E,?), ref: 00BCBFFE
Part of subcall function 00BCBFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00BCC010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00B9196D

Strings

WIN_XPe, xrefs: 00B91788

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 900aa5e76ae8ddf3c619df22ed70853d394802e493ba22653af3dd559766a96b
Instruction ID: 3cd40d19ead060c6bbd18cc40185eb09339770a56686d1aeb62c1d5b8c0557f1
Opcode Fuzzy Hash: 900aa5e76ae8ddf3c619df22ed70853d394802e493ba22653af3dd559766a96b
Instruction Fuzzy Hash: 04F0A5B080510ADFDB15DB95C9D4BECBBF8AB08301F5404EAE102A31A0DB758F84EF60

Function 00BD5998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BD59AE
PostMessageW.USER32(00000000), ref: 00BD59B5

Part of subcall function 00BB5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00BB52BC

Strings

Shell_TrayWnd, xrefs: 00BD59A7

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 7d3b6ee2a4b2e82890288b473f05a1a47f57cc58cea6f5bd55af92b9e5f90436
Instruction ID: c57dec13077628148c3b280427c63425869734b6139e0af1890d3f916be4ee82
Opcode Fuzzy Hash: 7d3b6ee2a4b2e82890288b473f05a1a47f57cc58cea6f5bd55af92b9e5f90436
Instruction Fuzzy Hash: 8CD0C9313863127BEA64BB70AC1BFE6A655BB14B50F040836B346AB1D0DDE0A800C658

Function 00BD5964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BD596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00BD5981

Part of subcall function 00BB5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00BB52BC

Strings

Shell_TrayWnd, xrefs: 00BD5967

Memory Dump Source

Source File: 00000000.00000002.2129821939.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000000.00000002.2129795167.0000000000B50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129821939.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130115710.0000000000CB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130165337.0000000000CCB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_l1QC9H0SNR.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 22db542f2a627c30a0674039e0b8cf433f97ca57b7f429359969414a52b969a1
Instruction ID: 8f69f5b97d33bf3c161b63b9b85ab2f5661cb8f956bf7db0aca94365f5f5670e
Opcode Fuzzy Hash: 22db542f2a627c30a0674039e0b8cf433f97ca57b7f429359969414a52b969a1
Instruction Fuzzy Hash: BAD0C935389312B7EA64BB70AC2BFE6AA55BB10B50F040836B34AAB1D0DDE0A800C654

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report l1QC9H0SNR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\user\AppData\Local\Temp\Charley

C:\Users\user\AppData\Local\Temp\aut7743.tmp

C:\Users\user\AppData\Local\Temp\aut77B1.tmp

C:\Users\user\AppData\Local\Temp\aut7B1B.tmp

Windows Analysis Report
l1QC9H0SNR.exe

Function 00B53B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00B53633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Function 00B549A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00B54E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00CB2A60 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Function 00BB9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00B5708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00B53A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00B53766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 00B53015 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
registrywindowclipboardCOMMON

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre