Edit tour

Windows Analysis Report
uVpytXGpQz.exe

Overview

General Information

Sample name:	uVpytXGpQz.exe renamed because original name is a hash value
Original sample name:	539ee7af02fcbd28659831dd774581f76ee66ca6238d12af286158f2f343f3b8.exe
Analysis ID:	1588380
MD5:	022dbaa1df24d488b03ecb058a521613
SHA1:	9f12948c741b6b27cce58d4cd804a2f988feddf2
SHA256:	539ee7af02fcbd28659831dd774581f76ee66ca6238d12af286158f2f343f3b8
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected Snake Keylogger

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Drops VBS files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

uVpytXGpQz.exe (PID: 7948 cmdline: "C:\Users\user\Desktop\uVpytXGpQz.exe" MD5: 022DBAA1DF24D488B03ECB058A521613)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EmbeddedExe1.exe (PID: 8144 cmdline: "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe" MD5: 47310E2D76477F79641F8703027A60B0)

caulds.exe (PID: 7396 cmdline: "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe" MD5: 47310E2D76477F79641F8703027A60B0)

RegSvcs.exe (PID: 1824 cmdline: "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cmd.exe (PID: 1472 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 1384 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

EmbeddedExe2.exe (PID: 8164 cmdline: "C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe" MD5: 5EFEF6CC9CD24BAEEED71C1107FC32DF)

wscript.exe (PID: 6024 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

caulds.exe (PID: 7480 cmdline: "C:\Users\user\AppData\Local\poufs\caulds.exe" MD5: 47310E2D76477F79641F8703027A60B0)

RegSvcs.exe (PID: 8128 cmdline: "C:\Users\user\AppData\Local\poufs\caulds.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cmd.exe (PID: 8080 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 7476 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot1628099890:AAEoyPqXzUZV0NK78yRGbDMLJqRw0vcASbg/sendMessage?chat_id=1217600190", "Token": "1628099890:AAEoyPqXzUZV0NK78yRGbDMLJqRw0vcASbg", "Chat_id": "1217600190", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14954:$a1: get_encryptedPassword 0x14c40:$a2: get_encryptedUsername 0x14760:$a3: get_timePasswordChanged 0x1485b:$a4: get_passwordField 0x1496a:$a5: set_encryptedPassword 0x15ff8:$a7: get_logins 0x15f5b:$a10: KeyLoggerEventArgs 0x15bc6:$a11: KeyLoggerEventArgsEventHandler
0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19970:$x1: $%SMTPDV$ 0x18354:$x2: $#TheHashHere%& 0x19918:$x3: %FTPDV$ 0x182f4:$x4: $%TelegramDv$ 0x15bc6:$x5: KeyLoggerEventArgs 0x15f5b:$x5: KeyLoggerEventArgs 0x1993c:$m2: Clipboard Logs ID 0x19b7a:$m2: Screenshot Logs ID 0x19c8a:$m2: keystroke Logs ID 0x19f64:$m3: SnakePW 0x19b52:$m4: \SnakeKeylogger\
0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b54:$a1: get_encryptedPassword 0x14e40:$a2: get_encryptedUsername 0x14960:$a3: get_timePasswordChanged 0x14a5b:$a4: get_passwordField 0x14b6a:$a5: set_encryptedPassword 0x161f8:$a7: get_logins 0x1615b:$a10: KeyLoggerEventArgs 0x15dc6:$a11: KeyLoggerEventArgsEventHandler
0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c538:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b76a:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb9d:$a4: \Orbitum\User Data\Default\Login Data 0x1cbdc:$a5: \Kometa\User Data\Default\Login Data
0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15744:$s1: UnHook 0x1574b:$s2: SetHook 0x15753:$s3: CallNextHook 0x15760:$s4: _hook
0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b70:$x1: $%SMTPDV$ 0x18554:$x2: $#TheHashHere%& 0x19b18:$x3: %FTPDV$ 0x184f4:$x4: $%TelegramDv$ 0x15dc6:$x5: KeyLoggerEventArgs 0x1615b:$x5: KeyLoggerEventArgs 0x19b3c:$m2: Clipboard Logs ID 0x19d7a:$m2: Screenshot Logs ID 0x19e8a:$m2: keystroke Logs ID 0x1a164:$m3: SnakePW 0x19d52:$m4: \SnakeKeylogger\
0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b54:$a1: get_encryptedPassword 0x14e40:$a2: get_encryptedUsername 0x14960:$a3: get_timePasswordChanged 0x14a5b:$a4: get_passwordField 0x14b6a:$a5: set_encryptedPassword 0x161f8:$a7: get_logins 0x1615b:$a10: KeyLoggerEventArgs 0x15dc6:$a11: KeyLoggerEventArgsEventHandler
0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c538:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b76a:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb9d:$a4: \Orbitum\User Data\Default\Login Data 0x1cbdc:$a5: \Kometa\User Data\Default\Login Data
0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15744:$s1: UnHook 0x1574b:$s2: SetHook 0x15753:$s3: CallNextHook 0x15760:$s4: _hook
0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b70:$x1: $%SMTPDV$ 0x18554:$x2: $#TheHashHere%& 0x19b18:$x3: %FTPDV$ 0x184f4:$x4: $%TelegramDv$ 0x15dc6:$x5: KeyLoggerEventArgs 0x1615b:$x5: KeyLoggerEventArgs 0x19b3c:$m2: Clipboard Logs ID 0x19d7a:$m2: Screenshot Logs ID 0x19e8a:$m2: keystroke Logs ID 0x1a164:$m3: SnakePW 0x19d52:$m4: \SnakeKeylogger\
00000012.00000002.1651176289.0000000002941000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000B.00000002.1502078806.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: caulds.exe PID: 7396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: caulds.exe PID: 7396	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: caulds.exe PID: 7396	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x96d6e4:$a1: get_encryptedPassword 0x96d9c6:$a2: get_encryptedUsername 0x96d4fa:$a3: get_timePasswordChanged 0x96d5f5:$a4: get_passwordField 0x96d6fa:$a5: set_encryptedPassword 0x96fbd3:$a7: get_logins 0x96fb36:$a10: KeyLoggerEventArgs 0x96f7a1:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: caulds.exe PID: 7396	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x96f7a1:$x5: KeyLoggerEventArgs 0x96fb36:$x5: KeyLoggerEventArgs 0x97043d:$x5: KeyLoggerEventArgs 0x97079e:$x5: KeyLoggerEventArgs 0x971d61:$m2: Clipboard Logs ID 0x971e67:$m2: Screenshot Logs ID 0x971ebd:$m2: keystroke Logs ID 0x971ff2:$m3: SnakePW 0x971e53:$m4: \SnakeKeylogger\
Process Memory Space: RegSvcs.exe PID: 1824	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 1824	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 1824	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33a8:$a1: get_encryptedPassword 0x368a:$a2: get_encryptedUsername 0x31be:$a3: get_timePasswordChanged 0x32b9:$a4: get_passwordField 0x33be:$a5: set_encryptedPassword 0x5897:$a7: get_logins 0x57fa:$a10: KeyLoggerEventArgs 0x5465:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 1824	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5465:$x5: KeyLoggerEventArgs 0x57fa:$x5: KeyLoggerEventArgs 0x6101:$x5: KeyLoggerEventArgs 0x6462:$x5: KeyLoggerEventArgs 0x7a25:$m2: Clipboard Logs ID 0x7b2b:$m2: Screenshot Logs ID 0x7b81:$m2: keystroke Logs ID 0x7cb6:$m3: SnakePW 0x7b17:$m4: \SnakeKeylogger\
Process Memory Space: caulds.exe PID: 7480	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: caulds.exe PID: 7480	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: caulds.exe PID: 7480	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5a58fc:$a1: get_encryptedPassword 0x5a5bde:$a2: get_encryptedUsername 0x5a5712:$a3: get_timePasswordChanged 0x5a580d:$a4: get_passwordField 0x5a5912:$a5: set_encryptedPassword 0x5a7deb:$a7: get_logins 0x5a7d4e:$a10: KeyLoggerEventArgs 0x5a79b9:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: caulds.exe PID: 7480	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5a79b9:$x5: KeyLoggerEventArgs 0x5a7d4e:$x5: KeyLoggerEventArgs 0x5a8655:$x5: KeyLoggerEventArgs 0x5a89b6:$x5: KeyLoggerEventArgs 0x5a9f79:$m2: Clipboard Logs ID 0x5aa07f:$m2: Screenshot Logs ID 0x5aa0d5:$m2: keystroke Logs ID 0x5aa20a:$m3: SnakePW 0x5aa06b:$m4: \SnakeKeylogger\
Process Memory Space: RegSvcs.exe PID: 8128	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.caulds.exe.1360000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.caulds.exe.1360000.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
10.2.caulds.exe.1360000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12d54:$a1: get_encryptedPassword 0x13040:$a2: get_encryptedUsername 0x12b60:$a3: get_timePasswordChanged 0x12c5b:$a4: get_passwordField 0x12d6a:$a5: set_encryptedPassword 0x143f8:$a7: get_logins 0x1435b:$a10: KeyLoggerEventArgs 0x13fc6:$a11: KeyLoggerEventArgsEventHandler
10.2.caulds.exe.1360000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a738:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1996a:$a3: \Google\Chrome\User Data\Default\Login Data 0x19d9d:$a4: \Orbitum\User Data\Default\Login Data 0x1addc:$a5: \Kometa\User Data\Default\Login Data
10.2.caulds.exe.1360000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13944:$s1: UnHook 0x1394b:$s2: SetHook 0x13953:$s3: CallNextHook 0x13960:$s4: _hook
10.2.caulds.exe.1360000.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17d70:$x1: $%SMTPDV$ 0x16754:$x2: $#TheHashHere%& 0x17d18:$x3: %FTPDV$ 0x166f4:$x4: $%TelegramDv$ 0x13fc6:$x5: KeyLoggerEventArgs 0x1435b:$x5: KeyLoggerEventArgs 0x17d3c:$m2: Clipboard Logs ID 0x17f7a:$m2: Screenshot Logs ID 0x1808a:$m2: keystroke Logs ID 0x18364:$m3: SnakePW 0x17f52:$m4: \SnakeKeylogger\
14.2.caulds.exe.3bc0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.caulds.exe.3bc0000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.caulds.exe.3bc0000.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
14.2.caulds.exe.3bc0000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b54:$a1: get_encryptedPassword 0x14e40:$a2: get_encryptedUsername 0x14960:$a3: get_timePasswordChanged 0x14a5b:$a4: get_passwordField 0x14b6a:$a5: set_encryptedPassword 0x161f8:$a7: get_logins 0x1615b:$a10: KeyLoggerEventArgs 0x15dc6:$a11: KeyLoggerEventArgsEventHandler
14.2.caulds.exe.3bc0000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c538:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b76a:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb9d:$a4: \Orbitum\User Data\Default\Login Data 0x1cbdc:$a5: \Kometa\User Data\Default\Login Data
14.2.caulds.exe.3bc0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15744:$s1: UnHook 0x1574b:$s2: SetHook 0x15753:$s3: CallNextHook 0x15760:$s4: _hook
14.2.caulds.exe.3bc0000.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b70:$x1: $%SMTPDV$ 0x18554:$x2: $#TheHashHere%& 0x19b18:$x3: %FTPDV$ 0x184f4:$x4: $%TelegramDv$ 0x15dc6:$x5: KeyLoggerEventArgs 0x1615b:$x5: KeyLoggerEventArgs 0x19b3c:$m2: Clipboard Logs ID 0x19d7a:$m2: Screenshot Logs ID 0x19e8a:$m2: keystroke Logs ID 0x1a164:$m3: SnakePW 0x19d52:$m4: \SnakeKeylogger\
11.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
11.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
11.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b54:$a1: get_encryptedPassword 0x14e40:$a2: get_encryptedUsername 0x14960:$a3: get_timePasswordChanged 0x14a5b:$a4: get_passwordField 0x14b6a:$a5: set_encryptedPassword 0x161f8:$a7: get_logins 0x1615b:$a10: KeyLoggerEventArgs 0x15dc6:$a11: KeyLoggerEventArgsEventHandler
11.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c538:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b76a:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb9d:$a4: \Orbitum\User Data\Default\Login Data 0x1cbdc:$a5: \Kometa\User Data\Default\Login Data
11.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15744:$s1: UnHook 0x1574b:$s2: SetHook 0x15753:$s3: CallNextHook 0x15760:$s4: _hook
11.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b70:$x1: $%SMTPDV$ 0x18554:$x2: $#TheHashHere%& 0x19b18:$x3: %FTPDV$ 0x184f4:$x4: $%TelegramDv$ 0x15dc6:$x5: KeyLoggerEventArgs 0x1615b:$x5: KeyLoggerEventArgs 0x19b3c:$m2: Clipboard Logs ID 0x19d7a:$m2: Screenshot Logs ID 0x19e8a:$m2: keystroke Logs ID 0x1a164:$m3: SnakePW 0x19d52:$m4: \SnakeKeylogger\
14.2.caulds.exe.3bc0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.caulds.exe.3bc0000.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
14.2.caulds.exe.3bc0000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12d54:$a1: get_encryptedPassword 0x13040:$a2: get_encryptedUsername 0x12b60:$a3: get_timePasswordChanged 0x12c5b:$a4: get_passwordField 0x12d6a:$a5: set_encryptedPassword 0x143f8:$a7: get_logins 0x1435b:$a10: KeyLoggerEventArgs 0x13fc6:$a11: KeyLoggerEventArgsEventHandler
14.2.caulds.exe.3bc0000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a738:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1996a:$a3: \Google\Chrome\User Data\Default\Login Data 0x19d9d:$a4: \Orbitum\User Data\Default\Login Data 0x1addc:$a5: \Kometa\User Data\Default\Login Data
14.2.caulds.exe.3bc0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13944:$s1: UnHook 0x1394b:$s2: SetHook 0x13953:$s3: CallNextHook 0x13960:$s4: _hook
14.2.caulds.exe.3bc0000.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17d70:$x1: $%SMTPDV$ 0x16754:$x2: $#TheHashHere%& 0x17d18:$x3: %FTPDV$ 0x166f4:$x4: $%TelegramDv$ 0x13fc6:$x5: KeyLoggerEventArgs 0x1435b:$x5: KeyLoggerEventArgs 0x17d3c:$m2: Clipboard Logs ID 0x17f7a:$m2: Screenshot Logs ID 0x1808a:$m2: keystroke Logs ID 0x18364:$m3: SnakePW 0x17f52:$m4: \SnakeKeylogger\
10.2.caulds.exe.1360000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.caulds.exe.1360000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.caulds.exe.1360000.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
10.2.caulds.exe.1360000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b54:$a1: get_encryptedPassword 0x14e40:$a2: get_encryptedUsername 0x14960:$a3: get_timePasswordChanged 0x14a5b:$a4: get_passwordField 0x14b6a:$a5: set_encryptedPassword 0x161f8:$a7: get_logins 0x1615b:$a10: KeyLoggerEventArgs 0x15dc6:$a11: KeyLoggerEventArgsEventHandler
10.2.caulds.exe.1360000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c538:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b76a:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb9d:$a4: \Orbitum\User Data\Default\Login Data 0x1cbdc:$a5: \Kometa\User Data\Default\Login Data
10.2.caulds.exe.1360000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15744:$s1: UnHook 0x1574b:$s2: SetHook 0x15753:$s3: CallNextHook 0x15760:$s4: _hook
10.2.caulds.exe.1360000.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b70:$x1: $%SMTPDV$ 0x18554:$x2: $#TheHashHere%& 0x19b18:$x3: %FTPDV$ 0x184f4:$x4: $%TelegramDv$ 0x15dc6:$x5: KeyLoggerEventArgs 0x1615b:$x5: KeyLoggerEventArgs 0x19b3c:$m2: Clipboard Logs ID 0x19d7a:$m2: Screenshot Logs ID 0x19e8a:$m2: keystroke Logs ID 0x1a164:$m3: SnakePW 0x19d52:$m4: \SnakeKeylogger\
Click to see the 28 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs" , ProcessId: 6024, ProcessName: wscript.exe

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe" , ParentImage: C:\Users\user\AppData\Local\poufs\caulds.exe, ParentProcessId: 7396, ParentProcessName: caulds.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe" , ProcessId: 1824, ProcessName: RegSvcs.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs" , ProcessId: 6024, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\poufs\caulds.exe, ProcessId: 7396, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:37:29.085992+0100	2803305	3	Unknown Traffic	192.168.2.10	49766	104.21.64.1	443	TCP
2025-01-11T01:37:30.571070+0100	2803305	3	Unknown Traffic	192.168.2.10	49777	104.21.64.1	443	TCP
2025-01-11T01:37:32.138874+0100	2803305	3	Unknown Traffic	192.168.2.10	49789	104.21.64.1	443	TCP
2025-01-11T01:37:33.625908+0100	2803305	3	Unknown Traffic	192.168.2.10	49797	104.21.64.1	443	TCP
2025-01-11T01:37:35.068708+0100	2803305	3	Unknown Traffic	192.168.2.10	49811	104.21.64.1	443	TCP
2025-01-11T01:37:36.589745+0100	2803305	3	Unknown Traffic	192.168.2.10	49822	104.21.64.1	443	TCP
2025-01-11T01:37:43.730191+0100	2803305	3	Unknown Traffic	192.168.2.10	49864	104.21.64.1	443	TCP
2025-01-11T01:37:45.546352+0100	2803305	3	Unknown Traffic	192.168.2.10	49874	104.21.64.1	443	TCP
2025-01-11T01:37:50.879452+0100	2803305	3	Unknown Traffic	192.168.2.10	49907	104.21.64.1	443	TCP
2025-01-11T01:37:53.956541+0100	2803305	3	Unknown Traffic	192.168.2.10	49931	104.21.64.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:37:27.400991+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49750	132.226.8.169	80	TCP
2025-01-11T01:37:28.521750+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49750	132.226.8.169	80	TCP
2025-01-11T01:37:29.961947+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49771	132.226.8.169	80	TCP
2025-01-11T01:37:41.601938+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49847	132.226.8.169	80	TCP
2025-01-11T01:37:43.117648+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49847	132.226.8.169	80	TCP
2025-01-11T01:37:44.945694+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49868	132.226.8.169	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uVpytXGpQz.exe

Avira: detected

Found malware configuration

Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot1628099890:AAEoyPqXzUZV0NK78yRGbDMLJqRw0vcASbg/sendMessage?chat_id=1217600190", "Token": "1628099890:AAEoyPqXzUZV0NK78yRGbDMLJqRw0vcASbg", "Chat_id": "1217600190", "Version": "5.1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: uVpytXGpQz.exe	Virustotal: Detection: 71%			Perma Link
Source: uVpytXGpQz.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: uVpytXGpQz.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: uVpytXGpQz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49759 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49858 version: TLS 1.0

Source: uVpytXGpQz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: caulds.exe, 0000000A.00000003.1365281073.0000000003D50000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000A.00000003.1366935338.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000E.00000003.1510471767.0000000004240000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000E.00000003.1510798124.00000000040A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: caulds.exe, 0000000A.00000003.1365281073.0000000003D50000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000A.00000003.1366935338.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000E.00000003.1510471767.0000000004240000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000E.00000003.1510798124.00000000040A0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010445A GetFileAttributesW,FindFirstFileW,FindClose,	8_2_0010445A
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010C6D1 FindFirstFileW,FindClose,	8_2_0010C6D1
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_0010C75C
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0010EF95
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0010F0F2
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_0010F3F3
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_001037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_001037EF
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00103B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00103B12
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_0010BCBC
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF26B00 GetProcAddress,FindFirstFileA,CloseHandle,	9_2_00007FF68EF26B00
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF00520 GetWindowsDirectoryA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetCurrentProcessId,	9_2_00007FF68EF00520
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF32190 FindFirstFileA,FindClose,FindWindowA,	9_2_00007FF68EF32190
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF33F40 FindFirstFileA,FindClose,	9_2_00007FF68EF33F40
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058445A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_0058445A
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058C6D1 FindFirstFileW,FindClose,	10_2_0058C6D1
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_0058C75C
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0058EF95
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0058F0F2
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0058F3F3
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005837EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_005837EF
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00583B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00583B12
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0058BCBC

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49847 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49868 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49771 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49750 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49766 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49777 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49789 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49822 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49874 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49811 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49864 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49907 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49797 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49931 -> 104.21.64.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49759 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49858 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_001122EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

8_2_001122EE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: RegSvcs.exe, 0000000B.00000002.1502078806.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A09000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002AD2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A09000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.00000000029FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 0000000B.00000002.1500953164.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: caulds.exe, 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, caulds.exe, 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: RegSvcs.exe, 0000000B.00000002.1502078806.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 0000000B.00000002.1502078806.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A09000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: caulds.exe, 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, caulds.exe, 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_00114164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

8_2_00114164

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00114164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	8_2_00114164
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED7060 GlobalAlloc,GlobalLock,GlobalUnlock,SendMessageA,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,GlobalFree,SendMessageA,	9_2_00007FF68EED7060
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED85D0 WideCharToMultiByte,GlobalAlloc,GlobalAlloc,GlobalAlloc,GlobalLock,GlobalLock,WideCharToMultiByte,GlobalFree,GlobalFree,GlobalUnlock,GlobalFree,GlobalFree,WideCharToMultiByte,GlobalAlloc,GlobalLock,GlobalUnlock,GlobalUnlock,GlobalUnlock,GlobalUnlock,SendMessageA,OpenClipboard,EmptyClipboard,SetClipboardData,SetClipboardData,SetClipboardData,RegisterClipboardFormatA,SetClipboardData,CloseClipboard,SendMessageA,GlobalFree,GlobalFree,GlobalFree,	9_2_00007FF68EED85D0
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00594164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	10_2_00594164

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_00113F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

8_2_00113F66

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_0010001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

8_2_0010001C

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		8_2_0012CABC
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005ACABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		10_2_005ACABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: caulds.exe PID: 7396, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: caulds.exe PID: 7396, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 1824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 1824, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: caulds.exe PID: 7480, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: caulds.exe PID: 7480, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: This is a third-party compiled AutoIt script.	8_2_000A3B3A
Source: EmbeddedExe1.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: EmbeddedExe1.exe, 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2b9c9c5c-6
Source: EmbeddedExe1.exe, 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_e91fd963-2
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: This is a third-party compiled AutoIt script.	10_2_00523B3A
Source: caulds.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: caulds.exe, 0000000A.00000002.1369094437.00000000005D4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cac089a8-2
Source: caulds.exe, 0000000A.00000002.1369094437.00000000005D4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_d36b6742-e
Source: caulds.exe, 0000000E.00000002.1511434241.00000000005D4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_824d0294-3
Source: caulds.exe, 0000000E.00000002.1511434241.00000000005D4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_7b73c95c-6

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A3633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	8_2_000A3633
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	8_2_0012C1AC
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	8_2_0012C498
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C57D SendMessageW,NtdllDialogWndProc_W,	8_2_0012C57D
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	8_2_0012C5FE
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C860 NtdllDialogWndProc_W,	8_2_0012C860
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C88F NtdllDialogWndProc_W,	8_2_0012C88F
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C8BE NtdllDialogWndProc_W,	8_2_0012C8BE
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C909 NtdllDialogWndProc_W,	8_2_0012C909
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012C93E ClientToScreen,NtdllDialogWndProc_W,	8_2_0012C93E
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012CA7C GetWindowLongW,NtdllDialogWndProc_W,	8_2_0012CA7C
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	8_2_0012CABC
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A1287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74D2C8D0,NtdllDialogWndProc_W,	8_2_000A1287
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A1290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	8_2_000A1290
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012D3B8 NtdllDialogWndProc_W,	8_2_0012D3B8
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012D43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	8_2_0012D43E
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A167D NtdllDialogWndProc_W,	8_2_000A167D
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A16B5 NtdllDialogWndProc_W,	8_2_000A16B5
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A16DE GetParent,NtdllDialogWndProc_W,	8_2_000A16DE
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012D78C NtdllDialogWndProc_W,	8_2_0012D78C
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A189B NtdllDialogWndProc_W,	8_2_000A189B
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012BC5D NtdllDialogWndProc_W,CallWindowProcW,	8_2_0012BC5D
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012BF30 NtdllDialogWndProc_W,	8_2_0012BF30
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0012BF8C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	8_2_0012BF8C
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00523633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	10_2_00523633
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	10_2_005AC1AC
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	10_2_005AC498
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC57D SendMessageW,NtdllDialogWndProc_W,	10_2_005AC57D
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	10_2_005AC5FE
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC860 NtdllDialogWndProc_W,	10_2_005AC860
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC88F NtdllDialogWndProc_W,	10_2_005AC88F
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC8BE NtdllDialogWndProc_W,	10_2_005AC8BE
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC909 NtdllDialogWndProc_W,	10_2_005AC909
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AC93E ClientToScreen,NtdllDialogWndProc_W,	10_2_005AC93E
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005ACA7C GetWindowLongW,NtdllDialogWndProc_W,	10_2_005ACA7C
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005ACABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	10_2_005ACABC
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00521290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	10_2_00521290
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00521287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74D2C8D0,NtdllDialogWndProc_W,	10_2_00521287
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AD3B8 NtdllDialogWndProc_W,	10_2_005AD3B8
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AD43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	10_2_005AD43E
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0052167D NtdllDialogWndProc_W,	10_2_0052167D
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005216DE GetParent,NtdllDialogWndProc_W,	10_2_005216DE
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005216B5 NtdllDialogWndProc_W,	10_2_005216B5
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005AD78C NtdllDialogWndProc_W,	10_2_005AD78C
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0052189B NtdllDialogWndProc_W,	10_2_0052189B
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005ABC5D NtdllDialogWndProc_W,CallWindowProcW,	10_2_005ABC5D
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005ABF30 NtdllDialogWndProc_W,	10_2_005ABF30
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005ABF8C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	10_2_005ABF8C

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_0010A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

8_2_0010A1EF

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000F85B1 GetCurrentProcess,OpenProcessToken,CloseHandle,CreateProcessWithLogonW,

8_2_000F85B1

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_001051BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		8_2_001051BD
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005851BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		10_2_005851BD

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000AE6A0	8_2_000AE6A0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000CD975	8_2_000CD975
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000AFCE0	8_2_000AFCE0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000C21C5	8_2_000C21C5
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000D62D2	8_2_000D62D2
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_001203DA	8_2_001203DA
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000D242E	8_2_000D242E
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000C25FA	8_2_000C25FA
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000FE616	8_2_000FE616
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000B66E1	8_2_000B66E1
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000D878F	8_2_000D878F
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000B8808	8_2_000B8808
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00120857	8_2_00120857
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000D6844	8_2_000D6844
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00108889	8_2_00108889
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000CCB21	8_2_000CCB21
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000D6DB6	8_2_000D6DB6
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000B6F9E	8_2_000B6F9E
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000B3030	8_2_000B3030
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000C3187	8_2_000C3187
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000CF1D9	8_2_000CF1D9
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A1287	8_2_000A1287
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000C1484	8_2_000C1484
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000B5520	8_2_000B5520
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000C7696	8_2_000C7696
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000B5760	8_2_000B5760
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000C1978	8_2_000C1978
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000D9AB5	8_2_000D9AB5
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000C1D90	8_2_000C1D90
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000CBDA6	8_2_000CBDA6
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00127DDB	8_2_00127DDB
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000ADF00	8_2_000ADF00
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000B3FE0	8_2_000B3FE0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_012B6A28	8_2_012B6A28
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF6F7C	9_2_00007FF68EEF6F7C
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF0AEF4	9_2_00007FF68EF0AEF4
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF2C60	9_2_00007FF68EEF2C60
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF14B00	9_2_00007FF68EF14B00
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDCB24	9_2_00007FF68EEDCB24
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF65F0	9_2_00007FF68EEF65F0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF1BD50	9_2_00007FF68EF1BD50
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED53E3	9_2_00007FF68EED53E3
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF07010	9_2_00007FF68EF07010
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF49120	9_2_00007FF68EF49120
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF16F90	9_2_00007FF68EF16F90
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF46FE0	9_2_00007FF68EF46FE0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEFF060	9_2_00007FF68EEFF060
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF2B020	9_2_00007FF68EF2B020
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF92E80	9_2_00007FF68EF92E80
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEECDA0	9_2_00007FF68EEECDA0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFAAEC8	9_2_00007FF68EFAAEC8
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDED80	9_2_00007FF68EEDED80
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF50F20	9_2_00007FF68EF50F20
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4EE10	9_2_00007FF68EF4EE10
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF28E20	9_2_00007FF68EF28E20
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF90E18	9_2_00007FF68EF90E18
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF4C30	9_2_00007FF68EEF4C30
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF96CA4	9_2_00007FF68EF96CA4
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF8EB94	9_2_00007FF68EF8EB94
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF90C30	9_2_00007FF68EF90C30
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF90A48	9_2_00007FF68EF90A48
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF22A80	9_2_00007FF68EF22A80
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF52B10	9_2_00007FF68EF52B10
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE0B00	9_2_00007FF68EEE0B00
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEFAAF0	9_2_00007FF68EEFAAF0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4A9C0	9_2_00007FF68EF4A9C0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE4A80	9_2_00007FF68EEE4A80
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF16A00	9_2_00007FF68EF16A00
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF882D	9_2_00007FF68EEF882D
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF9085C	9_2_00007FF68EF9085C
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF98748	9_2_00007FF68EF98748
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF2E7D0	9_2_00007FF68EF2E7D0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF5A830	9_2_00007FF68EF5A830
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF90670	9_2_00007FF68EF90670
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFB8678	9_2_00007FF68EFB8678
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED85D0	9_2_00007FF68EED85D0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4E540	9_2_00007FF68EF4E540
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE2700	9_2_00007FF68EEE2700
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF46590	9_2_00007FF68EF46590
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEEA680	9_2_00007FF68EEEA680
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF8E5FC	9_2_00007FF68EF8E5FC
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF90484	9_2_00007FF68EF90484
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE6374	9_2_00007FF68EEE6374
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF5E3A0	9_2_00007FF68EF5E3A0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEFA440	9_2_00007FF68EEFA440
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF96144	9_2_00007FF68EF96144
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4E170	9_2_00007FF68EF4E170
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDA032	9_2_00007FF68EEDA032
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE4030	9_2_00007FF68EEE4030
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDA01E	9_2_00007FF68EEDA01E
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFB60D4	9_2_00007FF68EFB60D4
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED6080	9_2_00007FF68EED6080
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDA03E	9_2_00007FF68EEDA03E
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4FE60	9_2_00007FF68EF4FE60
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED9E00	9_2_00007FF68EED9E00
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF0FE90	9_2_00007FF68EF0FE90
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF23EA0	9_2_00007FF68EF23EA0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED7D50	9_2_00007FF68EED7D50
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED1EED	9_2_00007FF68EED1EED
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFADDF8	9_2_00007FF68EFADDF8
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4DE20	9_2_00007FF68EF4DE20
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF3C20	9_2_00007FF68EEF3C20
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF51CB0	9_2_00007FF68EF51CB0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF9BB90	9_2_00007FF68EF9BB90
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF17C30	9_2_00007FF68EF17C30
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF0DA70	9_2_00007FF68EF0DA70
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFB1A94	9_2_00007FF68EFB1A94
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDB9B0	9_2_00007FF68EEDB9B0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4BB20	9_2_00007FF68EF4BB20
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFAF964	9_2_00007FF68EFAF964
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF8F9DC	9_2_00007FF68EF8F9DC
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDD810	9_2_00007FF68EEDD810
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF9387C	9_2_00007FF68EF9387C
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFA5888	9_2_00007FF68EFA5888
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF158D0	9_2_00007FF68EF158D0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF01780	9_2_00007FF68EF01780
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED9920	9_2_00007FF68EED9920
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE5890	9_2_00007FF68EEE5890
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF9F804	9_2_00007FF68EF9F804
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF176A0	9_2_00007FF68EF176A0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF1560	9_2_00007FF68EEF1560
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF0F550	9_2_00007FF68EF0F550
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF3700	9_2_00007FF68EEF3700
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF515A0	9_2_00007FF68EF515A0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE3650	9_2_00007FF68EEE3650
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEF1560	9_2_00007FF68EEF1560
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED1426	9_2_00007FF68EED1426
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED7410	9_2_00007FF68EED7410
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF49480	9_2_00007FF68EF49480
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFA5490	9_2_00007FF68EFA5490
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED93C0	9_2_00007FF68EED93C0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF93384	9_2_00007FF68EF93384
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE4A80	9_2_00007FF68EEE4A80
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF5D410	9_2_00007FF68EF5D410
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF19430	9_2_00007FF68EF19430
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4D430	9_2_00007FF68EF4D430
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF0F260	9_2_00007FF68EF0F260
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED11BB	9_2_00007FF68EED11BB
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4D2D0	9_2_00007FF68EF4D2D0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF232EC	9_2_00007FF68EF232EC
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED1160	9_2_00007FF68EED1160
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEE1330	9_2_00007FF68EEE1330
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF0D150	9_2_00007FF68EF0D150
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF05310	9_2_00007FF68EF05310
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDD2D0	9_2_00007FF68EEDD2D0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFA51A8	9_2_00007FF68EFA51A8
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EEDF280	9_2_00007FF68EEDF280
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF4F230	9_2_00007FF68EF4F230
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0052E6A0	10_2_0052E6A0
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0054D975	10_2_0054D975
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0052FCE0	10_2_0052FCE0
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005421C5	10_2_005421C5
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005562D2	10_2_005562D2
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005A03DA	10_2_005A03DA
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0055242E	10_2_0055242E
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005425FA	10_2_005425FA
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0057E616	10_2_0057E616
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005366E1	10_2_005366E1
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0055878F	10_2_0055878F
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005A0857	10_2_005A0857
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00556844	10_2_00556844
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00538808	10_2_00538808
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00588889	10_2_00588889
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0054CB21	10_2_0054CB21
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00556DB6	10_2_00556DB6
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00536F9E	10_2_00536F9E
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00533030	10_2_00533030
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0054F1D9	10_2_0054F1D9
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00543187	10_2_00543187
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00521287	10_2_00521287
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00541484	10_2_00541484
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00535520	10_2_00535520
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00547696	10_2_00547696
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00535760	10_2_00535760
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00541978	10_2_00541978
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00559AB5	10_2_00559AB5
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005A7DDB	10_2_005A7DDB
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00541D90	10_2_00541D90
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0054BDA6	10_2_0054BDA6
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0052DF00	10_2_0052DF00
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00533FE0	10_2_00533FE0
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_013D7920	10_2_013D7920

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe E61B8F44AB92CF0F9CB1101347967D31E1839979142A4114A7DD02AA237BA021

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: String function: 000A7DE1 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: String function: 000C8900 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: String function: 000C0AE3 appears 70 times
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: String function: 00548900 appears 42 times
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: String function: 00540AE3 appears 70 times
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: String function: 00527DE1 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EFA2CE8 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF12890 appears 137 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF9FC60 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF26360 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF1A3A0 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF0CD00 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF4A5D0 appears 78 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF25360 appears 66 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF9B8AC appears 457 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EEFC110 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF0CC30 appears 150 times
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: String function: 00007FF68EF4BFC0 appears 36 times

Source: EmbeddedExe1.exe.5.dr	Static PE information: Resource name: RT_MENU type: DOS executable (COM)
Source: caulds.exe.8.dr	Static PE information: Resource name: RT_MENU type: DOS executable (COM)

Source: uVpytXGpQz.exe, 00000005.00000002.1288133549.000000001C190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs uVpytXGpQz.exe
Source: uVpytXGpQz.exe, 00000005.00000000.1274361864.0000000000EC2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamePURCHASE DOCUMENTS.exe4 vs uVpytXGpQz.exe
Source: uVpytXGpQz.exe, 00000005.00000002.1287330059.000000000312C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePuTTYd" vs uVpytXGpQz.exe
Source: uVpytXGpQz.exe, 00000005.00000000.1274134430.0000000000CA2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamePuTTYd" vs uVpytXGpQz.exe
Source: uVpytXGpQz.exe	Binary or memory string: OriginalFilenamePuTTYd" vs uVpytXGpQz.exe
Source: uVpytXGpQz.exe	Binary or memory string: OriginalFilenamePURCHASE DOCUMENTS.exe4 vs uVpytXGpQz.exe

Source: uVpytXGpQz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: caulds.exe PID: 7396, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: caulds.exe PID: 7396, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RegSvcs.exe PID: 1824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 1824, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: caulds.exe PID: 7480, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: caulds.exe PID: 7480, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@25/10@2/2

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_0010A06A GetLastError,FormatMessageW,

8_2_0010A06A

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000F81CB AdjustTokenPrivileges,CloseHandle,	8_2_000F81CB
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000F87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	8_2_000F87E1
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005781CB AdjustTokenPrivileges,CloseHandle,	10_2_005781CB
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005787E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	10_2_005787E1

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_0010B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

8_2_0010B333

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_0011EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

8_2_0011EE0D

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_0010C397 CoInitialize,CoCreateInstance,CoUninitialize,

8_2_0010C397

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000A4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

8_2_000A4E89

Source: C:\Users\user\Desktop\uVpytXGpQz.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uVpytXGpQz.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8032:120:WilError_03

Source: C:\Users\user\Desktop\uVpytXGpQz.exe

File created: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs"

Source: uVpytXGpQz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: uVpytXGpQz.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.55%

Source: C:\Users\user\Desktop\uVpytXGpQz.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\uVpytXGpQz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uVpytXGpQz.exe	Virustotal: Detection: 71%
Source: uVpytXGpQz.exe	ReversingLabs: Detection: 68%

Source: EmbeddedExe2.exe	String found in binary or memory: config-address-family
Source: EmbeddedExe2.exe	String found in binary or memory: config-ssh-portfwd-address-family
Source: EmbeddedExe2.exe	String found in binary or memory: config-serial-stopbits
Source: uVpytXGpQz.exe	String found in binary or memory: config-address-family
Source: uVpytXGpQz.exe	String found in binary or memory: config-ssh-portfwd-address-family
Source: uVpytXGpQz.exe	String found in binary or memory: [200~}\|\|{zconfig-proxyUnable to parse auth header from HTTP proxyConnection/Proxysshttypermit-ptyconfig-ssh-ptyServer refused to allocate ptyAllocated ptyReset scrollback on display activityidentityconfig-ssh-xauthorityPublic key of certification authoritySelect public key file of certification authorityconfig-serial-parityConfiguring %s paritySerialParityFontQualityValidityAddDllDirectoryOut of memoryCryptProtectMemoryUnable to load any WinSock libraryprimaryconfig-selection-autocopyMouseAutocopyconfig-rtfcopyWindow/Selection/Copy&CopyFlush log file frequentlyApplyReceived invalid elliptic curve point in ECDH replyReceived invalid elliptic curve point in GSSAPI ECDH replyconfig-altonlyKey file contains public key onlyUse font in OEM mode onlyAltOnlyForwarded port opened successfullyDisconnect if authentication succeeds triviallyconfig-address-familyconfig-ssh-portfwd-address-familyNetwork error: Address family not supported by protocol familyAddressFamilyForbid resizing completelyHandles SSH-2 key re-exchange badlyValid hosts this key is trusted to certifyModifyconfig-ssh-privkey-hostkeyconfig-telnetkeyconfig-ssh-kex-rekeyconfig-ssh-bug-rekeyGssapiRekeypublickeypubkeycert_ca_keyerrors-cant-load-keyputty-private-key-file-mac-keycross-certifying new host keyNoninteractive SSH proxy cannot confirm host keyNoninteractive SSH proxy cannot confirm weak cached host keyNo validity expression configured for this keyServer refused our keyuser authentication keyEncrypted session keyssh.com SSH-2 private keynot a PuTTY SSH-2 private keynot a public key or a PuTTY SSH-2 private keySSH-1 private keyAltGr acts as Compose keyunable to identify algorithm of base keyThe Backspace keyAdd keyFull text of host's public keyOffered public keySSH-1 public keyFingerprint of signing CA keyHostKeyTelnetKeyScrollOnKeyComposeKeyPublicKeySteadycleanup after downstream went awayDisable bidirectional text displayX authority file for local displayX11Displayconfig-nodelayTCPNoDelaypublic_affine_ypublic_yLinuxaux-demo-config-boxPuTTYConfigBoxunixdisplay name '%s' has no ':number' suffixgssapi-keyexLocal\putty-connshare-mutexNTRU Prime / Curve25519 hybrid kexServer's host key did not match any used in previous GSS kexConnection/SSH/Kexhhctrl.ocxprivate_xpublic_affine_xFlashWindowExToUnicodeExPageantRequest%08x%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x%s%02x\'%02x
Source: uVpytXGpQz.exe	String found in binary or memory: config-serial-stopbits
Source: uVpytXGpQz.exe	String found in binary or memory: source-address
Source: uVpytXGpQz.exe	String found in binary or memory: /config-address-family.html
Source: uVpytXGpQz.exe	String found in binary or memory: /config-serial-stopbits.html
Source: uVpytXGpQz.exe	String found in binary or memory: j'/config-ssh-portfwd-address-family.html
Source: uVpytXGpQz.exe	String found in binary or memory: /faq-startmax.html
Source: uVpytXGpQz.exe	String found in binary or memory: /faq-startsess.html
Source: uVpytXGpQz.exe	String found in binary or memory: /faq-startssh.html
Source: uVpytXGpQz.exe	String found in binary or memory: /feedback-address.html
Source: uVpytXGpQz.exe	String found in binary or memory: /pageant-mainwin-addkey.html
Source: uVpytXGpQz.exe	String found in binary or memory: /pageant-start.html
Source: uVpytXGpQz.exe	String found in binary or memory: /plink-starting.html
Source: uVpytXGpQz.exe	String found in binary or memory: /pscp-starting.html
Source: uVpytXGpQz.exe	String found in binary or memory: /psftp-cmd-help.html
Source: uVpytXGpQz.exe	String found in binary or memory: /psftp-starting.html

Source: unknown	Process created: C:\Users\user\Desktop\uVpytXGpQz.exe "C:\Users\user\Desktop\uVpytXGpQz.exe"
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process created: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process created: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe"
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Process created: C:\Users\user\AppData\Local\poufs\caulds.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\poufs\caulds.exe "C:\Users\user\AppData\Local\poufs\caulds.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\poufs\caulds.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process created: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process created: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Process created: C:\Users\user\AppData\Local\poufs\caulds.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\poufs\caulds.exe "C:\Users\user\AppData\Local\poufs\caulds.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\poufs\caulds.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\uVpytXGpQz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe

Window detected: Number of UI elements: 20

Source: uVpytXGpQz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: uVpytXGpQz.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: uVpytXGpQz.exe

Static file information: File size 2226176 > 1048576

Source: uVpytXGpQz.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x21ee00

Source: uVpytXGpQz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: caulds.exe, 0000000A.00000003.1365281073.0000000003D50000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000A.00000003.1366935338.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000E.00000003.1510471767.0000000004240000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000E.00000003.1510798124.00000000040A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: caulds.exe, 0000000A.00000003.1365281073.0000000003D50000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000A.00000003.1366935338.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000E.00000003.1510471767.0000000004240000.00000004.00001000.00020000.00000000.sdmp, caulds.exe, 0000000E.00000003.1510798124.00000000040A0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000A4B37 LoadLibraryA,GetProcAddress,

8_2_000A4B37

Source: EmbeddedExe2.exe.5.dr	Static PE information: section name: .00cfg
Source: EmbeddedExe2.exe.5.dr	Static PE information: section name: .gxfg
Source: EmbeddedExe2.exe.5.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Code function: 5_2_00007FF7C10500BD pushad ; iretd	5_2_00007FF7C10500C1
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000C8945 push ecx; ret	8_2_000C8958
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A2F12 push es; retf	8_2_000A2F13
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0052C4C6 push A30052BAh; retn 0052h	10_2_0052C50D
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00548945 push ecx; ret	10_2_00548958
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00522F12 push es; retf	10_2_00522F13

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	File created: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	File created: C:\Users\user\AppData\Local\poufs\caulds.exe	Jump to dropped file
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	File created: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\poufs\caulds.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\poufs\caulds.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\poufs\caulds.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000A48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	8_2_000A48D7
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00125376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	8_2_00125376
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED97B0 IsIconic,ShowWindow,	9_2_00007FF68EED97B0
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED9610 IsIconic,SetWindowTextW,SetWindowTextA,	9_2_00007FF68EED9610
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EED96E0 IsIconic,SetWindowTextW,SetWindowTextA,	9_2_00007FF68EED96E0
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005248D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	10_2_005248D7
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005A5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	10_2_005A5376

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000C3187 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_000C3187

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\poufs\caulds.exe	API/Special instruction interceptor: Address: 13D7544
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	API/Special instruction interceptor: Address: 1828874

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Memory allocated: 15F0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Memory allocated: 1B110000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000B8C74 sldt word ptr [eax]

8_2_000B8C74

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598959	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598352	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598032	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595986	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595591	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595455	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594013	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593903	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593793	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599296
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599077
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598705
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598419
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598296
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598187
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597417
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596105
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595996
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595852
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593890

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8738	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1092	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1476
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8365

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_8-103681

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	API coverage: 4.7 %
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	API coverage: 4.7 %
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	API coverage: 6.3 %

Source: C:\Users\user\Desktop\uVpytXGpQz.exe TID: 8108

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010445A GetFileAttributesW,FindFirstFileW,FindClose,	8_2_0010445A
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010C6D1 FindFirstFileW,FindClose,	8_2_0010C6D1
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_0010C75C
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0010EF95
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0010F0F2
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_0010F3F3
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_001037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_001037EF
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00103B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00103B12
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_0010BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_0010BCBC
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF26B00 GetProcAddress,FindFirstFileA,CloseHandle,	9_2_00007FF68EF26B00
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF00520 GetWindowsDirectoryA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetCurrentProcessId,	9_2_00007FF68EF00520
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF32190 FindFirstFileA,FindClose,FindWindowA,	9_2_00007FF68EF32190
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF33F40 FindFirstFileA,FindClose,	9_2_00007FF68EF33F40
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058445A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_0058445A
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058C6D1 FindFirstFileW,FindClose,	10_2_0058C6D1
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_0058C75C
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0058EF95
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0058F0F2
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0058F3F3
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_005837EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_005837EF
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00583B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00583B12
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0058BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0058BCBC

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000A49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_000A49A0

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598959	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598352	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598032	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595986	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595591	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595455	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594013	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593903	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593793	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599296
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599077
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598705
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598419
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598296
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598187
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597417
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596105
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595996
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595852
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593890

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Source: RegSvcs.exe, 0000000B.00000002.1504066969.0000000005FE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 0000000B.00000002.1500953164.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\
Source: RegSvcs.exe, 0000000B.00000002.1504066969.0000000005FE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Q
Source: wscript.exe, 0000000D.00000002.1458631804.00000183B2204000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: RegSvcs.exe, 00000012.00000002.1650169645.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: EmbeddedExe2.exe, 00000009.00000002.2540703006.000001D217445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	API call chain: ExitProcess graph end node	graph_8-101041
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	API call chain: ExitProcess graph end node	graph_8-102035
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_00113F09 BlockInput,

8_2_00113F09

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000A3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

8_2_000A3B3A

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000D5A7C RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

8_2_000D5A7C

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000A4B37 LoadLibraryA,GetProcAddress,

8_2_000A4B37

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_012B5248 mov eax, dword ptr fs:[00000030h]	8_2_012B5248
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_012B6918 mov eax, dword ptr fs:[00000030h]	8_2_012B6918
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_012B68B8 mov eax, dword ptr fs:[00000030h]	8_2_012B68B8
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_013D6140 mov eax, dword ptr fs:[00000030h]	10_2_013D6140
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_013D77B0 mov eax, dword ptr fs:[00000030h]	10_2_013D77B0
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_013D7810 mov eax, dword ptr fs:[00000030h]	10_2_013D7810

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000F80A9 GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,

8_2_000F80A9

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000CA124 SetUnhandledExceptionFilter,	8_2_000CA124
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000CA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_000CA155
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF8AC78 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF68EF8AC78
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EFA4664 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF68EFA4664
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0054A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0054A155
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_0054A124 SetUnhandledExceptionFilter,	10_2_0054A124

Source: C:\Users\user\Desktop\uVpytXGpQz.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 857008			Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 84E008			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000F87B1 LogonUserW,

8_2_000F87B1

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000A3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

8_2_000A3B3A

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000A48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

8_2_000A48D7

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_00104C27 mouse_event,

8_2_00104C27

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process created: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Process created: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\poufs\caulds.exe "C:\Users\user\AppData\Local\poufs\caulds.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\poufs\caulds.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000F7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

8_2_000F7CAF

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000F874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

8_2_000F874B

Source: EmbeddedExe1.exe, 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmp, caulds.exe, 0000000A.00000002.1369094437.00000000005D4000.00000040.00000001.01000000.00000009.sdmp, caulds.exe, 0000000E.00000002.1511434241.00000000005D4000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: EmbeddedExe1.exe, caulds.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000C862B cpuid

8_2_000C862B

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: MonitorFromWindow,GetMonitorInfoA,GetDesktopWindow,GetClientRect,CreateWindowExW,GetLastError,MonitorFromWindow,MonitorFromWindow,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetWindowRect,GetClientRect,SetWindowPos,CreateBitmap,CreateCaret,SetScrollInfo,GetDoubleClickTime,GetSystemMenu,CreatePopupMenu,AppendMenuA,AppendMenuA,AppendMenuA,CreateMenu,DeleteMenu,DeleteMenu,AppendMenuA,AppendMenuA,GetKeyboardLayout,GetLocaleInfoA,ShowWindow,SetForegroundWindow,GetForegroundWindow,UpdateWindow,MsgWaitForMultipleObjects,PeekMessageW,IsWindow,DispatchMessageW,IsDialogMessageA,PeekMessageA,GetForegroundWindow,MsgWaitForMultipleObjects,DispatchMessageW,PeekMessageW,IsWindow,IsDialogMessageA,	9_2_00007FF68EED53E3
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: EnumSystemLocalesW,	9_2_00007FF68EFA2EDC
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: GetLocaleInfoW,	9_2_00007FF68EFA23A8
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00007FF68EFA9FB8
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: GetLocaleInfoA,DefWindowProcW,	9_2_00007FF68EED1B9F
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: EnumSystemLocalesW,	9_2_00007FF68EFA9D30
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: EnumSystemLocalesW,	9_2_00007FF68EFA9A14
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00007FF68EFA9714

Source: C:\Users\user\Desktop\uVpytXGpQz.exe	Queries volume information: C:\Users\user\Desktop\uVpytXGpQz.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe

Code function: 9_2_00007FF68EF7B700 CreateNamedPipeA,CloseHandle,CreateNamedPipeA,ConnectNamedPipe,GetLastError,CloseHandle,GetLastError,

9_2_00007FF68EF7B700

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000D4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_000D4E87

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000E1E06 GetUserNameW,

8_2_000E1E06

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000D3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

8_2_000D3F3A

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Code function: 8_2_000A49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_000A49A0

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1651176289.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1502078806.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: caulds.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: caulds.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8128, type: MEMORYSTR

Source: caulds.exe	Binary or memory string: WIN_81
Source: caulds.exe	Binary or memory string: WIN_XP
Source: caulds.exe	Binary or memory string: WIN_XPe
Source: caulds.exe	Binary or memory string: WIN_VISTA
Source: caulds.exe	Binary or memory string: WIN_7
Source: caulds.exe	Binary or memory string: WIN_8
Source: caulds.exe, 0000000E.00000002.1511434241.00000000005D4000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: caulds.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: caulds.exe PID: 7480, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 10.2.caulds.exe.1360000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.caulds.exe.3bc0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.caulds.exe.3bc0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.caulds.exe.1360000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1651176289.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1502078806.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: caulds.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: caulds.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8128, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00116283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	8_2_00116283
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_00116747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	8_2_00116747
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	Code function: 8_2_000D7AA1 RpcBindingSetOption,_LocaleUpdate::_LocaleUpdate,_memset,WideCharToMultiByte,GetLastError,_memset,	8_2_000D7AA1
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF0FE90 socket,SetHandleInformation,setsockopt,getaddrinfo,htons,inet_addr,htonl,htonl,htons,bind,listen,closesocket,WSAGetLastError,closesocket,closesocket,WSAGetLastError,	9_2_00007FF68EF0FE90
Source: C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	Code function: 9_2_00007FF68EF0F930 closesocket,socket,SetHandleInformation,setsockopt,setsockopt,setsockopt,htonl,htons,bind,WSAGetLastError,WSAGetLastError,htons,htonl,htons,connect,WSAGetLastError,	9_2_00007FF68EF0F930
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00596283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	10_2_00596283
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00596747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	10_2_00596747
Source: C:\Users\user\AppData\Local\poufs\caulds.exe	Code function: 10_2_00557AA1 RpcBindingSetOption,_LocaleUpdate::_LocaleUpdate,_memset,WideCharToMultiByte,GetLastError,_memset,	10_2_00557AA1

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	3 Native API	111 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	2 Valid Accounts	21 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Software Packing	NTDS	136 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	213 Process Injection	1 DLL Side-Loading	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	213 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
uVpytXGpQz.exe	71%	Virustotal		Browse
uVpytXGpQz.exe	68%	ReversingLabs	Win32.Trojan.AutoitInject
uVpytXGpQz.exe	100%	Avira	TR/Dropper.Gen
uVpytXGpQz.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\poufs\caulds.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	63%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe	69%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\poufs\caulds.exe	63%	ReversingLabs	Win32.Trojan.AutoitInject

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.64.1	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
https://sectigo.com/CPS0	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
http://ocsp.sectigo.com0	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
https://www.chiark.greenend.org.uk/~sgtatham/putty/	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
http://checkip.dyndns.org/q	caulds.exe, 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, caulds.exe, 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 0000000B.00000002.1502078806.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A09000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002AD2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A09000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.00000000029FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 0000000B.00000002.1502078806.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A09000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002AF3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 0000000B.00000002.1502078806.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	uVpytXGpQz.exe, EmbeddedExe2.exe.5.dr	false	high
https://reallyfreegeoip.org/xml/	caulds.exe, 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.1502078806.0000000002ADE000.00000004.00000800.00020000.00000000.sdmp, caulds.exe, 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000012.00000002.1651176289.0000000002A09000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States		16989	UTMEMUS	false
104.21.64.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588380
Start date and time:	2025-01-11 01:36:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uVpytXGpQz.exe renamed because original name is a hash value
Original Sample Name:	539ee7af02fcbd28659831dd774581f76ee66ca6238d12af286158f2f343f3b8.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@25/10@2/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 61 Number of non-executed functions: 280
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target uVpytXGpQz.exe, PID 7948 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:37:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs
19:37:27	API Interceptor	174x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	UF7jzc7ETP.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
104.21.64.1	4sfN3Gx1vO.exe	Get hash	malicious	FormBook	Browse	www.vilakodsiy.sbs/w7eo/
	1162-201.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/utww/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	ordrr.statementquo.com/QCbxA/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	adsfirm.com/administrator/index.php
	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.bser101pp.buzz/v89f/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
checkip.dyndns.com	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	4AMVusDMPP.exe	Get hash	malicious	GuLoader	Browse	193.122.130.0
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UTMEMUS	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	H75MnQEha8.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
CLOUDFLARENETUS	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	BcF3o0Egke.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe	8kDIr4ZdNj.exe	Get hash	malicious	Snake Keylogger	Browse
	filepdf.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse
	Invoice-UPS-218931.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uVpytXGpQz.exe.log

Download File

Process:	C:\Users\user\Desktop\uVpytXGpQz.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.355760272568367
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2FDkwIyp1v:Q3La/KDLI4MWuPXcp1v
MD5:	FC3575D5BE1A5405683DC33B66D36243
SHA1:	1C816D34B7D5B96E077DC3EF640BA8C7BA370502
SHA-256:	1D7F7FBA862417A1D0351C1BF454F1A9BB0ED7FFD5DF1112EED802C01BDDA50C
SHA-512:	68914FE00F8550A623074F9ACC31ACEF8A3F6DFDDBD9FDA23512079BEC5E8A4D4E82BC8CD8D536E6C88F4DA3A704AC376785B44343BD3BED83E440857A3C0164
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.353332853270839
Encrypted:	false
SSDEEP:	24:ML9E4KiE4Ko84qXKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKiHKoviYHKh3oPtHo6hAHKzeR
MD5:	A4AF0F36EC4E0C69DC0F860C891E8BBE
SHA1:	28DD81A1EDDF71CBCBF86DA986E047279EF097CD
SHA-256:	B038D4342E4DD96217BD90CFE32581FCCB381C5C2E6FF257CD32854F840D1FDE
SHA-512:	A675D3E9DB5BDD325A22E82C6BCDBD5409D7A34453DAAEB0E37206BE982C388547E1BDF22DC70393C69D0CE55635E2364502572C3AD2E6753A56A5C3893F6D69
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e

C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

Download File

Process:	C:\Users\user\Desktop\uVpytXGpQz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	558080
Entropy (8bit):	7.925927380448633
Encrypted:	false
SSDEEP:	12288:NquErHF6xC9D6DmR1J98w4oknqOOCyQfZYQignEMlsFqqYJiWn1:wrl6kD68JmlotQfZsgnEHPWn1
MD5:	47310E2D76477F79641F8703027A60B0
SHA1:	BBA7157BFAB11D11B6912CB0012E117DE61D175A
SHA-256:	54F08D458C3A9B5B6553E6BC6810FD9071D7BC2A517576D4DCC45B1CA0A47D1F
SHA-512:	CCF55E9915002E828FEEC50C58EC1CCAC378C0B1A1E081E5B2E542457FF4A2866AEBAEEEB40BFE6188938B4E1DC0BC1C770E33A012752D28429F8B14ED7FB7F7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L....BRg.........."......`...0...@......P........@.......................................@...@.......@.........................$.......................................................................H...........................................UPX0.....@..............................UPX1.....`...P...\..................@....rsrc....0.......$...`..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe

Download File

Process:	C:\Users\user\Desktop\uVpytXGpQz.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1663264
Entropy (8bit):	6.929148215184974
Encrypted:	false
SSDEEP:	49152:Plp9tHfYoEaTSiz23THT3WSMpDgF/qB0Rj6KIeVSc/zui+:PX/LEQkF/qBk6K2c/ii+
MD5:	5EFEF6CC9CD24BAEEED71C1107FC32DF
SHA1:	3CFC9764083154F682A38831C8229E3E29CBE3EF
SHA-256:	E61B8F44AB92CF0F9CB1101347967D31E1839979142A4114A7DD02AA237BA021
SHA-512:	CECD98F0E238D7387B44838251B795BB95E85EC8D35242FC24532BA21929759685205133923268BF8BC0E2DED37DB7D88ECBE2B692D2BE6F09C6D92A57D1FDAC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 8kDIr4ZdNj.exe, Detection: malicious, Browse Filename: filepdf.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: Invoice-UPS-218931.pdf.lnk.mal.lnk, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."............................@....................................q ....`..................................................H..........@.......8m...... W...................................=..(...0...@............S...............................text...V........................... ..`.rdata..\...........................@..@.data....U..........................@....pdata..8m.......n..................@..@.00cfg..8...........................@..@.gxfg...`*.......,..................@..@.tls.................:..............@..._RDATA..\............<..............@..@.rsrc...@............>..............@..@.reloc........... ..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut7F73.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe
File Type:	data
Category:	dropped
Size (bytes):	97080
Entropy (8bit):	7.921976746904169
Encrypted:	false
SSDEEP:	1536:qKOEpOdu51DV1PSJrkdk3deVbNGYUAfi1+oxkUCjoitAp5+7Qatw:qKxpOdu51DVZQrkWdcb59fiTxkFstp0+
MD5:	0A1DC59B5A2342A040748B933B272286
SHA1:	FD66081CE948153DD63855B828CB2CF29E458C13
SHA-256:	4DF324595FE5DBDE0BD08A591D4CFC8B09EF04A017CAF85A303B7A61C9F30C21
SHA-512:	38F4ADC2ED72ADF1A95F9B4E3A4444B954A2429B86CD0B516A70756F0B9473312480651B3BEA067C05C09A0F0FBCCABA6898FD2E1658D4EE563CB8C31F75696B
Malicious:	false
Preview:	EA06.....C44y.J.E.ShU.~.E.L)....7.Th.i..r.4T....".E...f..5....^...u.%..{../y..F}X.FdSYT..#..%rI\..9.NV.,..e......R.?.I...-".t.N..)E._h..z...4k[J.M..h.F...Q.4`.,[..z-B .hE...D..1..A.z.6..i.H...:<..i.."...L+....i..5p..T.4;..T0....E..k.._4.wR...}.._e..."..r...Ta....O$.. .....&.+......h@....S.\..5..............`.....T!...."......,...=..s..."......X...'..J.E.[.u.F.E......6c..Q. ...k.V.q..kg./G..k.....C.N..5;.4/..DH.....P.Bn.4]...x.q9.4$.....8......BT.hU...`..N.[l.....\|....:...1...6P...[.R(3k..@.Mi.z...V..w5.-.}g.T(\Z...9.M..R.V..lu&.K.V.r{...:..t.\.J..&4X..!X../..^.V.Sj7..6k...6..j.R..5.E>cY.Si....A{..#09.J.o.L...e..z.L.u..&9R....:<.l..-..H..n.F..Jt.3..m..[R..@..x....X.S......R..+.....T.R......N..j....A......QE...{.j..DUh..sX......I....t....T....=.Dh.....p.....].....U.-.^..=.S..Qh}.u6.^.....}B...T(...6.^.S'........4z%..3...z-J.@.V...mD....S.......@.....z.Qh.:l..Z...5*..W_...[.}.O;.Qh7..>c.....D...{%bW...#t...kN.v.......ZkW.U..-.N6......['7

C:\Users\user\AppData\Local\Temp\aut907B.tmp

Download File

Process:	C:\Users\user\AppData\Local\poufs\caulds.exe
File Type:	data
Category:	dropped
Size (bytes):	97080
Entropy (8bit):	7.921976746904169
Encrypted:	false
SSDEEP:	1536:qKOEpOdu51DV1PSJrkdk3deVbNGYUAfi1+oxkUCjoitAp5+7Qatw:qKxpOdu51DVZQrkWdcb59fiTxkFstp0+
MD5:	0A1DC59B5A2342A040748B933B272286
SHA1:	FD66081CE948153DD63855B828CB2CF29E458C13
SHA-256:	4DF324595FE5DBDE0BD08A591D4CFC8B09EF04A017CAF85A303B7A61C9F30C21
SHA-512:	38F4ADC2ED72ADF1A95F9B4E3A4444B954A2429B86CD0B516A70756F0B9473312480651B3BEA067C05C09A0F0FBCCABA6898FD2E1658D4EE563CB8C31F75696B
Malicious:	false
Preview:	EA06.....C44y.J.E.ShU.~.E.L)....7.Th.i..r.4T....".E...f..5....^...u.%..{../y..F}X.FdSYT..#..%rI\..9.NV.,..e......R.?.I...-".t.N..)E._h..z...4k[J.M..h.F...Q.4`.,[..z-B .hE...D..1..A.z.6..i.H...:<..i.."...L+....i..5p..T.4;..T0....E..k.._4.wR...}.._e..."..r...Ta....O$.. .....&.+......h@....S.\..5..............`.....T!...."......,...=..s..."......X...'..J.E.[.u.F.E......6c..Q. ...k.V.q..kg./G..k.....C.N..5;.4/..DH.....P.Bn.4]...x.q9.4$.....8......BT.hU...`..N.[l.....\|....:...1...6P...[.R(3k..@.Mi.z...V..w5.-.}g.T(\Z...9.M..R.V..lu&.K.V.r{...:..t.\.J..&4X..!X../..^.V.Sj7..6k...6..j.R..5.E>cY.Si....A{..#09.J.o.L...e..z.L.u..&9R....:<.l..-..H..n.F..Jt.3..m..[R..@..x....X.S......R..+.....T.R......N..j....A......QE...{.j..DUh..sX......I....t....T....=.Dh.....p.....].....U.-.^..=.S..Qh}.u6.^.....}B...T(...6.^.S'........4z%..3...z-J.@.V...mD....S.......@.....z.Qh.:l..Z...5*..W_...[.}.O;.Qh7..>c.....D...{%bW...#t...kN.v.......ZkW.U..-.N6......['7

C:\Users\user\AppData\Local\Temp\autC3B0.tmp

Download File

Process:	C:\Users\user\AppData\Local\poufs\caulds.exe
File Type:	data
Category:	dropped
Size (bytes):	97080
Entropy (8bit):	7.921976746904169
Encrypted:	false
SSDEEP:	1536:qKOEpOdu51DV1PSJrkdk3deVbNGYUAfi1+oxkUCjoitAp5+7Qatw:qKxpOdu51DVZQrkWdcb59fiTxkFstp0+
MD5:	0A1DC59B5A2342A040748B933B272286
SHA1:	FD66081CE948153DD63855B828CB2CF29E458C13
SHA-256:	4DF324595FE5DBDE0BD08A591D4CFC8B09EF04A017CAF85A303B7A61C9F30C21
SHA-512:	38F4ADC2ED72ADF1A95F9B4E3A4444B954A2429B86CD0B516A70756F0B9473312480651B3BEA067C05C09A0F0FBCCABA6898FD2E1658D4EE563CB8C31F75696B
Malicious:	false
Preview:	EA06.....C44y.J.E.ShU.~.E.L)....7.Th.i..r.4T....".E...f..5....^...u.%..{../y..F}X.FdSYT..#..%rI\..9.NV.,..e......R.?.I...-".t.N..)E._h..z...4k[J.M..h.F...Q.4`.,[..z-B .hE...D..1..A.z.6..i.H...:<..i.."...L+....i..5p..T.4;..T0....E..k.._4.wR...}.._e..."..r...Ta....O$.. .....&.+......h@....S.\..5..............`.....T!...."......,...=..s..."......X...'..J.E.[.u.F.E......6c..Q. ...k.V.q..kg./G..k.....C.N..5;.4/..DH.....P.Bn.4]...x.q9.4$.....8......BT.hU...`..N.[l.....\|....:...1...6P...[.R(3k..@.Mi.z...V..w5.-.}g.T(\Z...9.M..R.V..lu&.K.V.r{...:..t.\.J..&4X..!X../..^.V.Sj7..6k...6..j.R..5.E>cY.Si....A{..#09.J.o.L...e..z.L.u..&9R....:<.l..-..H..n.F..Jt.3..m..[R..@..x....X.S......R..+.....T.R......N..j....A......QE...{.j..DUh..sX......I....t....T....=.Dh.....p.....].....U.-.^..=.S..Qh}.u6.^.....}B...T(...6.^.S'........4z%..3...z-J.@.V...mD....S.......@.....z.Qh.:l..Z...5*..W_...[.}.O;.Qh7..>c.....D...{%bW...#t...kN.v.......ZkW.U..-.N6......['7

C:\Users\user\AppData\Local\Temp\vitraillist

Download File

Process:	C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe
File Type:	data
Category:	dropped
Size (bytes):	134144
Entropy (8bit):	6.940368794964889
Encrypted:	false
SSDEEP:	3072:R6qFC6I+GxZJ1DZ9cW6nwKvwA8gxzWbooBwmhicFsQIwyna8WomTk:1FJI+GxHK4ADe0mhicFYwynxWzk
MD5:	674D3B46E4B1C0960A436E5B4B3F50DC
SHA1:	D872AFD8AC737F8B79223C0E6E933BB588F86880
SHA-256:	224B7426C2FF4C7DA5EA10B3DE8D5319CB8F5C5B8A0D6CF7138BAF11581A0FD0
SHA-512:	8AAA777C4EFA4FFD0935335E0F7E11CC8A004846B1B625FD1ACC0A8FE52D3718144437F9744DEC2A78CF305295B2106BE515CB24C3B4A6CBD8C1815E178B84A9
Malicious:	false
Preview:	...G:RGEVMBZ..EE.0MJZ7M7.QEV1G9RGERMBZPHEEP0MJZ7M7RQEV1G9RGE.MBZ^W.KP.D.{.L{.p.>X4."55?#7p+$+>_9j8RmE'?e?_g}..e?"&?~EHOt0MJZ7M7..EV}F:R.h.+BZPHEEP0.JX6F6.QE.0G9FGERMBZn\GEP.MJZ.O7RQ.V1g9RGGRMFZPHEEP0IJZ7M7RQE63G9PGERMBZRH..P0]JZ'M7RQUV1W9RGERMRZPHEEP0MJZ7.$PQ.V1G9rEE9]BZPHEEP0MJZ7M7RQEV1.;RKERMBZPHEEP0MJZ7M7RQEV1G9RGERMBZPHEEP0MJZ7M7RQEV1G9RGeRMJZPHEEP0MJZ7E.RQ.V1G9RGERMBZ~< =$0MJ..L7RqEV1.8RGGRMBZPHEEP0MJZ7m7R1k$B5ZRGE9]BZPhGEP"MJZ.L7RQEV1G9RGERM.ZP.k75\")Z7A7RQE.3G9PGERG@ZPHEEP0MJZ7M7.QE.1G9RGERMBZPHEEP0m^X7M7RQ.V1G;RBE.oCZ..EES0MJ.7M1.pDV.G9RGERMBZPHEEP0MJZ7M7RQEV1G9RGERMBZPHEEP0MJ.J.8..?B..RGERMB[RKACX8MJZ7M7RQ;V1G.RGE.MBZgHEEu0MJ77M7vQEVOG9R9ERM&ZPH7EP0,JZ7.7RQV1GWRGE,MBZNJmeP0G`\|7O.sQE\1m.!eERG.[PHA6s0M@.5M7V"aV1M.QGEV>gZPB.AP0I9\|7M=.TEV5mcRD.DKBZK'\|EP:MI."K7RJop1E.hGEXMh\|PK.PV0MQp.M5.XEV5mo!ZERKj.PHO1Y0MH.=M7V{[T..9RMop3RZPLnEz.3[Z7I.R{g(#G9VlExo<IPHAnP.o4N7M3yQoH3.-RGAxo<OPHAnP.o4L7M3yQotOP9RCnRg\X._EET.K`87?.NQ5U^.9RAm.MBPx(EEV0gpZIm7RUG9.G9Xao.M@rTIEOP2N7l7M3PU8a1G=x.EP6{Z

C:\Users\user\AppData\Local\poufs\caulds.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	558080
Entropy (8bit):	7.925927380448633
Encrypted:	false
SSDEEP:	12288:NquErHF6xC9D6DmR1J98w4oknqOOCyQfZYQignEMlsFqqYJiWn1:wrl6kD68JmlotQfZsgnEHPWn1
MD5:	47310E2D76477F79641F8703027A60B0
SHA1:	BBA7157BFAB11D11B6912CB0012E117DE61D175A
SHA-256:	54F08D458C3A9B5B6553E6BC6810FD9071D7BC2A517576D4DCC45B1CA0A47D1F
SHA-512:	CCF55E9915002E828FEEC50C58EC1CCAC378C0B1A1E081E5B2E542457FF4A2866AEBAEEEB40BFE6188938B4E1DC0BC1C770E33A012752D28429F8B14ED7FB7F7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L....BRg.........."......`...0...@......P........@.......................................@...@.......@.........................$.......................................................................H...........................................UPX0.....@..............................UPX1.....`...P...\..................@....rsrc....0.......$...`..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs

Download File

Process:	C:\Users\user\AppData\Local\poufs\caulds.exe
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4381719499824994
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclq7UEZ+lX1ylG0c6nriIM8lfQVn:DsO+vNlq7Q1yMgmA2n
MD5:	FBF772BA54447C20E1EDC588014BA01A
SHA1:	FBE1552E80E532FD224C7020EDD8782D70202F70
SHA-256:	AEC63B0D54E4A2E4CC674C13B2EDE5BC360D8F5CCEDF73A4CD1F07F06F1EBA53
SHA-512:	D52DF4994F44CFC7DE6BB5B92FB42BCE60B4D850AA1CF26499C41CFE11E9B10DD2D4C186FDCD17E12DB0D10B46A91D3E26E795E52D79AE1D627B83F868095256
Malicious:	true
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.b.r.o.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.o.u.f.s.\.c.a.u.l.d.s...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.2615368179706286
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.55% Win32 Executable (generic) a (10002005/4) 49.50% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% InstallShield setup (43055/19) 0.21% UPX compressed Win32 Executable (30571/9) 0.15%
File name:	uVpytXGpQz.exe
File size:	2'226'176 bytes
MD5:	022dbaa1df24d488b03ecb058a521613
SHA1:	9f12948c741b6b27cce58d4cd804a2f988feddf2
SHA256:	539ee7af02fcbd28659831dd774581f76ee66ca6238d12af286158f2f343f3b8
SHA512:	1d23c5d6a8b384e2c746865da221a14d6cb7f9260597c4785ae527798e9215027bbc089b5214389ff2bbae180ba6cbec547df6c5d901ff6a56d2fb4909e50880
SSDEEP:	49152:0l328U2yfZrnJhlp9tHfYoEaTSiz23THT3WSMpDgF/qB0Rj6KIeVSc/zui:a30DfJJhX/LEQkF/qBk6K2c/ii
TLSH:	9FA5D017B29610EDC06EC178C7665111E971BC844B347AEF17A8A7292E32FD06F3EB25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....FRg..................!...........".. ... "...@.. .......................`"...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x620cce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67524615 [Fri Dec 6 00:32:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x220c74	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x222000	0x508	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x224000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x21ecd4	0x21ee00	451a3e2fcacc1a9b64dd5add0f9c87f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x222000	0x508	0x600	bea7b72de652d7e331682b7b576aeb24	False	0.3828125	data	3.83647344143046	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x224000	0xc	0x200	5a45e9b8d243ec56409efd7cd29cb872	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2220a0	0x274	data			0.4570063694267516
RT_MANIFEST	0x222318	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:37:27.400991+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49750	132.226.8.169	80	TCP
2025-01-11T01:37:28.521750+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49750	132.226.8.169	80	TCP
2025-01-11T01:37:29.085992+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49766	104.21.64.1	443	TCP
2025-01-11T01:37:29.961947+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49771	132.226.8.169	80	TCP
2025-01-11T01:37:30.571070+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49777	104.21.64.1	443	TCP
2025-01-11T01:37:32.138874+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49789	104.21.64.1	443	TCP
2025-01-11T01:37:33.625908+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49797	104.21.64.1	443	TCP
2025-01-11T01:37:35.068708+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49811	104.21.64.1	443	TCP
2025-01-11T01:37:36.589745+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49822	104.21.64.1	443	TCP
2025-01-11T01:37:41.601938+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49847	132.226.8.169	80	TCP
2025-01-11T01:37:43.117648+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49847	132.226.8.169	80	TCP
2025-01-11T01:37:43.730191+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49864	104.21.64.1	443	TCP
2025-01-11T01:37:44.945694+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49868	132.226.8.169	80	TCP
2025-01-11T01:37:45.546352+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49874	104.21.64.1	443	TCP
2025-01-11T01:37:50.879452+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49907	104.21.64.1	443	TCP
2025-01-11T01:37:53.956541+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49931	104.21.64.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:37:26.183254004 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:26.188110113 CET	80	49750	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:26.188179970 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:26.188513041 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:26.193253994 CET	80	49750	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:27.037596941 CET	80	49750	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:27.044996023 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:27.049762964 CET	80	49750	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:27.348889112 CET	80	49750	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:27.400990963 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:27.464236021 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:27.464255095 CET	443	49759	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:27.464308977 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:27.469645023 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:27.469659090 CET	443	49759	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:27.949354887 CET	443	49759	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:27.949451923 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:27.954375029 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:27.954386950 CET	443	49759	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:27.954694033 CET	443	49759	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:28.008152008 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:28.019013882 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:28.059340954 CET	443	49759	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:28.150975943 CET	443	49759	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:28.151031017 CET	443	49759	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:28.151077032 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:28.158313990 CET	49759	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:28.162542105 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:28.167345047 CET	80	49750	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:28.465300083 CET	80	49750	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:28.468472958 CET	49766	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:28.468512058 CET	443	49766	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:28.468565941 CET	49766	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:28.469039917 CET	49766	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:28.469054937 CET	443	49766	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:28.521749973 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:28.944752932 CET	443	49766	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:28.947272062 CET	49766	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:28.947283983 CET	443	49766	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:29.086080074 CET	443	49766	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:29.086153030 CET	443	49766	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:29.086200953 CET	49766	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:29.086815119 CET	49766	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:29.090120077 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:29.091523886 CET	49771	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:29.095079899 CET	80	49750	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:29.095180988 CET	49750	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:29.096303940 CET	80	49771	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:29.096452951 CET	49771	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:29.096544027 CET	49771	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:29.101316929 CET	80	49771	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:29.912506104 CET	80	49771	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:29.933173895 CET	49777	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:29.933207989 CET	443	49777	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:29.940937996 CET	49777	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:29.940937996 CET	49777	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:29.940964937 CET	443	49777	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:29.961946964 CET	49771	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:30.420443058 CET	443	49777	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:30.422291040 CET	49777	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:30.422308922 CET	443	49777	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:30.571093082 CET	443	49777	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:30.571187019 CET	443	49777	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:30.571233034 CET	49777	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:30.571607113 CET	49777	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:30.576597929 CET	49781	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:30.581401110 CET	80	49781	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:30.581475019 CET	49781	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:30.581552982 CET	49781	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:30.586253881 CET	80	49781	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:31.546086073 CET	80	49781	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:31.548388004 CET	49789	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:31.548432112 CET	443	49789	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:31.551152945 CET	49789	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:31.551368952 CET	49789	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:31.551378965 CET	443	49789	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:31.587353945 CET	49781	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:32.007998943 CET	443	49789	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:32.009777069 CET	49789	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:32.009797096 CET	443	49789	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:32.138900995 CET	443	49789	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:32.138959885 CET	443	49789	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:32.139489889 CET	49789	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:32.139489889 CET	49789	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:32.142463923 CET	49781	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:32.143522024 CET	49794	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:32.147479057 CET	80	49781	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:32.147645950 CET	49781	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:32.148399115 CET	80	49794	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:32.148559093 CET	49794	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:32.148559093 CET	49794	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:32.153465033 CET	80	49794	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:32.983073950 CET	80	49794	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:32.987241030 CET	49797	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:32.987274885 CET	443	49797	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:32.987346888 CET	49797	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:32.987881899 CET	49797	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:32.987895966 CET	443	49797	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:33.023771048 CET	49794	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:33.468548059 CET	443	49797	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:33.470472097 CET	49797	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:33.470504045 CET	443	49797	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:33.626004934 CET	443	49797	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:33.626169920 CET	443	49797	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:33.626234055 CET	49797	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:33.626789093 CET	49797	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:33.630466938 CET	49794	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:33.631660938 CET	49804	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:33.636864901 CET	80	49794	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:33.636919022 CET	49794	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:33.637725115 CET	80	49804	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:33.637799978 CET	49804	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:33.637880087 CET	49804	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:33.642637014 CET	80	49804	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:34.466528893 CET	80	49804	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:34.468240023 CET	49811	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:34.468286991 CET	443	49811	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:34.468359947 CET	49811	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:34.468724966 CET	49811	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:34.468736887 CET	443	49811	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:34.508203983 CET	49804	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:34.924271107 CET	443	49811	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:34.933340073 CET	49811	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:34.933357000 CET	443	49811	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:35.068716049 CET	443	49811	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:35.068783998 CET	443	49811	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:35.069020987 CET	49811	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:35.069346905 CET	49811	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:35.081798077 CET	49804	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:35.082753897 CET	49817	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:35.086811066 CET	80	49804	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:35.086905956 CET	49804	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:35.087605000 CET	80	49817	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:35.087763071 CET	49817	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:35.087902069 CET	49817	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:35.092757940 CET	80	49817	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:35.935523987 CET	80	49817	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:35.952965021 CET	49822	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:35.953010082 CET	443	49822	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:35.953355074 CET	49822	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:35.953355074 CET	49822	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:35.953397989 CET	443	49822	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:35.992569923 CET	49817	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:36.430030107 CET	443	49822	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:36.439883947 CET	49822	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:36.439907074 CET	443	49822	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:36.589730024 CET	443	49822	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:36.589843035 CET	443	49822	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:36.589885950 CET	49822	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:36.590462923 CET	49822	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:36.595714092 CET	49817	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:36.596806049 CET	49827	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:36.600692987 CET	80	49817	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:36.600761890 CET	49817	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:36.601701975 CET	80	49827	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:36.602073908 CET	49827	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:36.602184057 CET	49827	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:36.606930971 CET	80	49827	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:37.419583082 CET	80	49827	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:37.421188116 CET	49832	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:37.421258926 CET	443	49832	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:37.421348095 CET	49832	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:37.421675920 CET	49832	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:37.421695948 CET	443	49832	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:37.465893030 CET	49827	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:37.878113985 CET	443	49832	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:37.879720926 CET	49832	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:37.879753113 CET	443	49832	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:38.027466059 CET	443	49832	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:38.027534008 CET	443	49832	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:38.027777910 CET	49832	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:38.028122902 CET	49832	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:38.358845949 CET	49771	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:38.358918905 CET	49827	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:40.428220987 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:40.433305979 CET	80	49847	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:40.433386087 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:40.433660030 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:40.438466072 CET	80	49847	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:41.265412092 CET	80	49847	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:41.272036076 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:41.277009964 CET	80	49847	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:41.549546957 CET	80	49847	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:41.601938009 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:41.789104939 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:41.789145947 CET	443	49858	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:41.789213896 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:41.794604063 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:41.794636011 CET	443	49858	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:42.417434931 CET	443	49858	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:42.417521954 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:42.419122934 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:42.419133902 CET	443	49858	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:42.419408083 CET	443	49858	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:42.461328983 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:42.472414017 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:42.515328884 CET	443	49858	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:42.595597029 CET	443	49858	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:42.595660925 CET	443	49858	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:42.595716953 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:42.600065947 CET	49858	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:42.604892969 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:42.609658003 CET	80	49847	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:43.066503048 CET	80	49847	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:43.069510937 CET	49864	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:43.069549084 CET	443	49864	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:43.069710016 CET	49864	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:43.070055008 CET	49864	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:43.070065022 CET	443	49864	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:43.117647886 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:43.568994999 CET	443	49864	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:43.592784882 CET	49864	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:43.592807055 CET	443	49864	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:43.730192900 CET	443	49864	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:43.730278015 CET	443	49864	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:43.730355978 CET	49864	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:43.730940104 CET	49864	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:43.734833002 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:43.736119032 CET	49868	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:43.739821911 CET	80	49847	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:43.739875078 CET	49847	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:43.740951061 CET	80	49868	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:43.741024971 CET	49868	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:43.741123915 CET	49868	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:43.745938063 CET	80	49868	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:44.901215076 CET	80	49868	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:44.902920961 CET	49874	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:44.902961016 CET	443	49874	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:44.903018951 CET	49874	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:44.903465033 CET	49874	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:44.903477907 CET	443	49874	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:44.945693970 CET	49868	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:45.420782089 CET	443	49874	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:45.422967911 CET	49874	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:45.423017025 CET	443	49874	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:45.546370029 CET	443	49874	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:45.546432018 CET	443	49874	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:45.546519041 CET	49874	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:45.547142982 CET	49874	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:45.553390980 CET	49878	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:45.558234930 CET	80	49878	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:45.558312893 CET	49878	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:45.558459044 CET	49878	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:45.563281059 CET	80	49878	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:46.479726076 CET	80	49878	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:46.481188059 CET	49885	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:46.481249094 CET	443	49885	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:46.481415987 CET	49885	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:46.481865883 CET	49885	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:46.481879950 CET	443	49885	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:46.523843050 CET	49878	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:47.074899912 CET	443	49885	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:47.101154089 CET	49885	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:47.101180077 CET	443	49885	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:47.319861889 CET	443	49885	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:47.319931030 CET	443	49885	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:47.320009947 CET	49885	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:47.327653885 CET	49885	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:47.644615889 CET	49878	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:47.645944118 CET	49889	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:47.649743080 CET	80	49878	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:47.649792910 CET	49878	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:47.650790930 CET	80	49889	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:47.650876045 CET	49889	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:47.651119947 CET	49889	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:47.655936003 CET	80	49889	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:48.791492939 CET	80	49889	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:48.792915106 CET	49895	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:48.792973042 CET	443	49895	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:48.793314934 CET	49895	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:48.793608904 CET	49895	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:48.793623924 CET	443	49895	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:48.836401939 CET	49889	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:49.274574041 CET	443	49895	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:49.276344061 CET	49895	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:49.276367903 CET	443	49895	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:49.410695076 CET	443	49895	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:49.410763979 CET	443	49895	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:49.411092997 CET	49895	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:49.411499023 CET	49895	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:49.415760040 CET	49889	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:49.420819998 CET	80	49889	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:49.420855045 CET	49901	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:49.420978069 CET	49889	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:49.425677061 CET	80	49901	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:49.425863981 CET	49901	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:49.425863981 CET	49901	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:49.430670977 CET	80	49901	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:50.261837959 CET	80	49901	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:50.288491964 CET	49907	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:50.288558960 CET	443	49907	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:50.288757086 CET	49907	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:50.298626900 CET	49907	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:50.298671007 CET	443	49907	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:50.305068016 CET	49901	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:50.752140045 CET	443	49907	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:50.754086018 CET	49907	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:50.754132986 CET	443	49907	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:50.879574060 CET	443	49907	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:50.879741907 CET	443	49907	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:50.879800081 CET	49907	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:50.880310059 CET	49907	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:50.884500980 CET	49901	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:50.885914087 CET	49913	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:50.889481068 CET	80	49901	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:50.889539003 CET	49901	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:50.890671968 CET	80	49913	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:50.890737057 CET	49913	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:50.890914917 CET	49913	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:50.895698071 CET	80	49913	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:51.714534998 CET	80	49913	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:51.719341040 CET	49919	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:51.719386101 CET	443	49919	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:51.723784924 CET	49919	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:51.723784924 CET	49919	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:51.723829031 CET	443	49919	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:51.760094881 CET	49913	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:52.186577082 CET	443	49919	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:52.188477993 CET	49919	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:52.188520908 CET	443	49919	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:52.351739883 CET	443	49919	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:52.351805925 CET	443	49919	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:52.353030920 CET	49919	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:52.355426073 CET	49919	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:52.358367920 CET	49913	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:52.358371019 CET	49925	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:52.363229990 CET	80	49925	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:52.363323927 CET	80	49913	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:52.363410950 CET	49913	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:52.363414049 CET	49925	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:52.363627911 CET	49925	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:52.368375063 CET	80	49925	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:53.291182041 CET	80	49925	132.226.8.169	192.168.2.10
Jan 11, 2025 01:37:53.298579931 CET	49931	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:53.298628092 CET	443	49931	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:53.298768044 CET	49931	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:53.300736904 CET	49931	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:53.300750017 CET	443	49931	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:53.336349964 CET	49925	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:53.811831951 CET	443	49931	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:53.830661058 CET	49931	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:53.830688953 CET	443	49931	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:53.956568003 CET	443	49931	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:53.956727982 CET	443	49931	104.21.64.1	192.168.2.10
Jan 11, 2025 01:37:53.956800938 CET	49931	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:53.957320929 CET	49931	443	192.168.2.10	104.21.64.1
Jan 11, 2025 01:37:54.079540968 CET	49925	80	192.168.2.10	132.226.8.169
Jan 11, 2025 01:37:54.079607010 CET	49868	80	192.168.2.10	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:37:26.168595076 CET	57923	53	192.168.2.10	1.1.1.1
Jan 11, 2025 01:37:26.175434113 CET	53	57923	1.1.1.1	192.168.2.10
Jan 11, 2025 01:37:27.456496000 CET	52393	53	192.168.2.10	1.1.1.1
Jan 11, 2025 01:37:27.463522911 CET	53	52393	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:37:26.168595076 CET	192.168.2.10	1.1.1.1	0xc73e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:27.456496000 CET	192.168.2.10	1.1.1.1	0xfccd	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:37:26.175434113 CET	1.1.1.1	192.168.2.10	0xc73e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:37:26.175434113 CET	1.1.1.1	192.168.2.10	0xc73e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:26.175434113 CET	1.1.1.1	192.168.2.10	0xc73e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:26.175434113 CET	1.1.1.1	192.168.2.10	0xc73e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:26.175434113 CET	1.1.1.1	192.168.2.10	0xc73e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:26.175434113 CET	1.1.1.1	192.168.2.10	0xc73e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:27.463522911 CET	1.1.1.1	192.168.2.10	0xfccd	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:27.463522911 CET	1.1.1.1	192.168.2.10	0xfccd	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:27.463522911 CET	1.1.1.1	192.168.2.10	0xfccd	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:27.463522911 CET	1.1.1.1	192.168.2.10	0xfccd	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:27.463522911 CET	1.1.1.1	192.168.2.10	0xfccd	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:27.463522911 CET	1.1.1.1	192.168.2.10	0xfccd	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:37:27.463522911 CET	1.1.1.1	192.168.2.10	0xfccd	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49750	132.226.8.169	80	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:26.188513041 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:27.037596941 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 01:37:27.044996023 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:37:27.348889112 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 01:37:28.162542105 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:37:28.465300083 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49771	132.226.8.169	80	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:29.096544027 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:37:29.912506104 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49781	132.226.8.169	80	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:30.581552982 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:31.546086073 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49794	132.226.8.169	80	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:32.148559093 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:32.983073950 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49804	132.226.8.169	80	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:33.637880087 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:34.466528893 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49817	132.226.8.169	80	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:35.087902069 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:35.935523987 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49827	132.226.8.169	80	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:36.602184057 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:37.419583082 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49847	132.226.8.169	80	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:40.433660030 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:41.265412092 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 01:37:41.272036076 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:37:41.549546957 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 01:37:42.604892969 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:37:43.066503048 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49868	132.226.8.169	80	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:43.741123915 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 01:37:44.901215076 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49878	132.226.8.169	80	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:45.558459044 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:46.479726076 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49889	132.226.8.169	80	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:47.651119947 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:48.791492939 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49901	132.226.8.169	80	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:49.425863981 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:50.261837959 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49913	132.226.8.169	80	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:50.890914917 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:51.714534998 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49925	132.226.8.169	80	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:37:52.363627911 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 01:37:53.291182041 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49759	104.21.64.1	443	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:28 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:37:28 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:28 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870637 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RhjmSTRwId8hrmojJAmrW3UMgGPTI5rsVWK2YFWDHxCrKZU71XOMLZi2U9twT5%2BhLWC83AV1j4r1rK0JbKtuTbsUtya%2BUPXG7eq4vGdLE4t9bu6AJWsAZ4vrJU%2BqJSi6OM8MY2mn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6a2693b42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1641&min_rtt=1625&rtt_var=643&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1660034&cwnd=240&unsent_bytes=0&cid=166033e33527272c&ts=213&x=0"
2025-01-11 00:37:28 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49766	104.21.64.1	443	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:28 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:29 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870638 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eYDz6y6knz3kg5KnIhIWjsYUAyC46vAI5M71N99jv9TEMR%2F0HSHc2xrG3aEtqZvf4fMCAwYNSfkFrOzrtACISt13vkZ7m35hGu2vJ2e%2BPmAwTvhBvoPZ3Wq8bQApDJzqZtJD27ry"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6a86a844414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1680&min_rtt=1676&rtt_var=637&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1705607&cwnd=180&unsent_bytes=0&cid=caa4a5bb3ab52b90&ts=145&x=0"
2025-01-11 00:37:29 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49777	104.21.64.1	443	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:30 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:30 UTC	854	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870639 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a1bt1fOj5HVRt05bqaI4IqNhoYniynJHkoqTpnA7vpXh5YbELV0xOTOy%2BGCsJq7YG96A6DopKIVX3GyviRNXwrwA8Wf7AqYDRNMMf9Paf%2BHVXMKBcaQYyyEbOSMAaTe8N3KET316"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6b1a904de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2369&min_rtt=1701&rtt_var=1115&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1716637&cwnd=243&unsent_bytes=0&cid=2a01cde22f842d20&ts=155&x=0"
2025-01-11 00:37:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49789	104.21.64.1	443	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:32 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:32 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:32 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870641 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hc0qIKQFi8%2FwFLwScI9iC5VPDgpbRqoAB82SyX5NhzUxdKSolRnsNVFuECnOveOz%2BiB7YWctGFuXYv2EOqz5xKT0RSnf2ZPhj9hbh1D28O1JDquipfPqmFccjSxpntDSZq0g2bnn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6bb8ebede95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&min_rtt=1655&rtt_var=645&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1663817&cwnd=243&unsent_bytes=0&cid=7cc6b2736c527fbe&ts=137&x=0"
2025-01-11 00:37:32 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49797	104.21.64.1	443	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:33 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:33 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870642 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XYp%2FefpCdSVA6AhjH1QC%2Bg%2BkDLRsCMO1bv7zL6jvgAqzepAqNNiczbDZI22EWCMRto%2FgvKSXlp8Z0NxXnYBnOUymsnexUgfucpNmau%2F7mgNYfgrnPuLuoDBlSBvETz0okbb6k6at"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6c4bf4f8ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1959&min_rtt=1916&rtt_var=749&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1524008&cwnd=168&unsent_bytes=0&cid=28a36fdc36cc4ac8&ts=166&x=0"
2025-01-11 00:37:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49811	104.21.64.1	443	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:34 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:35 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870644 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v5bqjZe1L2CooXzuOdIYYUUCu91wd25tA95BF%2B7J2prf4JHd%2B72fY8tZgOs0XnMmitC32TImKLI1x2t9TvQQxxeUHdXeHAtH6MsgSbpHOXpCLyFJ%2F%2FpSIu%2Bs7ydYMvVjcPBktcxB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6cdda22de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1703&rtt_var=643&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1696687&cwnd=243&unsent_bytes=0&cid=a314993446ac6780&ts=148&x=0"
2025-01-11 00:37:35 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49822	104.21.64.1	443	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:36 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:36 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:36 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870645 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tmao7%2Fn5upBWcG0FmO4tkRs1b8Fu8qV4BLpzxT3DVszlitwcWH2vXLeKZwRa69YHd5%2FX3rRKliUAvqCKY6NYLpJeQ47QgkPKL19UW2Z%2BAaPn0EFVdAyuogLBI9c3%2Fqpg3xYi9iUz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6d74cb87c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2124&min_rtt=1947&rtt_var=1085&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=867240&cwnd=218&unsent_bytes=0&cid=91a81efc9440ae11&ts=167&x=0"
2025-01-11 00:37:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49832	104.21.64.1	443	1824	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:37 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:37:38 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:37 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870647 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ILxA3mf1KQvbMO1NoHIBwMhcZWyx346BbCSZ%2B5YzqGaQzzGdsgd3j2G6ATxiicDsdS6K%2Fu1Un7mZGWnXjomeEmZlGJLl6A2VIoxPs77gryyv%2BHZilBLi%2F3ticLka%2F3k4tLudosD7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6e04e0bc358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1616&rtt_var=619&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1749550&cwnd=155&unsent_bytes=0&cid=44a85bd079b0261a&ts=156&x=0"
2025-01-11 00:37:38 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49858	104.21.64.1	443	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:42 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:37:42 UTC	856	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:42 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870651 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O29Brcpog5FpjeLkJjg6hF0%2BvFfjoUdaWkfCVxZQ18v0VFJMKk5QT4h81pQrA5f6RFPcCylReFJjDqhMZKOpkVnykWd4XKiaamFRZloZJcbyfMeBUEbGYUYXgLddQXrYRh%2FzPUWi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d6fcdb264414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=52903&min_rtt=27387&rtt_var=28302&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=106619&cwnd=180&unsent_bytes=0&cid=8a266e9683d28dc1&ts=208&x=0"
2025-01-11 00:37:42 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49864	104.21.64.1	443	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:43 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:43 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:43 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870652 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=33lw22X6vhopnt1rWIZ2goab0tTJ9ElZbxufROApJq60lI497YRubO2T4Q8C%2FfHhvkziORee6wVIOG2laT27FcLPELLURmuBvWlXLqKbov96KiF1Z7g5Z8ruDNiwEgLVQmlRwu%2Fk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d703dffa8ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1944&min_rtt=1934&rtt_var=745&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1449851&cwnd=168&unsent_bytes=0&cid=9dc3c3f18174f8e3&ts=143&x=0"
2025-01-11 00:37:43 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49874	104.21.64.1	443	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:45 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:45 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:45 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870654 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FjLYJadsBi4wb8673DdY3b3DIZuJc6SA6mTyJR79aul7O3iDrUkHjCaK%2F4iMAb%2BbQAwDtQxzWS6Aw07nzSrMeN6O2VeUkOJMX9nJF9oZy63p9OHBI8a7LH1u5RQoSF6LRhg9kOQd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d70f5d784414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1668&min_rtt=1653&rtt_var=651&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1640449&cwnd=180&unsent_bytes=0&cid=04500f23644b5159&ts=128&x=0"
2025-01-11 00:37:45 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49885	104.21.64.1	443	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:47 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:37:47 UTC	854	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:47 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870656 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2yzv36RSn8Oy9ax7C1piObR7FQGfFmd4A%2BG8JymJCmG7GEQQB3J1Ve7ZxHZcbMTHl7YubTgWTaTCsbpBjETipKhDrzv7sVcDG97uB5eFTsxLZuTwGs4dAw6nyf1lkOI8vTDm6rPq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d71a4b0a4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28513&min_rtt=1695&rtt_var=16624&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1722713&cwnd=180&unsent_bytes=0&cid=3c39f0b50555106d&ts=231&x=0"
2025-01-11 00:37:47 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49895	104.21.64.1	443	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:49 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:37:49 UTC	863	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:49 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870658 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j57osn88AsXg2LgaFX5AI45QEU7q%2B1P%2F0R%2BC4IB1%2FqhhzzQwA%2B2h2ycrEDfpVpOcpYWSe1yI9ItyppT233TYOfaxeRcxtTDl7QjSyia9qvKoPzQNBAESW8bUfs15H9fT84%2F%2BOofw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d7277871de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&min_rtt=1643&rtt_var=625&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1738095&cwnd=243&unsent_bytes=0&cid=73282173a18d9e5c&ts=139&x=0"
2025-01-11 00:37:49 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49907	104.21.64.1	443	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:50 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:50 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:50 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870659 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=92gOA%2Fqoap3Am3A2jIJzNdrJPRZknWK1cSdnO7nt1wT7TU0UgTVS%2F8iNbR7ObfkOPiv%2F3QoVFLrJxhky4RuFYpkrMQ%2FYo4L7acUFK9KN10qlYDA9bMk4GxyYfy0cyE%2FfOMZGaoz5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d730ae298ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2007&min_rtt=1999&rtt_var=766&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1412675&cwnd=168&unsent_bytes=0&cid=67591d18d9be2a03&ts=130&x=0"
2025-01-11 00:37:50 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49919	104.21.64.1	443	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:52 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 00:37:52 UTC	856	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:52 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870661 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kwVi1snkr40gJ98v5H9YBvhJ0AYbksFDJF6zf7dxAvpnibdHUbUhWhIMMs%2FtlkWvPQ6UO60zuJI0CCC%2BcuyQs%2BubZ7qtTpKLD7oXelqyjAfqQcKNIP065MTODdesj%2F0J8aDt8lUI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d739b8728ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1966&min_rtt=1966&rtt_var=983&sent=5&recv=7&lost=0&retrans=1&sent_bytes=4236&recv_bytes=699&delivery_rate=458254&cwnd=168&unsent_bytes=0&cid=f51fe57c94da8319&ts=157&x=0"
2025-01-11 00:37:52 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49931	104.21.64.1	443	8128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:37:53 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 00:37:53 UTC	861	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:37:53 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1870663 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p1JTM1Rf%2FVNXs501ZHTWtYUBV3Ses2cCUZ1GK0Rip6TAsH6MJA%2BTKQncxPhPg4u%2B0EKNMS2w%2FcZJB3x2W0aH3iRlBbBpFGOHBl0xKwYF%2BD4yZ1Yd7IFJLh5YLENQagIgrCV%2FqakA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9000d743ddb37c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2022&min_rtt=2021&rtt_var=760&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1437007&cwnd=218&unsent_bytes=0&cid=03feaaf409a4547d&ts=149&x=0"
2025-01-11 00:37:53 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	5
Start time:	19:37:16
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\uVpytXGpQz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\uVpytXGpQz.exe"
Imagebase:	0xca0000
File size:	2'226'176 bytes
MD5 hash:	022DBAA1DF24D488B03ECB058A521613
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:37:16
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:37:16
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"
Imagebase:	0xa0000
File size:	558'080 bytes
MD5 hash:	47310E2D76477F79641F8703027A60B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs Detection: 69%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:37:17
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe"
Imagebase:	0x7ff68eed0000
File size:	1'663'264 bytes
MD5 hash:	5EFEF6CC9CD24BAEEED71C1107FC32DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:37:21
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\poufs\caulds.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"
Imagebase:	0x520000
File size:	558'080 bytes
MD5 hash:	47310E2D76477F79641F8703027A60B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 0000000A.00000002.1370886600.0000000001360000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:37:25
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe"
Imagebase:	0x6a0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 0000000B.00000002.1498792528.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000B.00000002.1502078806.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:37:33
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs"
Imagebase:	0x7ff6002f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:37:34
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\poufs\caulds.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\poufs\caulds.exe"
Imagebase:	0x520000
File size:	558'080 bytes
MD5 hash:	47310E2D76477F79641F8703027A60B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 0000000E.00000002.1513404739.0000000003BC0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:37:37
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:37:37
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:37:38
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0xef0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:37:39
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\poufs\caulds.exe"
Imagebase:	0x640000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000012.00000002.1651176289.0000000002941000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:37:53
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:37:53
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:37:53
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0xef0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF7C10504A5 Relevance: 1.1, Instructions: 1133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1288711311.00007FF7C1050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7c1050000_uVpytXGpQz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2ff5c02287f3bc9812e4bfc3a4aa9f70f405d4822d2ba261b1fc3a1468fa22
Instruction ID: 35373c510f9e446f36fe7251d2905e487fe2d9efec048ca49c8316651e5b19bf
Opcode Fuzzy Hash: 6f2ff5c02287f3bc9812e4bfc3a4aa9f70f405d4822d2ba261b1fc3a1468fa22
Instruction Fuzzy Hash: B2715772E0DE8A4FE755BB2898657FDBBE0FF55320F45017AD04EC3186DE18A88187A1

Function 00007FF7C10509CD Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1288711311.00007FF7C1050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7c1050000_uVpytXGpQz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d10a61a5715c1948d5e2f24c21237c96fb617bf19d969ff28f7d9a17dd0eaf
Instruction ID: 7ddbcbc5938e984db66db0d755feb9fd62351a46ccff92b81e73989c477b7f2c
Opcode Fuzzy Hash: 91d10a61a5715c1948d5e2f24c21237c96fb617bf19d969ff28f7d9a17dd0eaf
Instruction Fuzzy Hash: B631A470908A8D8FDB81FF6898586ADBBF1FF5A311F4501BAE04DD3256DE289C41C791

Function 00007FF7C1050488 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1288711311.00007FF7C1050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7c1050000_uVpytXGpQz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01eb18a069015a5b05fc2195c2c3cc9da56e14af0b2740f62dfb353061dfebd
Instruction ID: f4fc59353e7867c8a93af795963814a289d5908e59235dcbca574f4d4a6e4261
Opcode Fuzzy Hash: f01eb18a069015a5b05fc2195c2c3cc9da56e14af0b2740f62dfb353061dfebd
Instruction Fuzzy Hash: 00215530A08D1D8FEB94FF689459AADB7F1FF98310F51023AE40ED3245DE34A8818B90

Function 00007FF7C1050AC8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1288711311.00007FF7C1050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7c1050000_uVpytXGpQz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afa0621510359c434434ad054e93d77935b64b1c80d024306615eda51ecbac0
Instruction ID: 71cd9aedf374c40a2307f6968400ca6fe84a8f497cf0dada8e6b68fdd0baac7e
Opcode Fuzzy Hash: 7afa0621510359c434434ad054e93d77935b64b1c80d024306615eda51ecbac0
Instruction Fuzzy Hash: C0E0CD35508A4C5FCB00AB59E8005C5BB65FE89318F00029EE45DC3182C7219565C795

Analysis Process: EmbeddedExe1.exePID: 8144, Parent PID: 7948COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	8.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	56

Executed Functions

Function 000A3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 000A3B68
IsDebuggerPresent.KERNEL32 ref: 000A3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,001652F8,001652E0,?,?), ref: 000A3BEB

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

Part of subcall function 000B092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,000A3C14,001652F8,?,?,?), ref: 000B096E

SetCurrentDirectoryW.KERNEL32(?), ref: 000A3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00157770,00000010), ref: 000DD281
SetCurrentDirectoryW.KERNEL32(?,001652F8,?,?,?), ref: 000DD2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00154260,001652F8,?,?,?), ref: 000DD33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 000DD346

Part of subcall function 000A3A46: GetSysColorBrush.USER32(0000000F), ref: 000A3A50
Part of subcall function 000A3A46: LoadCursorW.USER32(00000000,00007F00), ref: 000A3A5F
Part of subcall function 000A3A46: LoadIconW.USER32(00000063), ref: 000A3A76
Part of subcall function 000A3A46: LoadIconW.USER32(000000A4), ref: 000A3A88
Part of subcall function 000A3A46: LoadIconW.USER32(000000A2), ref: 000A3A9A
Part of subcall function 000A3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 000A3AC0
Part of subcall function 000A3A46: RegisterClassExW.USER32(?), ref: 000A3B16

Part of subcall function 000A39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 000A3A03
Part of subcall function 000A39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 000A3A24
Part of subcall function 000A39D5: ShowWindow.USER32(00000000,?,?), ref: 000A3A38
Part of subcall function 000A39D5: ShowWindow.USER32(00000000,?,?), ref: 000A3A41

Part of subcall function 000A434A: _memset.LIBCMT ref: 000A4370
Part of subcall function 000A434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 000A4415

Strings

This is a third-party compiled AutoIt script., xrefs: 000DD279
runas, xrefs: 000DD33A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 488e9bc5ddd9695a05534cae4c9904ae22c3ff9b99bbd23ee15dd5a1d7a4cd60
Instruction ID: 88e06f95949a854ccdb531e9cc5a76624fdfb060a6a24240a3838d3cf8028a6b
Opcode Fuzzy Hash: 488e9bc5ddd9695a05534cae4c9904ae22c3ff9b99bbd23ee15dd5a1d7a4cd60
Instruction Fuzzy Hash: 5551E630908208EADB21EBF4EC16EFD7B7AAB56750F00416DF451A61A3CBB04686CB21

Function 000A3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 000A36D2
KillTimer.USER32(?,00000001), ref: 000A36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000A371F
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 000A372A
CreatePopupMenu.USER32 ref: 000A373E
PostQuitMessage.USER32(00000000), ref: 000A374D

Strings

TaskbarCreated, xrefs: 000A3725

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: ec2657ab77b85f1795e6cb55a9ba33a7e98a8c98d03c3b39a269fbf64527a54f
Instruction ID: 2cdde2e729f937b6f2b8d6f80c91e7f31751afdb6c4c4e998607a8f26b6b5480
Opcode Fuzzy Hash: ec2657ab77b85f1795e6cb55a9ba33a7e98a8c98d03c3b39a269fbf64527a54f
Instruction Fuzzy Hash: 5F415DB1204605FBDB305FE8DC09BBD37EAEB46300F10023EF502966B2CBA09E959761

Function 000A49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 000A49CD

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

GetCurrentProcess.KERNEL32(?,0012FAEC,00000000,00000000,?), ref: 000A4A9A
IsWow64Process.KERNEL32(00000000), ref: 000A4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 000A4AE7
FreeLibrary.KERNEL32(00000000), ref: 000A4AF2
GetSystemInfo.KERNEL32(00000000), ref: 000A4B23
GetSystemInfo.KERNEL32(00000000), ref: 000A4B2F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 487e527a02a4608a819b510d2a66caaced0f66ac3a944dc4d05ca2cf541d57c2
Instruction ID: d82f8cd307d62c9429cf342cdb3bbc11a9332263cfa84ec282b8b238882607a3
Opcode Fuzzy Hash: 487e527a02a4608a819b510d2a66caaced0f66ac3a944dc4d05ca2cf541d57c2
Instruction Fuzzy Hash: FB91C33598D7C0DEC771DBA884501AABFF5AF7A300F4449AED0CA93B02D660E548D76A

Function 000A4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 000A4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,000A4D8E,?,?,00000000,00000000), ref: 000A4EB0
LoadResource.KERNEL32(?,00000000,?,?,000A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,000A4E2F), ref: 000DD937
SizeofResource.KERNEL32(?,00000000,?,?,000A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,000A4E2F), ref: 000DD94C
LockResource.KERNEL32(000A4D8E,?,?,000A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,000A4E2F,00000000), ref: 000DD95F

Strings

SCRIPT, xrefs: 000A4EA6

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 0c31d2af5dc6f80ac771638054f228f1c1653f1dcea3199c31c5a3de12e287ee
Instruction ID: e869a63633c2a44a47dee79fe092325d5ea516e0f4e15cc277abb24cd08829a5
Opcode Fuzzy Hash: 0c31d2af5dc6f80ac771638054f228f1c1653f1dcea3199c31c5a3de12e287ee
Instruction Fuzzy Hash: DA115E75240700BFD7218BA5EC88F677BBAFBC6B11F10427CF40596650DBA1EC528660

Function 000AFCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 3ce51a64895d3864f9f607c2b401eca1d22d2867c2e5ba6308700e10c9815b9a
Instruction ID: 6fdab96c1ece53bd488bbbc861cd93ec4802d7e969108c4b764ff09983bbf464
Opcode Fuzzy Hash: 3ce51a64895d3864f9f607c2b401eca1d22d2867c2e5ba6308700e10c9815b9a
Instruction Fuzzy Hash: F2926970A083418FD764DF24C480BABB7E5BF85304F14896DE98A9B362D775EC45CB92

Function 0010445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,000DE398), ref: 0010446A
FindFirstFileW.KERNELBASE(?,?), ref: 0010447B
FindClose.KERNEL32(00000000), ref: 0010448B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 808d9d9bf45d84319f66fb3a1868b5ce3077505bfa902095cb7b32aa9e148e83
Instruction ID: 752250c8b938d06a1bd3324d50e2f0769a117cf6adaa0739eaf83a93f46bf213
Opcode Fuzzy Hash: 808d9d9bf45d84319f66fb3a1868b5ce3077505bfa902095cb7b32aa9e148e83
Instruction Fuzzy Hash: 66E0D876410500B79220AB38EC4D4E9776C9F06335F10072EF975C10D0E7B49D519595

Function 000AE6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 000E3E62

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 0d626fdb8a1d24e318a8d6489b378a9d37213caaf26f96973897f2fd32f1ac0f
Instruction ID: 7967339fbd802ffa7d8e93d4c4e13b9c061bf86f446b66ef6e6782477ff6aac3
Opcode Fuzzy Hash: 0d626fdb8a1d24e318a8d6489b378a9d37213caaf26f96973897f2fd32f1ac0f
Instruction Fuzzy Hash: FBA27D74A00245CFCB64CF94C894AAEB7F2FF5A310F248469E905AB352D775ED82CB91

Function 000B09D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000B0A5B
timeGetTime.WINMM ref: 000B0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000B0E53
Sleep.KERNEL32(0000000A), ref: 000B0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 000B0EFA
DestroyWindow.USER32 ref: 000B0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000B0F20
Sleep.KERNEL32(0000000A,?,?), ref: 000E4E83
TranslateMessage.USER32(?), ref: 000E5C60
DispatchMessageW.USER32(?), ref: 000E5C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000E5C82

Strings

@GUI_WINHANDLE, xrefs: 000E4F8F
@GUI_CTRLHANDLE, xrefs: 000E4FE4
@GUI_CTRLID, xrefs: 000E4F3A
@COM_EVENTOBJ, xrefs: 000E54F0
@TRAY_ID, xrefs: 000E578F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: d82184617f82cc43bc2aa7f9ad9142c43c4fe0752d641d86c73bd57d49d87327
Instruction ID: 63f756e9e87224a4588443f26d581dbd5d142a9a86c31976afc06c64b78897ec
Opcode Fuzzy Hash: d82184617f82cc43bc2aa7f9ad9142c43c4fe0752d641d86c73bd57d49d87327
Instruction Fuzzy Hash: BEB2B070608781DFD724DF24C894BAFB7E5BF85308F14492DE599A72A2CB71E885CB42

Function 00109155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00108F5F: __time64.LIBCMT ref: 00108F69

Part of subcall function 000A4EE5: _fseek.LIBCMT ref: 000A4EFD

__wsplitpath.LIBCMT ref: 00109234

Part of subcall function 000C40FB: __wsplitpath_helper.LIBCMT ref: 000C413B

_wcscpy.LIBCMT ref: 00109247
_wcscat.LIBCMT ref: 0010925A
__wsplitpath.LIBCMT ref: 0010927F
_wcscat.LIBCMT ref: 00109295
_wcscat.LIBCMT ref: 001092A8

Part of subcall function 00108FA5: _memmove.LIBCMT ref: 00108FDE
Part of subcall function 00108FA5: _memmove.LIBCMT ref: 00108FED

_wcscmp.LIBCMT ref: 001091EF

Part of subcall function 00109734: _wcscmp.LIBCMT ref: 00109824
Part of subcall function 00109734: _wcscmp.LIBCMT ref: 00109837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00109452
_wcsncpy.LIBCMT ref: 001094C5
DeleteFileW.KERNEL32(?,?), ref: 001094FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00109511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00109522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00109534

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: e5cc0759299bdecc08078c1f474da6c99f97cea3bcaad48bd29592b8885472e0
Instruction ID: 287885a32076e0c0bb90403ed9b8c6ad9d0a2c96dec8c7d93bc78f78b59fdfdf
Opcode Fuzzy Hash: e5cc0759299bdecc08078c1f474da6c99f97cea3bcaad48bd29592b8885472e0
Instruction Fuzzy Hash: CDC14EB1D00119AEDF21DF95CC91EDEB7BDEF95300F0040AAF609E6192EB709A458F61

Function 000A708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000A4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,001652F8,?,000A37AE,?), ref: 000A4724

Part of subcall function 000C050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,000A7165), ref: 000C052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 000A71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 000DE8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 000DE909
RegCloseKey.ADVAPI32(?), ref: 000DE947
_wcscat.LIBCMT ref: 000DE9A0

Strings

Include, xrefs: 000DE8BF, 000DE900
\, xrefs: 000DE9C3
Software\AutoIt v3\AutoIt, xrefs: 000A719E
\Include\, xrefs: 000A7165

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: e4c57f429c960173ed54d86eba7f1e39cd15d7af8a9a5fd299316ca27328cb0e
Instruction ID: 7e758f36bc059385b6885706be81fd9bdd4ee43b3c7a039096687f092577c86e
Opcode Fuzzy Hash: e4c57f429c960173ed54d86eba7f1e39cd15d7af8a9a5fd299316ca27328cb0e
Instruction Fuzzy Hash: 38719E71509301AEC300EFA5EC619AFBBF8FF95350F40452EF445972A1DBB09989CBA2

Function 000A3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 000A3A50
LoadCursorW.USER32(00000000,00007F00), ref: 000A3A5F
LoadIconW.USER32(00000063), ref: 000A3A76
LoadIconW.USER32(000000A4), ref: 000A3A88
LoadIconW.USER32(000000A2), ref: 000A3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 000A3AC0
RegisterClassExW.USER32(?), ref: 000A3B16

Part of subcall function 000A3041: GetSysColorBrush.USER32(0000000F), ref: 000A3074
Part of subcall function 000A3041: RegisterClassExW.USER32(00000030), ref: 000A309E
Part of subcall function 000A3041: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 000A30AF
Part of subcall function 000A3041: LoadIconW.USER32(000000A9), ref: 000A30F2

Strings

AutoIt v3, xrefs: 000A3B05
#, xrefs: 000A3AFB
0, xrefs: 000A3AF4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: 446dccd67803b0a62b16f8b295dcdfc5bb7ab1be1db773ff4c80cea488b60aef
Instruction ID: f9abca62349f8fe2d47b74a5f1e00a1f4187ba13bcdb490c3031e6c72fe21e82
Opcode Fuzzy Hash: 446dccd67803b0a62b16f8b295dcdfc5bb7ab1be1db773ff4c80cea488b60aef
Instruction Fuzzy Hash: 992135B0D00308EFEB20DFA4EC19BAD7BB6EB08711F00412EF504AA6A1D3F556918F94

Function 000A3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteScript, xrefs: 000A38BC
/AutoIt3OutputDebug, xrefs: 000A3892
/ErrorStdOut, xrefs: 000A387D
CMDLINE, xrefs: 000A3822
/AutoIt3ExecuteLine, xrefs: 000A38A7
CMDLINERAW, xrefs: 000A37FB
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 000A37AE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: acfb5a0969324f00000bead41149eb410ba53b1d078bb79444fa9c0d6c9d37a7
Instruction ID: 510bc3f031085b3a813d65fb304f26b8cd6fe854cfa5cec3ad46577b6f128e74
Opcode Fuzzy Hash: acfb5a0969324f00000bead41149eb410ba53b1d078bb79444fa9c0d6c9d37a7
Instruction Fuzzy Hash: 9DA12A7591022DAACB14EBE4DC91EEEB779BF16300F44052EF416B7192EF745A09CB60

Function 000A3015 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 72
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 000A3074
RegisterClassExW.USER32(00000030), ref: 000A309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 000A30AF
LoadIconW.USER32(000000A9), ref: 000A30F2

Strings

+, xrefs: 000A305D
0, xrefs: 000A3056
TaskbarCreated, xrefs: 000A30A4
AutoIt v3 GUI, xrefs: 000A3090

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: af38ccbd27f998a817764833b02fa06868207a666a4e0d898599a3516b1096f4
Instruction ID: 8c919822733ba87c35a6901245159a9a8fffafe78ad2723a0f446fba6c6050fc
Opcode Fuzzy Hash: af38ccbd27f998a817764833b02fa06868207a666a4e0d898599a3516b1096f4
Instruction Fuzzy Hash: 0F3134B1840309EFDB508FA4EC85AC9BBF6FB09314F14452EE580E6AA1E3B94596CF51

Function 000A3041 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 000A3074
RegisterClassExW.USER32(00000030), ref: 000A309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 000A30AF
LoadIconW.USER32(000000A9), ref: 000A30F2

Strings

+, xrefs: 000A305D
0, xrefs: 000A3056
TaskbarCreated, xrefs: 000A30A4
AutoIt v3 GUI, xrefs: 000A3090

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 19eb7f5a2cdf595d6a7371897abe51a6025128aa6acff9727b9ab816c81b0a4e
Instruction ID: 48c1ab3cfc45620a3c654fc6d1f08fbf388a775c13be0c2f627616504257ec47
Opcode Fuzzy Hash: 19eb7f5a2cdf595d6a7371897abe51a6025128aa6acff9727b9ab816c81b0a4e
Instruction Fuzzy Hash: 9C21E3B1900218AFDB10DFA5ED89B9DBBF9FB08700F00412AF910A7AA0D7B14596CF95

Function 012B3D08 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 012B3D4D

Memory Dump Source

Source File: 00000008.00000002.1327811021.00000000012B3000.00000040.00000020.00020000.00000000.sdmp, Offset: 012B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12b3000_EmbeddedExe1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction ID: 7c9f071360f676cc10e9c3dc159990bf471afd1464a897e980c8d2dc0460a954
Opcode Fuzzy Hash: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction Fuzzy Hash: C851EC75A60209FBDF20DFA4CC89FDE77B8BF48741F108558F61AEA180DA749A448B64

Function 000A7285 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 000DEA39
7574D0D0.COMDLG32(?), ref: 000DEA83

Part of subcall function 000A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000A4743,?,?,000A37AE,?), ref: 000A4770

Part of subcall function 000C0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000C07B0

Strings

AutoIt script files (*.au3, *.a3x), xrefs: 000DEA67
X, xrefs: 000DEA51
Run Script:, xrefs: 000DEA58
au3, xrefs: 000DEA7C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: NamePath$7574FullLong_memset
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$X$au3
API String ID: 3399031285-1954568251
Opcode ID: 6d07b3204ed395f4ba2f8df81d5e6e5becbb18558e0fedf21b31e69a20154af3
Instruction ID: 20d33843290043e5e8c63579c7728b032269e024954663ec678291d9f438f382
Opcode Fuzzy Hash: 6d07b3204ed395f4ba2f8df81d5e6e5becbb18558e0fedf21b31e69a20154af3
Instruction Fuzzy Hash: BF21C671A042489BCB519FD4CC45BEE7BFDAF49710F00805AE408BB242DFB45989CFA1

Function 000A39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 000A3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 000A3A24
ShowWindow.USER32(00000000,?,?), ref: 000A3A38
ShowWindow.USER32(00000000,?,?), ref: 000A3A41

Strings

AutoIt v3, xrefs: 000A39FB, 000A3A00, 000A3A01
edit, xrefs: 000A3A1E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 6a487eeb72da34aa9d17266e5ed356489d28827f702abe01b97305eddaf1c8f8
Instruction ID: 7b1c45a57e6251d564e2b0c973ae3d9271819f3ff21aca36f10384522083a332
Opcode Fuzzy Hash: 6a487eeb72da34aa9d17266e5ed356489d28827f702abe01b97305eddaf1c8f8
Instruction Fuzzy Hash: 69F0DA71541690BEEB315B276C59E7B3E7ED7C6F50F00413EFD04A2570C6A11892DAB0

Function 000A686A Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000A4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,001652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 000A4E0F

_free.LIBCMT ref: 000DE263
_free.LIBCMT ref: 000DE2AA

Part of subcall function 000A6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 000A6BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 000DE039
/v, xrefs: 000DE084, 000DE0BD
Bad directive syntax error, xrefs: 000DE292

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: /v$>>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1634556715
Opcode ID: 95b011186a76e3ff295f72069a9e38f729237fe6d2f269daea81b51ee9739ab0
Instruction ID: a89a2651dd8d55f5b47b0d7f5ee35b7e80899c71aee1a690e3706dc66b62d922
Opcode Fuzzy Hash: 95b011186a76e3ff295f72069a9e38f729237fe6d2f269daea81b51ee9739ab0
Instruction Fuzzy Hash: 44919E71900259EFCF14EFA4CC819EDBBB8FF15310F14442AF816AB2A2DB71A955CB60

Function 000A407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 000DD3D7

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

_memset.LIBCMT ref: 000A40FC
_wcscpy.LIBCMT ref: 000A4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000A4160

Strings

Line: , xrefs: 000DD400

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 1aaa229b7ebd92d7697b4f8f09dcf5866e7689ad180b71bf5a3a683e0d18f4dc
Instruction ID: a76e947bc85c16a1c0a2e7c570465b0310efe1d78b704fae87eb33b71c39d000
Opcode Fuzzy Hash: 1aaa229b7ebd92d7697b4f8f09dcf5866e7689ad180b71bf5a3a683e0d18f4dc
Instruction Fuzzy Hash: 8B31B371008704AFD371EBA0DC46FDB77E8AF95310F10491EF589920A2EBB09689CB92

Function 000C541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 000C547B
_memcpy_s.LIBCMT ref: 000C54ED
__read_nolock.LIBCMT ref: 000C554B
__filbuf.LIBCMT ref: 000C556E
_memset.LIBCMT ref: 000C55B2

Part of subcall function 000C8B28: __getptd_noexit.LIBCMT ref: 000C8B28

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 10f7dc2318ae58d967d589b05ee2bceb15401efbaa3bd294a622f2b306f6a749
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 55519378A00F059BDB288F69DC50FAE77E6AF40326F24872DF825962D1D770ADD09B40

Function 012B5788 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 164fileCOMMON

Download Yara Rule

APIs

Part of subcall function 012B5678: Sleep.KERNELBASE(000001F4), ref: 012B5689

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 012B58E3

Strings

EV1G9RGERMBZPHEEP0MJZ7M7RQ, xrefs: 012B5963, 012B5966

Memory Dump Source

Source File: 00000008.00000002.1327811021.00000000012B3000.00000040.00000020.00020000.00000000.sdmp, Offset: 012B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12b3000_EmbeddedExe1.jbxd

Similarity

API ID: CreateFileSleep
String ID: EV1G9RGERMBZPHEEP0MJZ7M7RQ
API String ID: 2694422964-3627028931
Opcode ID: ec2ec30d2218bf1699e600ffe5bfe0e0ceaf9a7df04b5fc7557880d93e585094
Instruction ID: b20cd75bd8c6880ebe44723f6120ffa0b63759585b89b0915afe06feed376d06
Opcode Fuzzy Hash: ec2ec30d2218bf1699e600ffe5bfe0e0ceaf9a7df04b5fc7557880d93e585094
Instruction Fuzzy Hash: 7F61C530D14288DBEF11DBB4C844BEEBB74AF19304F044198E248BB2C1D7B91B45CBA6

Function 000A35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,000A35A1,SwapMouseButtons,00000004,?), ref: 000A35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,000A35A1,SwapMouseButtons,00000004,?,?,?,?,000A2754), ref: 000A35F5
RegCloseKey.KERNELBASE(00000000,?,?,000A35A1,SwapMouseButtons,00000004,?,?,?,?,000A2754), ref: 000A3617

Strings

Control Panel\Mouse, xrefs: 000A35D2

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 3e46e910d884fb1da27af28e13eba48bb3fca983e9b5420bf4052c6688c69d91
Instruction ID: d145170e77fbaaea33a057c230307078330da49ebbf7b18f3673fbd62dc10573
Opcode Fuzzy Hash: 3e46e910d884fb1da27af28e13eba48bb3fca983e9b5420bf4052c6688c69d91
Instruction Fuzzy Hash: AD115A75910208BFDB208FA4DC44DEFB7B9EF05740F00856AF805D7210E2719F519B64

Function 0010955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 000A4EE5: _fseek.LIBCMT ref: 000A4EFD

Part of subcall function 00109734: _wcscmp.LIBCMT ref: 00109824
Part of subcall function 00109734: _wcscmp.LIBCMT ref: 00109837

_free.LIBCMT ref: 001096A2
_free.LIBCMT ref: 001096A9
_free.LIBCMT ref: 00109714

Part of subcall function 000C2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,000C9A24), ref: 000C2D69
Part of subcall function 000C2D55: GetLastError.KERNEL32(00000000,?,000C9A24), ref: 000C2D7B

_free.LIBCMT ref: 0010971C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: 3524effda7f3e24665f6a4d135bdbd8785199656688c036a5d0e940117743ebe
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: 705141B5D14258AFDF249FA4DC81ADEBB79EF88300F1044AEF549A3252DB715A80CF58

Function 000C470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000C47A0
__flush.LIBCMT ref: 000C47C0
__write.LIBCMT ref: 000C47F3
__flsbuf.LIBCMT ref: 000C4821

Part of subcall function 000C8B28: __getptd_noexit.LIBCMT ref: 000C8B28

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 18d033781250fa36440b1302b6349151bf26ddf009b419964777594f76449d90
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: BD41C375A047469BDB28CFA9C8A0FAE7BE5FF42360B24827DE815C7680DB70DD458B40

Function 000A44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000A44CF

Part of subcall function 000A407C: _memset.LIBCMT ref: 000A40FC
Part of subcall function 000A407C: _wcscpy.LIBCMT ref: 000A4150
Part of subcall function 000A407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000A4160

KillTimer.USER32(?,00000001,?,?), ref: 000A4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000A4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000DD4B9

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 02860ccfa411901b341ec9d6e7af5a1a8540ff6867c702f88be95d3fde9bed0b
Instruction ID: a0a48089e2cb375923de41dc6a00a14e79a39666020ccc45339a28f1c3185077
Opcode Fuzzy Hash: 02860ccfa411901b341ec9d6e7af5a1a8540ff6867c702f88be95d3fde9bed0b
Instruction Fuzzy Hash: 7A21D774904784AFE7728B74C855BEBBBEC9F46318F04009FE69E56242C7B42A85CB51

Function 001AA9D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,00000000), ref: 001AAB87
VirtualProtect.KERNELBASE(?,00001000), ref: 001AAB9C

Strings

RIPTFULLPATH, xrefs: 001AA9D1

Memory Dump Source

Source File: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ProtectVirtual
String ID: RIPTFULLPATH
API String ID: 544645111-4147738662
Opcode ID: 499e3d723dbd0037eb382703e2867939706875ad2f9ec26e61736e890b467e0f
Instruction ID: 0871aa1bbfca6178245116c746a9ece37af2288653adccbde595243de67d24a3
Opcode Fuzzy Hash: 499e3d723dbd0037eb382703e2867939706875ad2f9ec26e61736e890b467e0f
Instruction Fuzzy Hash: 5251047AA543524BD7209EB8CD90271B7E4EF53324BA90738C5E6C73C6E7A45C09C7A2

Function 00108D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00108DAC
__fread_nolock.LIBCMT ref: 00108DC1

Strings

EA06, xrefs: 00108DF3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 548ac6ec37c223942e7dbc542f32e7092f2fd176b1ff7a11df1275f90cd164ee
Instruction ID: d90e12649f767b9631287d4e2d6e00a357847392dc2988d77532f58d2fd92448
Opcode Fuzzy Hash: 548ac6ec37c223942e7dbc542f32e7092f2fd176b1ff7a11df1275f90cd164ee
Instruction Fuzzy Hash: 8D01B971904218BEDB18CBE8CC56FEE7BF8DB15311F00459EF592D61C1E9B5E6088760

Function 000C0DB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C571C: __FF_MSGBANNER.LIBCMT ref: 000C5733
Part of subcall function 000C571C: __NMSG_WRITE.LIBCMT ref: 000C573A
Part of subcall function 000C571C: RtlAllocateHeap.NTDLL(01270000,00000000,00000001), ref: 000C575F

std::exception::exception.LIBCMT ref: 000C0DEC
__CxxThrowException@8.LIBCMT ref: 000C0E01

Part of subcall function 000C859B: RaiseException.KERNEL32(?,?,00000000,00159E78,?,00000001,?,?,?,000C0E06,00000000,00159E78,000A9E8C,00000001), ref: 000C85F0

Strings

bad allocation, xrefs: 000C0DE1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: b6799fb702d2cbc751123db1e05bc61d92667cfb49bbc34142f3dd4034e242c1
Instruction ID: 28d8629940fbb4eb543f1e760a62a4d689ae2fcfcc0c3c2a9c431d9392e0fa26
Opcode Fuzzy Hash: b6799fb702d2cbc751123db1e05bc61d92667cfb49bbc34142f3dd4034e242c1
Instruction Fuzzy Hash: 4FF0813150031AE6DB14BBD4ED01FDF77AD9F01311F10442EF908A6182DFB09A80D6D5

Function 012B43E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 012B442D
ExitProcess.KERNEL32(00000000), ref: 012B444C

Strings

D, xrefs: 012B43F9

Memory Dump Source

Source File: 00000008.00000002.1327811021.00000000012B3000.00000040.00000020.00020000.00000000.sdmp, Offset: 012B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12b3000_EmbeddedExe1.jbxd

Similarity

API ID: Process$CreateExit
String ID: D
API String ID: 126409537-2746444292
Opcode ID: 5eb2aae7a9647d9e2c45f82c1b7c95c0f5ecba5966e3f1c76f424d9cb9e516ac
Instruction ID: 77980a71d8d0f906c2c7b704fc7c01b1be217d0cc1d1621ec40161b81bd5e157
Opcode Fuzzy Hash: 5eb2aae7a9647d9e2c45f82c1b7c95c0f5ecba5966e3f1c76f424d9cb9e516ac
Instruction Fuzzy Hash: ACF0FF7155024DABDB60EFE4CC89FFE777CBF04701F448508FB0A9A180DA7896088B61

Function 001098E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 001098F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0010990F

Strings

aut, xrefs: 00109909

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 96029379552a5230effec6e21e142a71032c528808ab9ea545107f14975c0709
Instruction ID: 907a03535c463b81f545b6744b257bbcdab65d4eb6af10bac1134d961338593b
Opcode Fuzzy Hash: 96029379552a5230effec6e21e142a71032c528808ab9ea545107f14975c0709
Instruction Fuzzy Hash: 8CD05E7954030DFBDB60ABA0EC0EF9A773CE704701F0002B1BE54D51A1EAB195AA8BA1

Function 0011CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e94b25f5f0ce24a111cbc9acdf7f0603ff5f0829dd7619a5b7ac6b4efb5933
Instruction ID: c75d9b44aff7d6a56a0fc38bb0ae8639cc42ec1e04a19bf026e57a9d229647a1
Opcode Fuzzy Hash: 88e94b25f5f0ce24a111cbc9acdf7f0603ff5f0829dd7619a5b7ac6b4efb5933
Instruction Fuzzy Hash: D4F13A716083019FCB18DF28C480AAABBE5FF89314F54892DF8999B352D734E945CF92

Function 000AF76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 000C0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 000C0193
Part of subcall function 000C0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 000C019B
Part of subcall function 000C0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 000C01A6
Part of subcall function 000C0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 000C01B1
Part of subcall function 000C0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 000C01B9
Part of subcall function 000C0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 000C01C1

Part of subcall function 000B60F9: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 000B6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 000AF9CD
OleInitialize.OLE32(00000000), ref: 000AFA4A
CloseHandle.KERNEL32(00000000), ref: 000E45C8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Virtual$Handle$ClipboardCloseFormatInitializeRegister
String ID:
API String ID: 3094916012-0
Opcode ID: b7a7cd8d0b4685099e579634be979d79d21509abce0b63110bfbaf663885eea4
Instruction ID: ca826a51d16973d83f6afb40ffa0fb35c1e9d6c4499a182441b2fc3bf1f55ff1
Opcode Fuzzy Hash: b7a7cd8d0b4685099e579634be979d79d21509abce0b63110bfbaf663885eea4
Instruction Fuzzy Hash: 4781BBB0901A408EC394DF69AD446A97BE7FB59346F9081AAD059DBB62FBF044C5CF10

Function 000A434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000A4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 000A4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 000A4432

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: d3969a4750c8ecc9e35f6343f12d82cb2db7508df64c7de5614dc38bc6f0b79d
Instruction ID: 03e3119b6839281afdb854c6e091a1e7060009108ca1f75b33a290f82a72414f
Opcode Fuzzy Hash: d3969a4750c8ecc9e35f6343f12d82cb2db7508df64c7de5614dc38bc6f0b79d
Instruction Fuzzy Hash: 5431C375504701DFC760DFA4D88469BBBF8FB99308F00092EF58A86251E7F0AA88CB52

Function 000C571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 000C5733

Part of subcall function 000CA16B: __NMSG_WRITE.LIBCMT ref: 000CA192
Part of subcall function 000CA16B: __NMSG_WRITE.LIBCMT ref: 000CA19C

__NMSG_WRITE.LIBCMT ref: 000C573A

Part of subcall function 000CA1C8: GetModuleFileNameW.KERNEL32(00000000,001633BA,00000104,00000000,00000001,00000000), ref: 000CA25A
Part of subcall function 000CA1C8: ___crtMessageBoxW.LIBCMT ref: 000CA308

Part of subcall function 000C309F: ___crtCorExitProcess.LIBCMT ref: 000C30A5
Part of subcall function 000C309F: ExitProcess.KERNEL32 ref: 000C30AE

Part of subcall function 000C8B28: __getptd_noexit.LIBCMT ref: 000C8B28

RtlAllocateHeap.NTDLL(01270000,00000000,00000001), ref: 000C575F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 9a7b3c0aa408e587827a4313f91bd7859f39d74542a31375deef47fddb3b25f8
Instruction ID: 8b80405132e1c4c5775a04aeda66ac1ec4a197decfd3c53272403280bf52ef8b
Opcode Fuzzy Hash: 9a7b3c0aa408e587827a4313f91bd7859f39d74542a31375deef47fddb3b25f8
Instruction Fuzzy Hash: DB01F539348B11DAD6602774FC56FAE7388CB42763F50022DF415AA1C2DFB0ADC04760

Function 001098A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00109548,?,?,?,?,?,00000004), ref: 001098BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00109548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 001098D1
CloseHandle.KERNEL32(00000000,?,00109548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 001098D8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 9146c0f6e053448e38325bb00733dae63a21e0f7998064ea3cda2edeb05095fd
Instruction ID: 00cb77b75789b77e432e948b64c5d365b0d05b3c71383291ad578a3f45e75356
Opcode Fuzzy Hash: 9146c0f6e053448e38325bb00733dae63a21e0f7998064ea3cda2edeb05095fd
Instruction Fuzzy Hash: EFE08632141218B7D7312B54EC0AFCA7B29AB06760F108234FB54694E087B115739798

Function 00108D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00108D1B

Part of subcall function 000C2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,000C9A24), ref: 000C2D69
Part of subcall function 000C2D55: GetLastError.KERNEL32(00000000,?,000C9A24), ref: 000C2D7B

_free.LIBCMT ref: 00108D2C
_free.LIBCMT ref: 00108D3E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 2d18795c06cf7f06cbf20726b95781303e9e141fdb3b40986097e36973abf972
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: 48E012F161560147CB24A6F8A940FD723DC4F683527140A2DB48ED75C7CFA4F8428228

Function 000AA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 000DFC01

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: f07ed0b785838e4be85a0df0ac78e734815a6825d6ff5d1db737c90b44d4cb9f
Instruction ID: daa9716c7476c71fffb672c6aa60b7481a9e374b55f6a740d27788e62937dd9f
Opcode Fuzzy Hash: f07ed0b785838e4be85a0df0ac78e734815a6825d6ff5d1db737c90b44d4cb9f
Instruction Fuzzy Hash: CD226970608301DFD724DF64C490B6AB7E1BF46314F14896DE89A9B3A2DB75EC85CB82

Function 000A4C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000A4CBA

Strings

EA06, xrefs: 000DD8CC

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 46266b99695c21cc57930404de7af7830abab6daacc2587a7e399042e548215e
Instruction ID: e28bf6fa97a05e84353d0965e6a73767bedba06c28105880af26c60897ad8474
Opcode Fuzzy Hash: 46266b99695c21cc57930404de7af7830abab6daacc2587a7e399042e548215e
Instruction Fuzzy Hash: 04414D39A041586BDF219BE4CC917FE7BA29BC7300F284475FC869B287D6E05D4483A1

Function 000A7A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000A7AAB
_memmove.LIBCMT ref: 000A7B16

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
Instruction ID: 4b9b8b2cbf9795dce09636fc6c29db893cb49ef9510194d945614ae41dc01c3a
Opcode Fuzzy Hash: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
Instruction Fuzzy Hash: 1F3173B1604606AFC714DFA8CCD1E6DB3A9FF99310715C629E519CB691EB30E950CB90

Function 000A47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

74D2C8D0.UXTHEME ref: 000A4834

Part of subcall function 000C336C: __lock.LIBCMT ref: 000C3372
Part of subcall function 000C336C: RtlDecodePointer.NTDLL(00000001), ref: 000C337E
Part of subcall function 000C336C: RtlEncodePointer.NTDLL(?), ref: 000C3389

Part of subcall function 000A48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 000A4915
Part of subcall function 000A48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 000A492A

Part of subcall function 000A3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 000A3B68
Part of subcall function 000A3B3A: IsDebuggerPresent.KERNEL32 ref: 000A3B7A
Part of subcall function 000A3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,001652F8,001652E0,?,?), ref: 000A3BEB
Part of subcall function 000A3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 000A3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 000A4874

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$DebuggerDecodeEncodeFullNamePathPresent__lock
String ID:
API String ID: 2688871447-0
Opcode ID: be6e1fa6f0024b66edb68dced148a71aeeef7d7b8347cb4bfb03ce6e52583186
Instruction ID: 090d56a133cb83fead6f4f34282afb0bef71587a9db26b0ac7f4ac97eac5322d
Opcode Fuzzy Hash: be6e1fa6f0024b66edb68dced148a71aeeef7d7b8347cb4bfb03ce6e52583186
Instruction Fuzzy Hash: 40119D719183419FC700EF68EC0595EBBE8EF85750F10852EF044872B2DFB49689CB92

Function 000C55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 000C562C
__lock_file.LIBCMT ref: 000C564D

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: cbb0d7c37d6bbe4ceb780bc50000607ffb624429608846e9b82e95c90c388511
Instruction ID: 06e97f6aa6d8e3ea1c32d4de5f3a6b9e138fc449e3b32814f68426c5f8df7013
Opcode Fuzzy Hash: cbb0d7c37d6bbe4ceb780bc50000607ffb624429608846e9b82e95c90c388511
Instruction Fuzzy Hash: 2B01A775800A08EBCF22EF649C02EDF7BA1EF91362F54811DF8241B192DB319A91DF91

Function 000C53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000C8B28: __getptd_noexit.LIBCMT ref: 000C8B28

__lock_file.LIBCMT ref: 000C53EB

Part of subcall function 000C6C11: __lock.LIBCMT ref: 000C6C34

__fclose_nolock.LIBCMT ref: 000C53F6

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 5342343f65012377d35eb1db9462d842a8161f74f23f79f3a7c8497bc6b599fd
Instruction ID: 08498ed3e9dbbcb24953635c74c4910f8d51218a40577197f475e50519445680
Opcode Fuzzy Hash: 5342343f65012377d35eb1db9462d842a8161f74f23f79f3a7c8497bc6b599fd
Instruction Fuzzy Hash: D3F09631910A449AD7206B659C02FED67F0AF41376F25820CA424AB1C3CBFC6A815B55

Function 012B4458 Relevance: 1.7, APIs: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 012B3CC8: GetFileAttributesW.KERNELBASE(?), ref: 012B3CD3

CreateDirectoryW.KERNELBASE(?,00000000), ref: 012B4575

Memory Dump Source

Source File: 00000008.00000002.1327811021.00000000012B3000.00000040.00000020.00020000.00000000.sdmp, Offset: 012B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12b3000_EmbeddedExe1.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 875e4113ae1cf33bd3103560008af28001e1c44058add95accb36785407f8daa
Instruction ID: 6cead8b79b97093cefa918d8adc30e5aa8502a383fdbda32868038b60ad62acc
Opcode Fuzzy Hash: 875e4113ae1cf33bd3103560008af28001e1c44058add95accb36785407f8daa
Instruction Fuzzy Hash: DF518331A2021997EF14EFA0C994BFF7379FF58340F04456CA609A7180EB799B45CBA5

Function 000C0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000C0CB7

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 73facd27680616ce91d7a4174792ffee224cffbc9e132f89019e4068a5f02592
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: E831AEB0A00106DBD758DF58C4D5A6DFBA6FB59300B6487A9E80ACB356DA31EDC1DB80

Function 000DFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 000DFCB7

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 6633332c2a42325240ed748eb461cf36d09f23877fd482acaa89967800ce361b
Instruction ID: e65bdd374efaa34dab4f4cd9a7c62290de46b948a143e9931a2d260fe45dc108
Opcode Fuzzy Hash: 6633332c2a42325240ed748eb461cf36d09f23877fd482acaa89967800ce361b
Instruction Fuzzy Hash: C2412974604341DFDB24DF64C444B5ABBE1BF46314F0988ACE89A8B762C735E845CF52

Function 000A7B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000A7BB3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a0ff24c84481f97127b737e857dc03636f418376c5c54b3ba3593c417f88a991
Instruction ID: 721cc74c077d82ed1dbee3e3c1afeebfbfd8633884d589361bd1eb51eb427e01
Opcode Fuzzy Hash: a0ff24c84481f97127b737e857dc03636f418376c5c54b3ba3593c417f88a991
Instruction Fuzzy Hash: 512128B2624B09EBDB249F55EC41BAD7BB4FF14351F21842EE44ACD290EB3091D0D765

Function 000A4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 000A4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 000A4BEF

Part of subcall function 000C525B: __wfsopen.LIBCMT ref: 000C5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,001652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 000A4E0F

Part of subcall function 000A4B6A: FreeLibrary.KERNEL32(00000000), ref: 000A4BA4

Part of subcall function 000A4C70: _memmove.LIBCMT ref: 000A4CBA

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 6c72e28629d56a2e38786cf2f01b54dce2acc1f98fc2c04bb5381a4f46a7506e
Instruction ID: faa69626b99dc57a90c5f63fab07a8ebddae0cb8a9f023205b879066e0ca09d9
Opcode Fuzzy Hash: 6c72e28629d56a2e38786cf2f01b54dce2acc1f98fc2c04bb5381a4f46a7506e
Instruction Fuzzy Hash: E7119439610205ABCF25EFB0C816FAD77A5AFC5710F10842DF541A7182EBF19951AB61

Function 000DFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 000DFD91

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d496380de66776fd854a8160dc4099239658b02f64f7975c78c58693d460af3e
Instruction ID: 33b92a0915eb0f8949d5a7300f1aa17d1a13909a3e8a3d5eca58f5fcdea834b1
Opcode Fuzzy Hash: d496380de66776fd854a8160dc4099239658b02f64f7975c78c58693d460af3e
Instruction Fuzzy Hash: E9215570A08341DFCB24DFA4C444B5ABBE0BF8A314F04886CF88A97762D731E805CB92

Function 000C4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 000C48A6

Part of subcall function 000C8B28: __getptd_noexit.LIBCMT ref: 000C8B28

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: e7cedccf37411053e6f8e7226782e049d5afdc906ab730963c7284f347f28cd2
Instruction ID: 9ea78d38b8ca0117b12a1c99fa7aba926992e6e00dd8a772f6ae82af486397d1
Opcode Fuzzy Hash: e7cedccf37411053e6f8e7226782e049d5afdc906ab730963c7284f347f28cd2
Instruction Fuzzy Hash: 82F0AF31900609EBDF61AFA48C06FEE36A0BF11325F15851CB8249A1D2CF788955DB55

Function 000A4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,001652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 000A4E7E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d174259adf8f52bd5ff39eb673f460f17b4f549bf5ba688e12aa7744d38338a2
Instruction ID: 8e429f0d3231673d06537ff244619b99410de60e9d4d88b3103787c97b6340a6
Opcode Fuzzy Hash: d174259adf8f52bd5ff39eb673f460f17b4f549bf5ba688e12aa7744d38338a2
Instruction Fuzzy Hash: D6F03079501711CFCB74DFA4D494816B7F1BF95329310893EE1D682610C7B19890DF40

Function 000C0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000C07B0

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 68796c99e377626d4fcd476d47834e9b4f946fa38e3c75f45a39f7b891e78d77
Instruction ID: d94b7b26942de2cb35feb4175e34b03067a4bdd9183bd6a543e94640d92f4db4
Opcode Fuzzy Hash: 68796c99e377626d4fcd476d47834e9b4f946fa38e3c75f45a39f7b891e78d77
Instruction Fuzzy Hash: 02E0867690422867C72196989C05FEAB7ADDB896A0F0441B6FC0CD7205D9609C9186A0

Function 00108E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00108EC1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 0e1a89ff798ae0a31bd84de40e36193586669f0a18486e3296780bfe5b1d33a3
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 1EE092B0108B005BD7388E24D811BE373E1AB05305F00081DF2EA83242EBA278418759

Function 012B3CC8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 012B3CD3

Memory Dump Source

Source File: 00000008.00000002.1327811021.00000000012B3000.00000040.00000020.00020000.00000000.sdmp, Offset: 012B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12b3000_EmbeddedExe1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction ID: 6d5ae7c3fc9d381c54c56747b7e16cb4c05035d7889c47f72fd3ab648b2025f6
Opcode Fuzzy Hash: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction Fuzzy Hash: A5E08C3096520CEBDB10CAED8986AE9B7A8BB043A0F004654AA06C3280D5319A04D750

Function 012B3C98 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 012B3CA3

Memory Dump Source

Source File: 00000008.00000002.1327811021.00000000012B3000.00000040.00000020.00020000.00000000.sdmp, Offset: 012B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12b3000_EmbeddedExe1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction ID: 78a94902ee1fbcebb665624c481acbbe21d448905325a2255f9b86f776fa38f2
Opcode Fuzzy Hash: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction Fuzzy Hash: E0D0A73091520CEBCB10CFF99D049DD73A8E709360F004754FD15C3380E53199049794

Function 000C525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 000C5266

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 79fc7c8b5094c04bb3d01e0bce02cdaabf0a287aa46b062146e50137f8bb9baa
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 85B0927A44020C77CE012A82EC02F897B599B467A4F408020FB0C18162A673A6A49A89

Function 012B5674 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 012B5689

Memory Dump Source

Source File: 00000008.00000002.1327811021.00000000012B3000.00000040.00000020.00020000.00000000.sdmp, Offset: 012B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12b3000_EmbeddedExe1.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: eae7401a550ae47d30927833e29a3f96a600447f140f76ed731d4855b4b14ba1
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 9EE0BF7494010DEFDB00EFA4D9496DD7BB4EF04302F1005A1FD05D7680DB309E548A66

Function 012B5678 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 012B5689

Memory Dump Source

Source File: 00000008.00000002.1327811021.00000000012B3000.00000040.00000020.00020000.00000000.sdmp, Offset: 012B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12b3000_EmbeddedExe1.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 2ee8fb32073893c079eef4e551fb7337a76a84bbc4ad73f0eca49d8d25be6b13
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 83E0E67494010DDFDB00EFB4D9496DD7BB4EF04302F100161FD01D6280D6309D508A62

Non-executed Functions

Function 0012CABC Relevance: 68.9, APIs: 37, Strings: 2, Instructions: 632windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?), ref: 0012CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0012CB95
GetWindowLongW.USER32(?,000000F0), ref: 0012CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0012CC00
SendMessageW.USER32 ref: 0012CC29
_wcsncpy.LIBCMT ref: 0012CC95
GetKeyState.USER32(00000011), ref: 0012CCB6
GetKeyState.USER32(00000009), ref: 0012CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0012CCD9
GetKeyState.USER32(00000010), ref: 0012CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0012CD0C
SendMessageW.USER32 ref: 0012CD33
SendMessageW.USER32(?,00001030,?,0012B348), ref: 0012CE37
SetCapture.USER32(?), ref: 0012CE69
ClientToScreen.USER32(?,?), ref: 0012CECE
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0012CEF5
ReleaseCapture.USER32 ref: 0012CF00
GetCursorPos.USER32(?), ref: 0012CF3A
ScreenToClient.USER32(?,?), ref: 0012CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0012CFA3
SendMessageW.USER32 ref: 0012CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0012D00E
SendMessageW.USER32 ref: 0012D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0012D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0012D06D
GetCursorPos.USER32(?), ref: 0012D08D
ScreenToClient.USER32(?,?), ref: 0012D09A
GetParent.USER32(?), ref: 0012D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0012D123
SendMessageW.USER32 ref: 0012D154
ClientToScreen.USER32(?,?), ref: 0012D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0012D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0012D20C
SendMessageW.USER32 ref: 0012D22F
ClientToScreen.USER32(?,?), ref: 0012D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0012D2B5

Part of subcall function 000A25DB: GetWindowLongW.USER32(?,000000EB), ref: 000A25EC

GetWindowLongW.USER32(?,000000F0), ref: 0012D351

Strings

F, xrefs: 0012D235
@GUI_DRAGID, xrefs: 0012CE9C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongWindow$State$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 302779176-4164748364
Opcode ID: d5e31844b85cee8097bfc50c44467105254fe9bc3d5cd116ab3feab7ce351fe9
Instruction ID: 205474e86beb1f7b46aad5d7c43b2bdb60cc993470c47da2f8de426e37469521
Opcode Fuzzy Hash: d5e31844b85cee8097bfc50c44467105254fe9bc3d5cd116ab3feab7ce351fe9
Instruction Fuzzy Hash: 4442BB78204290AFD724CF28E844EAABBF6FF49350F14052DF695876A1C731D8A5DB92

Function 000B6F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000B71C3
_memset.LIBCMT ref: 000B7539
_memmove.LIBCMT ref: 000B76AC

Strings

Q\E, xrefs: 000B7FCB
[:<:]], xrefs: 000B7479
DEFINE, xrefs: 000F2103
[:>:]], xrefs: 000B7492
\b(?=\w), xrefs: 000F3769
\b(?<=\w), xrefs: 000F3773

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: dc08cfaa5ec3cf425feb0da69614b75307364c593bb591f8b008d2e706239b1b
Instruction ID: d733d03c6cf22d27948ed5663daf13e379bc09a1a361f2bf0e7ed6dfb5189d7b
Opcode Fuzzy Hash: dc08cfaa5ec3cf425feb0da69614b75307364c593bb591f8b008d2e706239b1b
Instruction Fuzzy Hash: 6D939371A04219DBDB24CF58C881BFDB7F1FF48710F25816AEA49AB691E7709E81DB40

Function 000A48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 000A48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 000DD665
IsIconic.USER32(?), ref: 000DD66E
ShowWindow.USER32(?,00000009), ref: 000DD67B
SetForegroundWindow.USER32(?), ref: 000DD685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 000DD69B
GetCurrentThreadId.KERNEL32 ref: 000DD6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 000DD6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 000DD6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 000DD6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 000DD6CF
SetForegroundWindow.USER32(?), ref: 000DD6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 000DD6E7
keybd_event.USER32(00000012,00000000), ref: 000DD6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 000DD6FC
keybd_event.USER32(00000012,00000000), ref: 000DD701
MapVirtualKeyW.USER32(00000012,00000000), ref: 000DD70A
keybd_event.USER32(00000012,00000000), ref: 000DD70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 000DD719
keybd_event.USER32(00000012,00000000), ref: 000DD71E
SetForegroundWindow.USER32(?), ref: 000DD721
AttachThreadInput.USER32(?,?,00000000), ref: 000DD748

Strings

Shell_TrayWnd, xrefs: 000DD660

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 4a9d35db9c7924c9560f03eb59a3298b85b5c33892e6959e9b5ff08cda7c4abb
Instruction ID: 3520ac04ace02de6f8100b92f5b49d9fda90f3374a5f078f4f62f735c40fa498
Opcode Fuzzy Hash: 4a9d35db9c7924c9560f03eb59a3298b85b5c33892e6959e9b5ff08cda7c4abb
Instruction Fuzzy Hash: F6317371A40318BAEB306F619C49F7F7E7CEB44B50F10407AFA04EA1D1D6B05952AAA0

Function 0010C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0010C78D
FindClose.KERNEL32(00000000), ref: 0010C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0010C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0010C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 0010C844
__swprintf.LIBCMT ref: 0010C890
__swprintf.LIBCMT ref: 0010C8D3

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

__swprintf.LIBCMT ref: 0010C927

Part of subcall function 000C3698: __woutput_l.LIBCMT ref: 000C36F1

__swprintf.LIBCMT ref: 0010C975

Part of subcall function 000C3698: __flsbuf.LIBCMT ref: 000C3713
Part of subcall function 000C3698: __flsbuf.LIBCMT ref: 000C372B

__swprintf.LIBCMT ref: 0010C9C4
__swprintf.LIBCMT ref: 0010CA13
__swprintf.LIBCMT ref: 0010CA62

Strings

%02d, xrefs: 0010C91B, 0010C925, 0010C973, 0010C9C2, 0010CA11, 0010CA60
%4d%02d%02d%02d%02d%02d, xrefs: 0010C88A
%4d, xrefs: 0010C8CD

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 3ce5014c1b8c577d114a536475918ce5508d4b36aae24739b1366bdd04fc9eda
Instruction ID: 10c65735e99426d7c21e78a207fc0033d63cdedb763c409ee5bc016f8e5c3d13
Opcode Fuzzy Hash: 3ce5014c1b8c577d114a536475918ce5508d4b36aae24739b1366bdd04fc9eda
Instruction Fuzzy Hash: D1A11BB1508304ABC714EFA4C885EEFB7ECBF95704F40492DF59586192EB34DA49CBA2

Function 0010EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,774C8FB0,?,00000000), ref: 0010EFB6
_wcscmp.LIBCMT ref: 0010EFCB
_wcscmp.LIBCMT ref: 0010EFE2
GetFileAttributesW.KERNEL32(?), ref: 0010EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 0010F00E
FindNextFileW.KERNEL32(00000000,?), ref: 0010F026
FindClose.KERNEL32(00000000), ref: 0010F031
FindFirstFileW.KERNEL32(*.*,?), ref: 0010F04D
_wcscmp.LIBCMT ref: 0010F074
_wcscmp.LIBCMT ref: 0010F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 0010F09D
SetCurrentDirectoryW.KERNEL32(00158920), ref: 0010F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 0010F0C5
FindClose.KERNEL32(00000000), ref: 0010F0D2
FindClose.KERNEL32(00000000), ref: 0010F0E4

Strings

*.*, xrefs: 0010F048

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 9220c0595c408df891f30750fe2bcbbf2ba49d13c6e21ed8f41e60d2b6bff9db
Instruction ID: b9c35c9530647fc240f92b466d06eb6a603843f6b965585d04625c819738289c
Opcode Fuzzy Hash: 9220c0595c408df891f30750fe2bcbbf2ba49d13c6e21ed8f41e60d2b6bff9db
Instruction Fuzzy Hash: 9F31E532500219BACB34EFA4DC49EEE77ADAF45360F10417DF840E24D1DBB0DA96CA51

Function 00120857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00120953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0012F910,00000000,?,00000000,?,?), ref: 001209C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00120A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00120A92
RegCloseKey.ADVAPI32(?), ref: 00120DB2
RegCloseKey.ADVAPI32(00000000), ref: 00120DBF

Strings

REG_BINARY, xrefs: 00120D4D
REG_SZ, xrefs: 00120AD0
REG_DWORD, xrefs: 00120C83
REG_QWORD, xrefs: 00120D00
REG_MULTI_SZ, xrefs: 00120B7A
REG_EXPAND_SZ, xrefs: 00120A2F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 53ba5d63142b2515dc82b117fcdeafdb5195dcf4b1af475a2e3ff3580668348c
Instruction ID: 2ceaa1aa7235d837f086b1eb09f11b0c869dc129abe775060d05e91abad832b2
Opcode Fuzzy Hash: 53ba5d63142b2515dc82b117fcdeafdb5195dcf4b1af475a2e3ff3580668348c
Instruction Fuzzy Hash: 30028A756006119FCB15EF64D881E6AB7E5FF8A710F04895CF88A9B7A2CB34EC51CB81

Function 0012C5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

DragQueryPoint.SHELL32(?,?), ref: 0012C627

Part of subcall function 0012AB37: ClientToScreen.USER32(?,?), ref: 0012AB60
Part of subcall function 0012AB37: GetWindowRect.USER32(?,?), ref: 0012ABD6
Part of subcall function 0012AB37: PtInRect.USER32(?,?,0012C014), ref: 0012ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0012C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0012C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0012C6BE
_wcscat.LIBCMT ref: 0012C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0012C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0012C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0012C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0012C757
DragFinish.SHELL32(?), ref: 0012C75E
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 0012C851

Strings

@GUI_DRAGFILE, xrefs: 0012C800
@GUI_DROPID, xrefs: 0012C77E
@GUI_DRAGID, xrefs: 0012C7C9

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2166380349-3440237614
Opcode ID: 2e2ee6940a160a3d77643b73d86cfff588bd02347dc7bdf6d11a2011f377a03e
Instruction ID: 53e398dfe3ae870e1078013a50e30bcf1e52a9f290a71e1023af37064488bd38
Opcode Fuzzy Hash: 2e2ee6940a160a3d77643b73d86cfff588bd02347dc7bdf6d11a2011f377a03e
Instruction Fuzzy Hash: C1618D71108300AFC711EFA4DC85DAFBBF8EF89310F40492EF695961A1DB709959CB92

Function 0010F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,774C8FB0,?,00000000), ref: 0010F113
_wcscmp.LIBCMT ref: 0010F128
_wcscmp.LIBCMT ref: 0010F13F

Part of subcall function 00104385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 001043A0

FindNextFileW.KERNEL32(00000000,?), ref: 0010F16E
FindClose.KERNEL32(00000000), ref: 0010F179
FindFirstFileW.KERNEL32(*.*,?), ref: 0010F195
_wcscmp.LIBCMT ref: 0010F1BC
_wcscmp.LIBCMT ref: 0010F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 0010F1E5
SetCurrentDirectoryW.KERNEL32(00158920), ref: 0010F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 0010F20D
FindClose.KERNEL32(00000000), ref: 0010F21A
FindClose.KERNEL32(00000000), ref: 0010F22C

Strings

*.*, xrefs: 0010F190

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 53145d07fe1e814827adfdd209701f9e43d3eec4d0f153cac5551e46cc955732
Instruction ID: 62b3728151950138e5f7d1ba2c3b8865e1e97ca1752441598d3c92cdc73b2e43
Opcode Fuzzy Hash: 53145d07fe1e814827adfdd209701f9e43d3eec4d0f153cac5551e46cc955732
Instruction Fuzzy Hash: 5131C236500219BADB30AFA4EC4AEEE77BCAF45360F14417DE850A24E1DB70DA97CA54

Function 0010A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0010A20F
__swprintf.LIBCMT ref: 0010A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 0010A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0010A293
_memset.LIBCMT ref: 0010A2B2
_wcsncpy.LIBCMT ref: 0010A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0010A323
CloseHandle.KERNEL32(00000000), ref: 0010A32E
RemoveDirectoryW.KERNEL32(?), ref: 0010A337
CloseHandle.KERNEL32(00000000), ref: 0010A341

Strings

\??\%s, xrefs: 0010A22B
\, xrefs: 0010A247
:, xrefs: 0010A252

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: fa6013f0fdf4142c922a24b7807e89978cc870212254a878642e5c887c5a9e5c
Instruction ID: 6ef63c7b5f714530ca7b8d0d17f9f7878a20bca45cf9bcb84401690bfc85cb2c
Opcode Fuzzy Hash: fa6013f0fdf4142c922a24b7807e89978cc870212254a878642e5c887c5a9e5c
Instruction Fuzzy Hash: 3231A075500209ABDB20DFA0DC49FEB37BCFF89740F5041BAF509D61A1EB7096968B25

Function 0012C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0012C1FC
GetFocus.USER32 ref: 0012C20C
GetDlgCtrlID.USER32(00000000), ref: 0012C217
_memset.LIBCMT ref: 0012C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0012C36D
GetMenuItemCount.USER32(?), ref: 0012C38D
GetMenuItemID.USER32(?,00000000), ref: 0012C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0012C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0012C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0012C454
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 0012C489

Strings

0, xrefs: 0012C33A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: 3c1dab43a40fdd489db5d6d3de475526ed2bd5d8e437e930881abfa02162f84e
Instruction ID: d06eb7d21d80e3fe9ef9c4c72179cc55d8ec4fe09c74b344849f7cdc9fec42b6
Opcode Fuzzy Hash: 3c1dab43a40fdd489db5d6d3de475526ed2bd5d8e437e930881abfa02162f84e
Instruction Fuzzy Hash: 9381B270108361AFD720DF14E884AAFBBE9FF88314F104A2DFA8597291D770D965CB92

Function 000F7CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000F8202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000F821E
Part of subcall function 000F8202: GetLastError.KERNEL32(?,000F7CE2,?,?,?), ref: 000F8228
Part of subcall function 000F8202: GetProcessHeap.KERNEL32(00000008,?,?,000F7CE2,?,?,?), ref: 000F8237
Part of subcall function 000F8202: RtlAllocateHeap.NTDLL(00000000,?,000F7CE2), ref: 000F823E
Part of subcall function 000F8202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000F8255

Part of subcall function 000F829F: GetProcessHeap.KERNEL32(00000008,000F7CF8,00000000,00000000,?,000F7CF8,?), ref: 000F82AB
Part of subcall function 000F829F: RtlAllocateHeap.NTDLL(00000000,?,000F7CF8), ref: 000F82B2
Part of subcall function 000F829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,000F7CF8,?), ref: 000F82C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 000F7D13
_memset.LIBCMT ref: 000F7D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 000F7D47
GetLengthSid.ADVAPI32(?), ref: 000F7D58
GetAce.ADVAPI32(?,00000000,?), ref: 000F7D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000F7DB1
GetLengthSid.ADVAPI32(?), ref: 000F7DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 000F7DDD
RtlAllocateHeap.NTDLL(00000000), ref: 000F7DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 000F7E05
CopySid.ADVAPI32(00000000), ref: 000F7E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 000F7E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000F7E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 000F7E77

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: a2d456be6964b525baad2de7101dc617b8c557cde0ff8c30cfbb9ba622b90170
Instruction ID: 39f0ee950ead71acad7d5baac1c2734aa0494d9eaa17ca96b579493f657d73ea
Opcode Fuzzy Hash: a2d456be6964b525baad2de7101dc617b8c557cde0ff8c30cfbb9ba622b90170
Instruction Fuzzy Hash: D9615C71900109AFDF108FA0DC44EFEBBBAFF08300F04816EF915A6691DB319A16DB61

Function 000B66E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

NO_AUTO_POSSESS), xrefs: 000F112E
CR), xrefs: 000F1287
UCP), xrefs: 000F110D
UTF), xrefs: 000F10FA
NO_START_OPT), xrefs: 000F114F
CRLF), xrefs: 000F12C1
BSR_ANYCRLF), xrefs: 000F131E
ANY), xrefs: 000F12DE
ANYCRLF), xrefs: 000F12FB
LIMIT_MATCH=, xrefs: 000F1170
LIMIT_RECURSION=, xrefs: 000F11FC
LF), xrefs: 000F12A4
BSR_UNICODE), xrefs: 000F1338
UTF16), xrefs: 000F10CF

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 9b208c9b77af1ee7d76a7f6ff931609cf7f6a25597bca6f86b55b41e0f518b66
Instruction ID: b9ec638008235cad03d62d521700c0c9564821c32a802ea071ffb82ff36b8c73
Opcode Fuzzy Hash: 9b208c9b77af1ee7d76a7f6ff931609cf7f6a25597bca6f86b55b41e0f518b66
Instruction Fuzzy Hash: 91725C71E00219DBDB64CF58C880BFEB7F5EF44710F14816AE909EB691EB359A81DB90

Function 0010001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00100097
SetKeyboardState.USER32(?), ref: 00100102
GetAsyncKeyState.USER32(000000A0), ref: 00100122
GetKeyState.USER32(000000A0), ref: 00100139
GetAsyncKeyState.USER32(000000A1), ref: 00100168
GetKeyState.USER32(000000A1), ref: 00100179
GetAsyncKeyState.USER32(00000011), ref: 001001A5
GetKeyState.USER32(00000011), ref: 001001B3
GetAsyncKeyState.USER32(00000012), ref: 001001DC
GetKeyState.USER32(00000012), ref: 001001EA
GetAsyncKeyState.USER32(0000005B), ref: 00100213
GetKeyState.USER32(0000005B), ref: 00100221

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ec5c7b734beead219239852d874e9b7a4b4616eda44504ceb64dfb172709df93
Instruction ID: 5d89068efea53e897070c371b72b07cbf311b847ad10fbaaf7e4df28d8426f52
Opcode Fuzzy Hash: ec5c7b734beead219239852d874e9b7a4b4616eda44504ceb64dfb172709df93
Instruction Fuzzy Hash: 9851DA3090478829FB36DBA089547EABFB49F16380F08459ED9C65A5C3DBE4DB8CC761

Function 001203DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00120E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0011FDAD,?,?), ref: 00120E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001204AC

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0012054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 001205E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00120822
RegCloseKey.ADVAPI32(00000000), ref: 0012082F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 5a184a31ca51748f264cf2f53a03f9049a2fdbd8cfd48c427e776bb5cab9ed2a
Instruction ID: cb8d0d65ecf08438f2e9c59bea6e320ef525eb8b14526f709d305a28b49ef643
Opcode Fuzzy Hash: 5a184a31ca51748f264cf2f53a03f9049a2fdbd8cfd48c427e776bb5cab9ed2a
Instruction Fuzzy Hash: 46E16B30604214AFCB15DF28D891E6BBBE5EF89714F04896DF84ADB262DB30ED11CB91

Function 00114164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0011418B
EmptyClipboard.USER32 ref: 00114191
GlobalAlloc.KERNEL32(00000002,?), ref: 001141A6
CloseClipboard.USER32 ref: 00114245

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 2e0b2c5b486374593c6170fffb42b2971c59a377ad068c1b1ae10f0b7e15228a
Instruction ID: 2a042398e30bca425458c08fb1f65ee3eb39967d14a98a01c4782602f33a0c1b
Opcode Fuzzy Hash: 2e0b2c5b486374593c6170fffb42b2971c59a377ad068c1b1ae10f0b7e15228a
Instruction Fuzzy Hash: CF21A335700210AFDB14AF64EC19BAD7BB8EF05B10F148039F946DB6A2DB74AC92CB54

Function 001037EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000A4743,?,?,000A37AE,?), ref: 000A4770

Part of subcall function 00104A31: GetFileAttributesW.KERNEL32(?,0010370B), ref: 00104A32

FindFirstFileW.KERNEL32(?,?), ref: 001038A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0010394B
MoveFileW.KERNEL32(?,?), ref: 0010395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0010397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0010399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 001039B9

Strings

\*.*, xrefs: 0010384E, 00103857, 0010386C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: d44bde46c9819cc483733a86dafa687684805078d949280f02017c422f395ad6
Instruction ID: c12cc7cba50047ab064635cde0872412482bba6ec27730997c5b75140f654532
Opcode Fuzzy Hash: d44bde46c9819cc483733a86dafa687684805078d949280f02017c422f395ad6
Instruction Fuzzy Hash: F551AD3180414CAACF15EBE0CE929EEB779AF16305F604069E456B71D2EFB06F09CB60

Function 0010F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0010F440
Sleep.KERNEL32(0000000A), ref: 0010F470
_wcscmp.LIBCMT ref: 0010F484
_wcscmp.LIBCMT ref: 0010F49F
FindNextFileW.KERNEL32(?,?), ref: 0010F53D
FindClose.KERNEL32(00000000), ref: 0010F553

Strings

*.*, xrefs: 0010F425

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 79eb9bd372303ada8cbc3834b940c2666485d98fe9745054078f766f96bf3f68
Instruction ID: 33f7bd9061cdc92a3c989d356cee1d8c4eb75e9ed624da8c797bf36fe85b9011
Opcode Fuzzy Hash: 79eb9bd372303ada8cbc3834b940c2666485d98fe9745054078f766f96bf3f68
Instruction Fuzzy Hash: DB417F71900219AFCF24DFA4DC4AAEEBBB4FF05310F10846AE855A75D1DB709A96CB50

Function 0012D43E Relevance: 12.3, APIs: 8, Instructions: 257windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

GetSystemMetrics.USER32(0000000F), ref: 0012D47C
GetSystemMetrics.USER32(0000000F), ref: 0012D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0012D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0012D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0012D716
ShowWindow.USER32(00000003,00000000), ref: 0012D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0012D75A
NtdllDialogWndProc_W.NTDLL(?,00000005,?,?), ref: 0012D77D

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$DialogInvalidateLongMoveNtdllProc_RectShow
String ID:
API String ID: 830902736-0
Opcode ID: 5a02fc780d87115e628c760441d1a78e59c52741a7fb61775365477b0b7cf325
Instruction ID: c13d29f524aa1895475018a2b30a5c0cc64b26be923e3323b352109bb149a0a0
Opcode Fuzzy Hash: 5a02fc780d87115e628c760441d1a78e59c52741a7fb61775365477b0b7cf325
Instruction Fuzzy Hash: ADB18A71600225EFDF18CF68E9C5BAD7BB1FF04705F088169EC489B695DB74A9A0CB90

Function 000FE616 Relevance: 11.1, APIs: 1, Strings: 6, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 000FE628

Strings

Release, xrefs: 000FE946
InterfaceDispatch, xrefs: 000FE7DE
|, xrefs: 000FE658
(, xrefs: 000FE66E
AddRef, xrefs: 000FE8FE
QueryInterface, xrefs: 000FE871

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: lstrlen
String ID: ($AddRef$InterfaceDispatch$QueryInterface$Release$|
API String ID: 1659193697-2318614619
Opcode ID: a0226b0488c534f0113590f734022ef272cbd7bbea38ee84fed4decff9e3ea67
Instruction ID: ba49bb11306aae3db3ff449f7e80ffab1d46260076a586a9f0dd4c687da1e2ac
Opcode Fuzzy Hash: a0226b0488c534f0113590f734022ef272cbd7bbea38ee84fed4decff9e3ea67
Instruction Fuzzy Hash: 11323575A047099FD728DF19C4819AAB7F0FF48310B15C46EE99ADB7A2E770E941CB40

Function 000B5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000B58A5
_memmove.LIBCMT ref: 000B58F5
_memmove.LIBCMT ref: 000B595B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 221549705d2c9b07ecd506f700ca42d83810e5807a444acfb75582a731149ad4
Instruction ID: 683505eb2e22e9882b20a463c059e41f37d2e3e224788b12c755729d11e30815
Opcode Fuzzy Hash: 221549705d2c9b07ecd506f700ca42d83810e5807a444acfb75582a731149ad4
Instruction Fuzzy Hash: 4D12A970A00A09DFDF14DFA4D981AEEB7F5FF48301F108569E846E7292EB36A910CB50

Function 00103B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000A4743,?,?,000A37AE,?), ref: 000A4770

Part of subcall function 00104A31: GetFileAttributesW.KERNEL32(?,0010370B), ref: 00104A32

FindFirstFileW.KERNEL32(?,?), ref: 00103B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00103BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00103BEA
FindClose.KERNEL32(00000000), ref: 00103C01
FindClose.KERNEL32(00000000), ref: 00103C0A

Strings

\*.*, xrefs: 00103B5B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 1960021dd6fd83d8b40d0897554ad19cb07fb91e2ab093dacae29e3377c1a7cf
Instruction ID: 0337001aa5229c1c47bece9717a54c107bec3505c6ffd978c67a2bb8f8da2a94
Opcode Fuzzy Hash: 1960021dd6fd83d8b40d0897554ad19cb07fb91e2ab093dacae29e3377c1a7cf
Instruction Fuzzy Hash: ED316D31008385ABC305EF64C9919EFB7ACBF96315F404D2EF4E592192EB61DA09C763

Function 001051BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 000F87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000F882B
Part of subcall function 000F87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000F8858
Part of subcall function 000F87E1: GetLastError.KERNEL32 ref: 000F8865

ExitWindowsEx.USER32(?,00000000), ref: 001051F9

Strings

SeShutdownPrivilege, xrefs: 001051C9
, xrefs: 001051E7
@, xrefs: 001051EC

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: c530ff0f6d2904aa7f9765eb474869ee0156d86d16bb8f6cbe98ddc4e3822db4
Instruction ID: 37eb5fdb8bda11da06ed03a210ea1fb6f9297fc9f375b8981da266e9f2b40c0b
Opcode Fuzzy Hash: c530ff0f6d2904aa7f9765eb474869ee0156d86d16bb8f6cbe98ddc4e3822db4
Instruction Fuzzy Hash: 8301F735691615FBE73C62689C8AFFB726AEF05740F204534F993E24D3DBD15C428990

Function 00116283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 001162DC
WSAGetLastError.WS2_32(00000000), ref: 001162EB
bind.WS2_32(00000000,?,00000010), ref: 00116307
listen.WS2_32(00000000,00000005), ref: 00116316
WSAGetLastError.WS2_32(00000000), ref: 00116330
closesocket.WS2_32(00000000), ref: 00116344

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 8bb2400dbf97be2cd4aec68968187e5b6874e5d62e0aa7c364b1a27938d516b7
Instruction ID: 7dc5e1540538ba062753a14df2d3847bc9391dfecea56cee43861f43bdd8b8c1
Opcode Fuzzy Hash: 8bb2400dbf97be2cd4aec68968187e5b6874e5d62e0aa7c364b1a27938d516b7
Instruction Fuzzy Hash: BE21D534600204AFCB14EF64C945BAEB7B9EF45710F14416CE916A7392CB70AC82CB61

Function 000B5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 000C0DB6: std::exception::exception.LIBCMT ref: 000C0DEC
Part of subcall function 000C0DB6: __CxxThrowException@8.LIBCMT ref: 000C0E01

_memmove.LIBCMT ref: 000F0258
_memmove.LIBCMT ref: 000F036D
_memmove.LIBCMT ref: 000F0414

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 3605413f2e3a52b35b7e3e64f70fcba7e6578b859c4e872103edefdd27321e42
Instruction ID: 0ecf445945182d8afba60e13d9aa2276c51ad2ce9969de3cef10f954b723a012
Opcode Fuzzy Hash: 3605413f2e3a52b35b7e3e64f70fcba7e6578b859c4e872103edefdd27321e42
Instruction Fuzzy Hash: 3A029FB0A00209DBCF14DF64D981ABEBBF5FF44300F1480A9E90ADB256EB35DA54DB91

Function 000A1287 Relevance: 7.9, APIs: 5, Instructions: 379nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 000A19FA
GetSysColor.USER32(0000000F), ref: 000A1A4E
SetBkColor.GDI32(?,00000000), ref: 000A1A61

Part of subcall function 000A1290: NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 000A12D8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ColorDialogNtdllProc_$LongWindow
String ID:
API String ID: 591255283-0
Opcode ID: 002683cf05a409f4d8f973307355b69daf830bc1d469b9b630149bbf429762cb
Instruction ID: 68ac22870946b65c35a23ad13c41867a6ac9da8bca02bfd957c7554854e5ea69
Opcode Fuzzy Hash: 002683cf05a409f4d8f973307355b69daf830bc1d469b9b630149bbf429762cb
Instruction Fuzzy Hash: ADA17870106694FAEB38ABA99C54EFF35DDDF67341F15021AF102D6692CB208D51D2B3

Function 0010BCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0010BCE6
_wcscmp.LIBCMT ref: 0010BD16
_wcscmp.LIBCMT ref: 0010BD2B
FindNextFileW.KERNEL32(00000000,?), ref: 0010BD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0010BD6C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 5d8930d5927a4aac2039ae7b076ed489225a964e212a2d3a2ee73eac73aa6128
Instruction ID: 6c438e3204830086cb202b08813790e7ad8f927d228ccfadc91c8ba55b8be89f
Opcode Fuzzy Hash: 5d8930d5927a4aac2039ae7b076ed489225a964e212a2d3a2ee73eac73aa6128
Instruction Fuzzy Hash: 93515E356086019FC718DFA8C4D0E9AB3E4EF49314F10462DE996873A2DB70ED05CB91

Function 00116747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00117D8B: inet_addr.WS2_32(00000000), ref: 00117DB6

socket.WS2_32(00000002,00000002,00000011), ref: 0011679E
WSAGetLastError.WS2_32(00000000), ref: 001167C7
bind.WS2_32(00000000,?,00000010), ref: 00116800
WSAGetLastError.WS2_32(00000000), ref: 0011680D
closesocket.WS2_32(00000000), ref: 00116821

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 9e2b5483dd7676de230afb08356ed42cbabc3834929e1a3db8b3b003f1988133
Instruction ID: ba69bfe317ffd7b74da3f337b960589a89af805e68fd3da55a240050934df0bf
Opcode Fuzzy Hash: 9e2b5483dd7676de230afb08356ed42cbabc3834929e1a3db8b3b003f1988133
Instruction Fuzzy Hash: 6441C275B00210AFDB14AFA48C86FAE77A89B06B14F04856CF915AB3D3CB749D4187A1

Function 00125376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 001253C5
IsWindowEnabled.USER32 ref: 001253D3
GetForegroundWindow.USER32(?,?,00000001), ref: 001253E0
IsIconic.USER32 ref: 001253EE
IsZoomed.USER32 ref: 001253FC

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: e3812b28f3d60630d05b92e6f7681c2f6b16cc273df1538e6aa968e2d036ca1a
Instruction ID: 258cdd526eedf400695325b1fe32c138869f48a4dbaee3f27ac98b02a3dfa642
Opcode Fuzzy Hash: e3812b28f3d60630d05b92e6f7681c2f6b16cc273df1538e6aa968e2d036ca1a
Instruction Fuzzy Hash: 3711C8317009216FD721AF26AC84A6EBBAAFF457A1F41403CF845D3242DB74DC6386A0

Function 000F80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 000F80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 000F80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 000F80D9
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 000F80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 000F80F6

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 406f409ee556390b64a012a85a02e37a00717c8ac68e7ab88b4dee4efe901cfd
Instruction ID: f626b4362b8d86dddf93aae4adddac20f6b69aa825831d3bcf81cf267f52fdf2
Opcode Fuzzy Hash: 406f409ee556390b64a012a85a02e37a00717c8ac68e7ab88b4dee4efe901cfd
Instruction Fuzzy Hash: F5F03C35240208BFEB204FA5EC89EB73BADFF49755F504139FA4586550CB619C93EB60

Function 0010C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0010C432
CoCreateInstance.COMBASE(00132D6C,00000000,00000001,00132BDC,?), ref: 0010C44A

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

CoUninitialize.COMBASE ref: 0010C6B7

Strings

.lnk, xrefs: 0010C3C6, 0010C3EE, 0010C3F8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: bbb31f09ce329a2e88a72a00d71cc745d93f99239ea8717c9395b2cde6977519
Instruction ID: 901dd1ac92cd183b71291b989ace9cb0396ab777f20f33c4f0ca8ff5b3d68654
Opcode Fuzzy Hash: bbb31f09ce329a2e88a72a00d71cc745d93f99239ea8717c9395b2cde6977519
Instruction Fuzzy Hash: 3FA12B71204205AFD700EF94CC81EABB7E8FF95354F00492DF5959B1A2DB71EA49CB62

Function 000A4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,000A4AD0), ref: 000A4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 000A4B57

Strings

GetNativeSystemInfo, xrefs: 000A4B51
kernel32.dll, xrefs: 000A4B40

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: b69cb3464d1ae1104106cd3a6e954355440f31bb72c1c9bd6f3fbd40567f4eee
Instruction ID: dbea9d3e8c441ddedae786154ecd998a7aae15d51b2f64f58b5e045ef4d8af95
Opcode Fuzzy Hash: b69cb3464d1ae1104106cd3a6e954355440f31bb72c1c9bd6f3fbd40567f4eee
Instruction Fuzzy Hash: E5D01234A10723DFD7209F71E818B06B6F4AF45751F11883D9485D6550D7B0D4E1C664

Function 000B3030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 267c4182c70bcd8c89355e1c6581e80d9d0aed9459705126cfda210d9b842439
Instruction ID: 447cee5c011a2e962d570d6a41d3fa10c39ec50250330422062d10ab94146a84
Opcode Fuzzy Hash: 267c4182c70bcd8c89355e1c6581e80d9d0aed9459705126cfda210d9b842439
Instruction Fuzzy Hash: 7F22AB716083409FC724DF64D891BAFB7E4AF85710F14492DF89AA7292DB71EA04CB92

Function 0011EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0011EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0011EE4B

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Process32NextW.KERNEL32(00000000,?), ref: 0011EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0011EF1A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 992ac426a88f15d0d7e1dcb70298edf5e161b63f95ba49244110774e6061ed2f
Instruction ID: dd210cc4e94cd060da7a7be99b1c798e3f9e7af28f304888af57d17fbb465a93
Opcode Fuzzy Hash: 992ac426a88f15d0d7e1dcb70298edf5e161b63f95ba49244110774e6061ed2f
Instruction Fuzzy Hash: 6B51A071504301AFD324EF60DC81EABB7E8FF95700F40482DF895972A2EB70A949CB92

Function 0012C498 Relevance: 6.1, APIs: 4, Instructions: 83nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

GetCursorPos.USER32(?), ref: 0012C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,000DB9AB,?,?,?,?,?), ref: 0012C4E7
GetCursorPos.USER32(?), ref: 0012C534
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,000DB9AB,?,?,?), ref: 0012C56E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: 583b5e3ff653256550588b4379688fac6e27758830a0501462ba9d941dcc3431
Instruction ID: eec2d8ec2135ab01430963bd500ca2741eba1228f5aff9c1b9fee6b423fe7600
Opcode Fuzzy Hash: 583b5e3ff653256550588b4379688fac6e27758830a0501462ba9d941dcc3431
Instruction Fuzzy Hash: FA31B435600068BFCB258F58E858DEE7BF6EB09350F044069FA0587661C731A961DFD4

Function 000F85B1 Relevance: 6.1, APIs: 4, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 000F85E2
OpenProcessToken.ADVAPI32(00000000), ref: 000F85E9
CloseHandle.KERNEL32(00000004), ref: 000F8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 000F8632

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: ddaaf8035a2251a652d1c96195e15972d5413f156c8279b465996bffef71da6b
Instruction ID: f15c9fd57b6e051c475664fb30ab55a610d7679d13ec704e559d0b92dfb26932
Opcode Fuzzy Hash: ddaaf8035a2251a652d1c96195e15972d5413f156c8279b465996bffef71da6b
Instruction Fuzzy Hash: 3F114A7250024DBBDF118FA4ED49FEE7BB9EB08704F048069FE04A2560C6718D62EB60

Function 000A1290 Relevance: 6.1, APIs: 4, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 000A12D8
GetClientRect.USER32(?,?), ref: 000DB5FB
GetCursorPos.USER32(?), ref: 000DB605
ScreenToClient.USER32(?,?), ref: 000DB610

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Client$CursorDialogLongNtdllProc_RectScreenWindow
String ID:
API String ID: 1010295502-0
Opcode ID: e2997cbd315e377451ff5494eb1edb616915c6e83bb869a9c8411c91229234d2
Instruction ID: 4e9fb81fd9debc5113908d95c8a3cb4207f6ee9ff4400a848ac7bed76d54a8b2
Opcode Fuzzy Hash: e2997cbd315e377451ff5494eb1edb616915c6e83bb869a9c8411c91229234d2
Instruction Fuzzy Hash: C7110A39500519FFCB10DF98D985AFE77B9EB06301F500466F901E7651D730FAA28BA5

Function 001122EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0011180A,00000000), ref: 001123E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00112418

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: ae301d69e4d883f696e3e88066c75c2e36acfd266b7dde377a6ab928aa23456a
Instruction ID: 52b5e7cc0488f5feb5f46e869617420a2092106a18485fe44f1c271dca979a86
Opcode Fuzzy Hash: ae301d69e4d883f696e3e88066c75c2e36acfd266b7dde377a6ab928aa23456a
Instruction Fuzzy Hash: DF41D071A04209BFEB289B95DC81FFFB7ACEB44314F10403EF611A6541EB749EA19660

Function 0010B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0010B343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0010B39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0010B3EA

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 3847d174bfbd906c36092731d5383ba4c9f0b31b20dfefc0b841ed8170c645a2
Instruction ID: 2666c3a5c8050af1ea03e9b95241b178d06548e3dae76b9c50600c0617460710
Opcode Fuzzy Hash: 3847d174bfbd906c36092731d5383ba4c9f0b31b20dfefc0b841ed8170c645a2
Instruction Fuzzy Hash: 4E217135A00508EFCB00EFA5D881AEEBBB8FF49310F1480A9E905AB351DB359956CB51

Function 000F87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 000C0DB6: std::exception::exception.LIBCMT ref: 000C0DEC
Part of subcall function 000C0DB6: __CxxThrowException@8.LIBCMT ref: 000C0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000F882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000F8858
GetLastError.KERNEL32 ref: 000F8865

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: b1e5951f9561125f5d64d2f4465ddacc6949d01389c27a4ad09a85b926fdaa2e
Instruction ID: aa2d7bfa52939b1e2e918df40b58ab953f4ec8baf7631dae7529633034ac0139
Opcode Fuzzy Hash: b1e5951f9561125f5d64d2f4465ddacc6949d01389c27a4ad09a85b926fdaa2e
Instruction Fuzzy Hash: 941160B1414205AFD728DF54DC85D6BB7FDEB44750B10852EF45697641DE30AC42CB60

Function 000F874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 000F8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 000F878B
FreeSid.ADVAPI32(?), ref: 000F879B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 71b84890bf0aa180825bff28fa1da21bce211eb9f63beb81bbf8ce94c27bd6fd
Instruction ID: 4a917b7c1154f715a3d05c7ef1355a186421682f409134e2198f31b761957107
Opcode Fuzzy Hash: 71b84890bf0aa180825bff28fa1da21bce211eb9f63beb81bbf8ce94c27bd6fd
Instruction Fuzzy Hash: 62F08735A0030CBFDB00DFE09C89AAEBBB8EF08200F1044A8AA01E2581E6306A558B14

Function 000A16DE Relevance: 3.1, APIs: 2, Instructions: 83nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

Part of subcall function 000A25DB: GetWindowLongW.USER32(?,000000EB), ref: 000A25EC

GetParent.USER32(?), ref: 000DB7BA
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,000A19B3,?,?,?,00000006,?), ref: 000DB834

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: 84814f811bfea9cc08ba8d9e571716c774bcd58655433ec0c4e1e7f9d5105fec
Instruction ID: f82707e118be43040970eab7c69a1920ce9a6f5a475c7eb0f893b5a1e1bcdfb9
Opcode Fuzzy Hash: 84814f811bfea9cc08ba8d9e571716c774bcd58655433ec0c4e1e7f9d5105fec
Instruction Fuzzy Hash: 77218D34209604AFCB608F68C9849ED3BE7AF4A320F584265F5655B3A2CB319D52EB60

Function 0010C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0010C6FB
FindClose.KERNEL32(00000000), ref: 0010C72B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d281fcd31415dc5d4469dd2affffe5ae5c0ee2cb4417efa529b103b95daa2f11
Instruction ID: 42a1b917df81a09edcd566896d533cd99c8a0763b1aa47fd76f094eac01b8078
Opcode Fuzzy Hash: d281fcd31415dc5d4469dd2affffe5ae5c0ee2cb4417efa529b103b95daa2f11
Instruction Fuzzy Hash: 4E118E726006049FDB10DF29C845A6AF7E9FF85320F00861DF9A997291DB74A801CF91

Function 0012C57D Relevance: 3.0, APIs: 2, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,000DB93A,?,?,?), ref: 0012C5F1

Part of subcall function 000A25DB: GetWindowLongW.USER32(?,000000EB), ref: 000A25EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 0012C5D7

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID:
API String ID: 1273190321-0
Opcode ID: 5fa2100f9c1e30a4fc23fd5d2a53f2375d4d2dda340b6405654d9e25f4fe8463
Instruction ID: 82925bc36a2e5828a50bcda247a69eefb41655ea09b090a07fa61596ff1ed811
Opcode Fuzzy Hash: 5fa2100f9c1e30a4fc23fd5d2a53f2375d4d2dda340b6405654d9e25f4fe8463
Instruction Fuzzy Hash: E101D831300614ABCB255F18DC44E6E3BB7FF86360F144128FA411B6E1CB71A862DBD0

Function 0012C93E Relevance: 3.0, APIs: 2, Instructions: 33nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0012C961
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,000DBA16,?,?,?,?,?), ref: 0012C98A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: eb1c7bc1ecc22b5294342f0f3b76f58198b60fb38487fcf721d69565e0ee63fb
Instruction ID: 0f156c6fdf5375de45ddd900335e71fb7c695ef3b87b146daa0f0fff0d02cc65
Opcode Fuzzy Hash: eb1c7bc1ecc22b5294342f0f3b76f58198b60fb38487fcf721d69565e0ee63fb
Instruction Fuzzy Hash: 2BF0307240011CFFDF149F45DC09DAE7BB9FB44311F00416AF90552561D3716AA5DBA4

Function 0010A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00119468,?,0012FB84,?), ref: 0010A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00119468,?,0012FB84,?), ref: 0010A0A9

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d4d37b5042e0304680ec22ce0aed8ced3b2aa20131ab6730324313c431c9f149
Instruction ID: bdc0dc247c53af7fd31ab49784b4aa22d4de382dc5b66155fce13b6495627ba9
Opcode Fuzzy Hash: d4d37b5042e0304680ec22ce0aed8ced3b2aa20131ab6730324313c431c9f149
Instruction Fuzzy Hash: 0BF0823510532DBBDB219FA4CC48FEA776CFF09761F00826AF909D6181DB709951CBA1

Function 0012CA7C Relevance: 3.0, APIs: 2, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0012CA84
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,000DB995,?,?,?,?), ref: 0012CAB2

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 4dc93e69a54435e574bcaf389ee9a26c97616e67ef9a9dbb381a52fb839fc750
Instruction ID: 675854e8af251432d5a1d7195b78b2c6e81cb62f8c2c09627d51d1270a1421a6
Opcode Fuzzy Hash: 4dc93e69a54435e574bcaf389ee9a26c97616e67ef9a9dbb381a52fb839fc750
Instruction Fuzzy Hash: 3FE08670100258BFEB249F1DEC0AFBE3B64EB04751F408529F956DA1E1D77098A1D7A0

Function 000F81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,000F8309), ref: 000F81E0
CloseHandle.KERNEL32(?,?,000F8309), ref: 000F81F2

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 7a1567a142da7a57a4aceeea6deff531d1c92d322edb61d3b0f1e620738a35e0
Instruction ID: 40b45cbec82e083f8eccd95b566506588d4aa01ebf4076e3eaea7cd1af2801ca
Opcode Fuzzy Hash: 7a1567a142da7a57a4aceeea6deff531d1c92d322edb61d3b0f1e620738a35e0
Instruction Fuzzy Hash: 54E0BF71010510EEE7252B60EC09EB777EEEB04310B14892DB955C4871DB616CA2DB10

Function 000CA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00134178,000C8D57,t of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.,?,?,00000001), ref: 000CA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 000CA163

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 09c53ce8244f9851f3ebc410f9e7a298fac6fc12438f8b146647062e039faecf
Instruction ID: 539286daa2931981b77e3187fdbeee35fbb815963bb2fd5f7aab3b5d1bfcf05f
Opcode Fuzzy Hash: 09c53ce8244f9851f3ebc410f9e7a298fac6fc12438f8b146647062e039faecf
Instruction Fuzzy Hash: E3B09231054208FBCA106B91EC09B883F78FB44AA2F404034F60D84860CB6254A3CA91

Function 000CF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894644d06617243525ca60abfbe0adb4c6169343bb577e4226f9282e88ea3c57
Instruction ID: 06606186e2d4a6786112f03876bcccd3703c46df195638be5124c02dabbb23c6
Opcode Fuzzy Hash: 894644d06617243525ca60abfbe0adb4c6169343bb577e4226f9282e88ea3c57
Instruction Fuzzy Hash: CD321361D29F064DDB639634D83233AA299AFB73C4F15D73BE819B5DA9EB28C4C34101

Function 000D242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f464c8f24513ee355db6628f7b617bf26d89feeb59fafadc4c104d1a2fb40881
Instruction ID: 54fa4fedd3d044c08b1f46860ec7bc1b0a4321093a07603250bd72a7dd402141
Opcode Fuzzy Hash: f464c8f24513ee355db6628f7b617bf26d89feeb59fafadc4c104d1a2fb40881
Instruction Fuzzy Hash: 98B1DE21E2AF414DD22396398835336BA5CAFBB2C5F91D71BFC6674D62EB2285C34141

Function 00108889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0010889B

Part of subcall function 000C520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00108F6E,00000000,?,?,?,?,0010911F,00000000,?), ref: 000C5213
Part of subcall function 000C520A: __aulldiv.LIBCMT ref: 000C5233

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: c6ecb052af9ad8bf240a57d3cad7689426f1611f928e4a50989ab2ec7a33f1b9
Instruction ID: 0d781f6e770b34f8e128c05ab0eb3f430f0fc3d4d9e4bca91e66381a8de4e525
Opcode Fuzzy Hash: c6ecb052af9ad8bf240a57d3cad7689426f1611f928e4a50989ab2ec7a33f1b9
Instruction Fuzzy Hash: 7521AF326256108BC729CF29D841A52B3E1EBA5311B688E6DD1F6CB2C0CBB4B945CB94

Function 0012D78C Relevance: 1.6, APIs: 1, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

NtdllDialogWndProc_W.NTDLL(?,00000112,?,00000000), ref: 0012D838

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 0e75330fadd6cb9a6a4d3b0ec296a991a1d89473fb6b028f386126b08beff823
Instruction ID: dfb0da000004b4a93cd4e4bf3f3d275f65a8f4e5a67e774496bb7bc2e4e8b124
Opcode Fuzzy Hash: 0e75330fadd6cb9a6a4d3b0ec296a991a1d89473fb6b028f386126b08beff823
Instruction Fuzzy Hash: 6D11E335204275BFEB295B2CFD06FBA3715DB42720F604324F9225A9E2CB64AD3093A4

Function 0012D3B8 Relevance: 1.5, APIs: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A25DB: GetWindowLongW.USER32(?,000000EB), ref: 000A25EC

NtdllDialogWndProc_W.NTDLL(?,00000115,?,?,?,?,?,?,000DB952,?,?,?,?,00000000,?), ref: 0012D432

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: a4382e53a2d7956cfa9a9099387516f8c12d8bc0c6961c06622765420a201016
Instruction ID: b9a8974e90a2b2d490963c53a0766a9c84854d7f46ad46b5e3451563ae21d9e6
Opcode Fuzzy Hash: a4382e53a2d7956cfa9a9099387516f8c12d8bc0c6961c06622765420a201016
Instruction Fuzzy Hash: 5301D831600564AFDB18EF29F849AF93B52EF46321F444125F9565B591C331BC7297A0

Function 0012BC5D Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 000A25DB: GetWindowLongW.USER32(?,000000EB), ref: 000A25EC

CallWindowProcW.USER32(?,?,00000020,?,?), ref: 0012BCA3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$CallLongProc
String ID:
API String ID: 4084987330-0
Opcode ID: 338a7ac4ccae706667a5b1de9949863a9d66976f4a0837b26f366bbbcfde6efd
Instruction ID: 4fc62aa0f642058481e9451cd9fc479a26417b2793edb87b61c884d97654c292
Opcode Fuzzy Hash: 338a7ac4ccae706667a5b1de9949863a9d66976f4a0837b26f366bbbcfde6efd
Instruction Fuzzy Hash: 52F04F31104518FFCF159F54ED80CB93BAAEB48360F048124F9114A671CB32ACB1EB90

Function 000A189B Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

NtdllDialogWndProc_W.NTDLL(?,00000006,00000000,?,?,?,000A1B04,?,?,?,?,?), ref: 000A18E2

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 806540dcb0f6ab0007e5591810d779ff0357f53a31384a1b2c7fc8f02dfe50d2
Instruction ID: d9a8f8293bba60d113dbfad6f687a03313b05b90e0a2a73a6fe73e71f3fec52c
Opcode Fuzzy Hash: 806540dcb0f6ab0007e5591810d779ff0357f53a31384a1b2c7fc8f02dfe50d2
Instruction Fuzzy Hash: 7FF0E231200215EFCB18DF49CC509BA37E2FB01350F904228F9524B6E1CB75DCA0DBA0

Function 0012C8BE Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 0012C8FE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 9acc48c84f3dc56c8a52c7047de2721117dc0278d8199c8ef19363e2a06d8072
Instruction ID: 1731a53a747543855ef60a11022726a60a777ba74ec86b53ab3a8af2dc732a2d
Opcode Fuzzy Hash: 9acc48c84f3dc56c8a52c7047de2721117dc0278d8199c8ef19363e2a06d8072
Instruction Fuzzy Hash: 02F06D31600255BFDB21DF58DD05FC63BA5EB09320F448018FA11672E2CBB07870DBA0

Function 00104C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00104C4A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 1c0acd617303be076d22b7a6e3181422a300ae09bdcb857731609c6a256985e7
Instruction ID: 778efa1e14abdd85cc9034b2c67e60a03f9dd6333767744475a7a834fcc435c2
Opcode Fuzzy Hash: 1c0acd617303be076d22b7a6e3181422a300ae09bdcb857731609c6a256985e7
Instruction Fuzzy Hash: A6D05EF51652093BFE2C07209F8FF7A1108E380782FD1818973818A0C1EEC49C415030

Function 000F87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,000F8389), ref: 000F87D1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: f6bb94e645288441d946848c008bf250f33dfaf9ab9f721fa06e06de7f8c4814
Instruction ID: c18100f5a29489a876633678cd6ca5a6c2a1161ec1717a8ccc306b9613ce20e0
Opcode Fuzzy Hash: f6bb94e645288441d946848c008bf250f33dfaf9ab9f721fa06e06de7f8c4814
Instruction Fuzzy Hash: 9ED05E3226050EBBEF018EA4ED05EAE3B6AEB04B01F408121FE15D50A1C775D836AB60

Function 0012C909 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,000DB9BC,?,?,?,?,?,?), ref: 0012C934

Part of subcall function 0012B635: _memset.LIBCMT ref: 0012B644
Part of subcall function 0012B635: _memset.LIBCMT ref: 0012B653
Part of subcall function 0012B635: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00166F20,00166F64), ref: 0012B682
Part of subcall function 0012B635: CloseHandle.KERNEL32 ref: 0012B694

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: de165473c388887bb9008014b644e93041ce0a743de950c1fb6b88b3877e15d2
Instruction ID: d73e0c7784c8b91b3b1cf63e4cea8d88a1c579a29c424ed74301df079ff44c00
Opcode Fuzzy Hash: de165473c388887bb9008014b644e93041ce0a743de950c1fb6b88b3877e15d2
Instruction Fuzzy Hash: A9E01231100218EFCB11AF44ED50E8937B6FB18305F018024FA05072B2C731A8B0EF90

Function 000A167D Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?,?,000A1AEE,?,?,?), ref: 000A16AB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 5e47c3d390bb77e65c5cec50e532da69289e6c87c441fc38f14d206ac9a65c10
Instruction ID: 061da5b549e1fadbf5bc386f0a5b5350ed9a45f79e62a898660f124db859d38d
Opcode Fuzzy Hash: 5e47c3d390bb77e65c5cec50e532da69289e6c87c441fc38f14d206ac9a65c10
Instruction Fuzzy Hash: FDE01235100208FBCF15AF94DD11EA43B2BFB59310F508428FA451B6A2CB73A572DB50

Function 0012C860 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 0012C885

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 6fdbafa2096eb4c5123e3a711913ac8a83ea72d6d0536d6ea2d02f6a5c5bdc39
Instruction ID: fad3de698de204b35f0c610fd62cd7d260baa45e722bff30b34aa347463f5374
Opcode Fuzzy Hash: 6fdbafa2096eb4c5123e3a711913ac8a83ea72d6d0536d6ea2d02f6a5c5bdc39
Instruction Fuzzy Hash: 13E0E235200209EFCB01DF88DC84E863BA5AB1D300F004064FA0547662C771A870EB61

Function 0012C88F Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 0012C8B4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: adb8e318d99c8ecbbeeeab571fc781a4601ebaec361e2809d2462268ffba7848
Instruction ID: e6c309420c2fbdc82bc3c4ed3adbcabbe12602927f8d20d440b3b31a3ae4de5a
Opcode Fuzzy Hash: adb8e318d99c8ecbbeeeab571fc781a4601ebaec361e2809d2462268ffba7848
Instruction Fuzzy Hash: 53E0E235200209EFCB01DF88D944D863BA5AB1D300F004064FA0547662C771A8B0EBA1

Function 000A16B5 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

Part of subcall function 000A201B: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 000A20D3
Part of subcall function 000A201B: KillTimer.USER32(-00000001,?,?,?,?,000A16CB,00000000,?,?,000A1AE2,?,?), ref: 000A216E

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,000A1AE2,?,?), ref: 000A16D4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: 620d8cd6049cff0ee32f706d293e5d23d076158dbdedef6be41f72839ed2f0f8
Instruction ID: a3eaa268374a8e0a1268c13cfcaf8c43f9b2094e90c68c70b6fa789f83628bfa
Opcode Fuzzy Hash: 620d8cd6049cff0ee32f706d293e5d23d076158dbdedef6be41f72839ed2f0f8
Instruction Fuzzy Hash: 2DD01230140308B7DB202F94DE17F893A1A9B15750F808030BB04291D3CB716871A558

Function 000CA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 000CA12A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1c61813b8144847544b520543a7fd12e33e2775919bd966ce3e2992117090436
Instruction ID: 20679b9e9d9756be118a43633f1d84b71541986935c51ab28831a09cb6e9ca96
Opcode Fuzzy Hash: 1c61813b8144847544b520543a7fd12e33e2775919bd966ce3e2992117090436
Instruction Fuzzy Hash: 86A0113000020CFB8A002B82EC08888BFACEB002A0B008030F80C808228B32A8A28A80

Function 000B8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70fb4a8e2df2238ab5c76b6e3d5d0f0108cdd4e57007300d18b842ca80ecbab
Instruction ID: 7d07aeb7adc467f0bb94b678c91ef5b23ee4820a0192a46649c2602c72333a49
Opcode Fuzzy Hash: b70fb4a8e2df2238ab5c76b6e3d5d0f0108cdd4e57007300d18b842ca80ecbab
Instruction Fuzzy Hash: 8A22363050460ACBEF788A64C8947BD77E5FB41305F28C06BDB468B9B2DB74AD91E742

Function 000C21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 60e427fca34c55f6ef2a07ed9d7c811bdc8ac4e7ba2c41a8dc56239506f2e35d
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 32C193322050930AEBAD47398434A7EFAE15FA37B131A076DD8B3CB5D5EE20C975D660

Function 000C25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: bf8ccc6340ada184a719e41f1ee1d8f1c56e0077548bd694bcb9b557ed25036c
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 25C1D4322051930AEFAD47398474A7EBAE15FA37B131A036DD4B3DB4D5EE20C974D660

Function 000C1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: ba13be34c23054be7148481fa2eb852543c45b4815cad543e35bf314f19a8992
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 19C1A43220509309EFAD47398474ABEBAE15FA37B131A075DE4B3CB1C6EE20C975D660

Function 000B8C74 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b96d2019149ad045e2fab9f7ce87151d33c874815b8ca7d8b37dc5c546f561
Instruction ID: 9038406eb8812c421809f57402a0d7c6efdd8a64357c833ff4db4b6114bc33b6
Opcode Fuzzy Hash: a0b96d2019149ad045e2fab9f7ce87151d33c874815b8ca7d8b37dc5c546f561
Instruction Fuzzy Hash: F511E1385051088FCB619F7DC8905F5BBF9EFA6320B95C1ABD881CB1A2EA344D86C711

Function 0012356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0012F910), ref: 00123627
IsWindowVisible.USER32(?), ref: 0012364B

Strings

ADDSTRING, xrefs: 00123716
SHOWDROPDOWN, xrefs: 001236E0
GETCURRENTLINE, xrefs: 001238ED
HIDEDROPDOWN, xrefs: 00123700
ISENABLED, xrefs: 0012366B
SELECTSTRING, xrefs: 00123806
CHECK, xrefs: 0012386D
ISCHECKED, xrefs: 00123839
SENDCOMMANDID, xrefs: 001239DA
CURRENTTAB, xrefs: 001236BD
GETCURRENTCOL, xrefs: 00123928
TABLEFT, xrefs: 00123687
SETCURRENTSELECTION, xrefs: 001237B6
GETSELECTED, xrefs: 001238A3
FINDSTRING, xrefs: 00123776
GETLINE, xrefs: 0012399B
DELSTRING, xrefs: 00123749
EDITPASTE, xrefs: 0012395F
GETLINECOUNT, xrefs: 001238C6
ISVISIBLE, xrefs: 00123637
TABRIGHT, xrefs: 0012369D
UNCHECK, xrefs: 00123883
GETCURRENTSELECTION, xrefs: 001237E3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: dd24feb49264852c05e92512528aec4bfc58988004e4dc33ac2901bd93ca6983
Instruction ID: 953d6bbd996f2d732cd5186656654afbace0521e793345917b326c4d2b0a0c94
Opcode Fuzzy Hash: dd24feb49264852c05e92512528aec4bfc58988004e4dc33ac2901bd93ca6983
Instruction Fuzzy Hash: D0D19F30208311DBCB04EF10D551EAEB7A5AF95344F05446CF8A2AB3A3DB35EE5ACB52

Function 0012A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0012A630
GetSysColorBrush.USER32(0000000F), ref: 0012A661
GetSysColor.USER32(0000000F), ref: 0012A66D
SetBkColor.GDI32(?,000000FF), ref: 0012A687
SelectObject.GDI32(?,00000000), ref: 0012A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0012A6C1
GetSysColor.USER32(00000010), ref: 0012A6C9
CreateSolidBrush.GDI32(00000000), ref: 0012A6D0
FrameRect.USER32(?,?,00000000), ref: 0012A6DF
DeleteObject.GDI32(00000000), ref: 0012A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0012A731
FillRect.USER32(?,?,00000000), ref: 0012A763
GetWindowLongW.USER32(?,000000F0), ref: 0012A78E

Part of subcall function 0012A8CA: GetSysColor.USER32(00000012), ref: 0012A903
Part of subcall function 0012A8CA: SetTextColor.GDI32(?,?), ref: 0012A907
Part of subcall function 0012A8CA: GetSysColorBrush.USER32(0000000F), ref: 0012A91D
Part of subcall function 0012A8CA: GetSysColor.USER32(0000000F), ref: 0012A928
Part of subcall function 0012A8CA: GetSysColor.USER32(00000011), ref: 0012A945
Part of subcall function 0012A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0012A953
Part of subcall function 0012A8CA: SelectObject.GDI32(?,00000000), ref: 0012A964
Part of subcall function 0012A8CA: SetBkColor.GDI32(?,00000000), ref: 0012A96D
Part of subcall function 0012A8CA: SelectObject.GDI32(?,?), ref: 0012A97A
Part of subcall function 0012A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0012A999
Part of subcall function 0012A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0012A9B0
Part of subcall function 0012A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0012A9C5
Part of subcall function 0012A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0012A9ED

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 71742f74d4ef2f1421671dc44e325d0f885d4c1ca505a1b320f62add0ea916cb
Instruction ID: e2e3476aa5a84020ffe350524ae14c2af635c5e0b19a81b613fb9d8beb847eea
Opcode Fuzzy Hash: 71742f74d4ef2f1421671dc44e325d0f885d4c1ca505a1b320f62add0ea916cb
Instruction Fuzzy Hash: F8916B72408311BFC7209F64EC08E5B7BB9FF88321F500A2DF962961A1D771D9A6CB52

Function 001174AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 001174DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0011759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 001175DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 001175ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00117633
GetClientRect.USER32(00000000,?), ref: 0011763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00117683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00117692
GetStockObject.GDI32(00000011), ref: 001176A2
SelectObject.GDI32(00000000,00000000), ref: 001176A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 001176B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001176BF
DeleteDC.GDI32(00000000), ref: 001176C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 001176F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0011770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00117746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0011775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0011776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0011779B
GetStockObject.GDI32(00000011), ref: 001177A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 001177B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 001177BB

Strings

DISPLAY, xrefs: 00117688
AutoIt v3, xrefs: 0011762B
static, xrefs: 0011767D, 00117795
msctls_progress32, xrefs: 0011773C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 76e63e6d2b791e81f29fe22bc104e9eb2731f43c8e4fb85a3ce24b6064b4619b
Instruction ID: 9bd9d24d5519cd67d6f5aacc47e65b30aeb933ccb7753907b2f994a2b9ed628e
Opcode Fuzzy Hash: 76e63e6d2b791e81f29fe22bc104e9eb2731f43c8e4fb85a3ce24b6064b4619b
Instruction Fuzzy Hash: E2A18471A00615BFEB14DBA4DC4AFAF7B7AEB05710F004128FA14A76E1C7B0AD51CB60

Function 0010AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0010AD1E
GetDriveTypeW.KERNEL32(?,0012FAC0,?,\\.\,0012F910), ref: 0010ADFB
SetErrorMode.KERNEL32(00000000,0012FAC0,?,\\.\,0012F910), ref: 0010AF59

Strings

SAS, xrefs: 0010AF05
SCSI, xrefs: 0010AEC6
RAID, xrefs: 0010AEF7
SATA, xrefs: 0010AF0C
Network, xrefs: 0010AE39
\\.\, xrefs: 0010AD70
SSA, xrefs: 0010AEE2
FileBackedVirtual, xrefs: 0010AF28
ATAPI, xrefs: 0010AECD
Virtual, xrefs: 0010AF21
Removable, xrefs: 0010AE4D
SSD, xrefs: 0010AE86
iSCSI, xrefs: 0010AEFE
MMC, xrefs: 0010AF1A
RAMDisk, xrefs: 0010AE25
Fibre, xrefs: 0010AEE9
USB, xrefs: 0010AEF0
1394, xrefs: 0010AEDB
Unknown, xrefs: 0010AE1B, 0010AEBF
CDROM, xrefs: 0010AE2F
ATA, xrefs: 0010AED4
PhysicalDrive, xrefs: 0010ADA7
Fixed, xrefs: 0010AE43

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 177832ac8422150a3983585418ff20976ddba87f3e639fc2688dc4887a0c7fd7
Instruction ID: a6b898d564b5b313cecff11d9c09d449ec58886e10a5b3de5d909a8855d1154d
Opcode Fuzzy Hash: 177832ac8422150a3983585418ff20976ddba87f3e639fc2688dc4887a0c7fd7
Instruction Fuzzy Hash: 1B51B2B0644306EBCB14EB60C942CBD73A5EF09701BA08066E897BB2D1DFB09D45DB53

Function 000A68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 000A6931
__wcsnicmp.LIBCMT ref: 000A6949
__wcsnicmp.LIBCMT ref: 000A6961
__wcsnicmp.LIBCMT ref: 000A6979
__wcsnicmp.LIBCMT ref: 000A6991
__wcsnicmp.LIBCMT ref: 000A69A9
__wcsnicmp.LIBCMT ref: 000A69C1
__wcsnicmp.LIBCMT ref: 000A69D5
__wcsnicmp.LIBCMT ref: 000A6A16
__wcsnicmp.LIBCMT ref: 000A6A2A
__wcsnicmp.LIBCMT ref: 000A6A3E
__wcsnicmp.LIBCMT ref: 000A6A52

Strings

Cannot parse #include, xrefs: 000DE3F0
#include-once, xrefs: 000A698B
#ce, xrefs: 000A6A4C
#comments-start, xrefs: 000A69BB, 000A6A10
Bad directive syntax error, xrefs: 000DE31A
#pragma compile, xrefs: 000A692B
#requireadmin, xrefs: 000A695B
#OnAutoItStartRegister, xrefs: 000A6973
#notrayicon, xrefs: 000A6943
Unterminated group of comments, xrefs: 000DE403
#cs, xrefs: 000A69CF, 000A6A24
#comments-end, xrefs: 000A6A38
#include, xrefs: 000A69A3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 62441ea3cddd2df637f456a185e7bbe5444a27aa1c3c335d4ffc2374b82f677a
Instruction ID: 7456fc570bb30308fa2d236fc28756fdaae367797c5aec9ed62d86998dd01a4b
Opcode Fuzzy Hash: 62441ea3cddd2df637f456a185e7bbe5444a27aa1c3c335d4ffc2374b82f677a
Instruction Fuzzy Hash: 2D81EBB1644305AACB21BBA0EC47FFF37B8AF16700F084029F905AB197EB71DA55D661

Function 000A2C18 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 000A2CA2
DeleteObject.GDI32(00000000), ref: 000A2CE8
DeleteObject.GDI32(00000000), ref: 000A2CF3
DestroyCursor.USER32(00000000), ref: 000A2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 000A2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 000DC43B
6FCB0200.COMCTL32(?,000000FF,?), ref: 000DC474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 000DC89D

Part of subcall function 000A1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,000A2036,?,00000000,?,?,?,?,000A16CB,00000000,?), ref: 000A1B9A

SendMessageW.USER32(?,00001053), ref: 000DC8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 000DC8F1

Strings

0, xrefs: 000DC731

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: DestroyMessageSendWindow$DeleteObject$B0200CursorInvalidateMoveRect
String ID: 0
API String ID: 3010530511-4108050209
Opcode ID: d1d82022bd0b0bb80cdece56b830cce90c19217a162e362445b97c4f4beb094b
Instruction ID: 6ccc12c06790ff6834b26b6430a0ca49e9fb23113a13ba3cde1057e54678f9ee
Opcode Fuzzy Hash: d1d82022bd0b0bb80cdece56b830cce90c19217a162e362445b97c4f4beb094b
Instruction Fuzzy Hash: 7D125C30604602AFEB658F28C884FA9B7E5BF45310F54457AF495CB662CB31E892DBA1

Function 00129A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00129AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00129B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00129BA7

Strings

0, xrefs: 00129BE4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 955c259e31a7094110de7a553448b2e2ede6d25a73fd322e9e691d76502dfb4e
Instruction ID: 213cff6e459b1c8d25e429476d5d5da3a5f4055e8e16efd62c7f104db359642d
Opcode Fuzzy Hash: 955c259e31a7094110de7a553448b2e2ede6d25a73fd322e9e691d76502dfb4e
Instruction Fuzzy Hash: BD020270104321AFD725CF28ED48BAABBE5FF49310F04852CF999D62A1C734D9A5CB52

Function 0012A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0012A903
SetTextColor.GDI32(?,?), ref: 0012A907
GetSysColorBrush.USER32(0000000F), ref: 0012A91D
GetSysColor.USER32(0000000F), ref: 0012A928
CreateSolidBrush.GDI32(?), ref: 0012A92D
GetSysColor.USER32(00000011), ref: 0012A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0012A953
SelectObject.GDI32(?,00000000), ref: 0012A964
SetBkColor.GDI32(?,00000000), ref: 0012A96D
SelectObject.GDI32(?,?), ref: 0012A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0012A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0012A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0012A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0012A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0012AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0012AA32
DrawFocusRect.USER32(?,?), ref: 0012AA3D
GetSysColor.USER32(00000011), ref: 0012AA4B
SetTextColor.GDI32(?,00000000), ref: 0012AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0012AA67
SelectObject.GDI32(?,0012A5FA), ref: 0012AA7E
DeleteObject.GDI32(?), ref: 0012AA89
SelectObject.GDI32(?,?), ref: 0012AA8F
DeleteObject.GDI32(?), ref: 0012AA94
SetTextColor.GDI32(?,?), ref: 0012AA9A
SetBkColor.GDI32(?,?), ref: 0012AAA4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: c95fd7749cc879dc68c3fd7f816d913bd68a169a1525814c002309e36052f332
Instruction ID: 43d03b29df357984cceb55e4686f28223a3fd51c3f141045deecf81f6798f7e2
Opcode Fuzzy Hash: c95fd7749cc879dc68c3fd7f816d913bd68a169a1525814c002309e36052f332
Instruction Fuzzy Hash: 6B513E71900218FFDF119FA4DC48EAE7B79EF08320F114129F911AB2A1D77599A2DF90

Function 001289D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00128AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00128AD2
CharNextW.USER32(0000014E), ref: 00128B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00128B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00128B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00128B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00128B86
SetWindowTextW.USER32(?,0000014E), ref: 00128BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00128BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00128C1F
_memset.LIBCMT ref: 00128C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00128C8D
_memset.LIBCMT ref: 00128CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00128D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00128D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00128E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00128E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00128E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00128EB4
DrawMenuBar.USER32(?), ref: 00128EC3
SetWindowTextW.USER32(?,0000014E), ref: 00128EEB

Strings

0, xrefs: 00128E55

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 6596f1db3f35bc2f02449c95a06cf448e621f2b47eca607277e35a13bb4294b1
Instruction ID: 73c223538c3b99f00d279494f24e1090eb3d246464f652cf7d542b7b18d7afa3
Opcode Fuzzy Hash: 6596f1db3f35bc2f02449c95a06cf448e621f2b47eca607277e35a13bb4294b1
Instruction Fuzzy Hash: D7E17170901228AFDF209F64DC84EEE7B79EF05710F10815AF915AB291DF709AA6DF60

Function 0012488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001249CA
GetDesktopWindow.USER32 ref: 001249DF
GetWindowRect.USER32(00000000), ref: 001249E6
GetWindowLongW.USER32(?,000000F0), ref: 00124A48
DestroyWindow.USER32(?), ref: 00124A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00124A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00124ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00124AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00124AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00124B09
IsWindowVisible.USER32(?), ref: 00124B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00124B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00124B58
GetWindowRect.USER32(?,?), ref: 00124B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00124B96
GetMonitorInfoW.USER32(00000000,?), ref: 00124BB0
CopyRect.USER32(?,?), ref: 00124BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00124C32

Strings

0, xrefs: 00124975
tooltips_class32, xrefs: 00124A96
(, xrefs: 00124BA3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 557c3ad461d27e16ad1f52f137c50abf09956c1408a270e9dd9528d91bdff076
Instruction ID: 36c5f422a495e10f4b97f3170e36950e067b4f4f9e5e2efa271c0d62ea22eba5
Opcode Fuzzy Hash: 557c3ad461d27e16ad1f52f137c50abf09956c1408a270e9dd9528d91bdff076
Instruction Fuzzy Hash: 14B1AA70604350AFDB14DF64D848B6ABBE4FF89310F00892CF99A9B2A1D770EC55CB96

Function 000A27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000A28BC
GetSystemMetrics.USER32(00000007), ref: 000A28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000A28EF
GetSystemMetrics.USER32(00000008), ref: 000A28F7
GetSystemMetrics.USER32(00000004), ref: 000A291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 000A2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 000A2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 000A297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 000A2990
GetClientRect.USER32(00000000,000000FF), ref: 000A29AE
GetStockObject.GDI32(00000011), ref: 000A29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 000A29D5

Part of subcall function 000A2344: GetCursorPos.USER32(?), ref: 000A2357
Part of subcall function 000A2344: ScreenToClient.USER32(001657B0,?), ref: 000A2374
Part of subcall function 000A2344: GetAsyncKeyState.USER32(00000001), ref: 000A2399
Part of subcall function 000A2344: GetAsyncKeyState.USER32(00000002), ref: 000A23A7

SetTimer.USER32(00000000,00000000,00000028,000A1256), ref: 000A29FC

Strings

AutoIt v3 GUI, xrefs: 000A2974

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5a79b073dccaed1e847ccb86e6c77eee0c1d3cacb4770debc0c713cfc0b8cf3b
Instruction ID: 6ee010205c04bfd8856bb293c24d9b4a13a8ec1c8deb02a42f4d9b5cbe15efa7
Opcode Fuzzy Hash: 5a79b073dccaed1e847ccb86e6c77eee0c1d3cacb4770debc0c713cfc0b8cf3b
Instruction Fuzzy Hash: C9B15C71A0020AEFDB24DFA8DD45BAE7BB5FB09311F104239FA15E76A0DB749851CB50

Function 0010449A Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00104500
_wcscmp.LIBCMT ref: 0010450B
_wcscat.LIBCMT ref: 00104521
_wcsstr.LIBCMT ref: 0010452C
754B1560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00104548
_wcscat.LIBCMT ref: 00104591
_wcscat.LIBCMT ref: 00104598
_wcsncpy.LIBCMT ref: 001045C3

Strings

04090000, xrefs: 0010457E
StringFileInfo\, xrefs: 0010451B
%u.%u.%u.%u, xrefs: 00104626
\VarFileInfo\Translation, xrefs: 00104540
DefaultLangCodepage, xrefs: 001045AB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _wcscat$B1560_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 2719676056-1459072770
Opcode ID: 875c88b00fb9834a5413465bafbac335f58563ea792e92d8deece8bcb637a73c
Instruction ID: ff445a8042c571babb88234755e5edc1ef3e8d328312b63308538583b0062235
Opcode Fuzzy Hash: 875c88b00fb9834a5413465bafbac335f58563ea792e92d8deece8bcb637a73c
Instruction Fuzzy Hash: 3D41AF72A40200BBDB14AB649C47FFF77ACDF45710F04406EFA05A61C3EB75AA1296A9

Function 000FA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 000FA47A
__swprintf.LIBCMT ref: 000FA51B
_wcscmp.LIBCMT ref: 000FA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 000FA583
_wcscmp.LIBCMT ref: 000FA5BF
GetClassNameW.USER32(?,?,00000400), ref: 000FA5F6
GetDlgCtrlID.USER32(?), ref: 000FA648
GetWindowRect.USER32(?,?), ref: 000FA67E
GetParent.USER32(?), ref: 000FA69C
ScreenToClient.USER32(00000000), ref: 000FA6A3
GetClassNameW.USER32(?,?,00000100), ref: 000FA71D
_wcscmp.LIBCMT ref: 000FA731
GetWindowTextW.USER32(?,?,00000400), ref: 000FA757
_wcscmp.LIBCMT ref: 000FA76B

Part of subcall function 000C362C: _iswctype.LIBCMT ref: 000C3634

Strings

%s%u, xrefs: 000FA515

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: a896912512070f8ae0392d08e8ef425144396091b6f83b049e68b4a8154bebe7
Instruction ID: b3e6ab80a528795f6c14662530ca6856c8382d8a2b51465eb91fe7951be5fd71
Opcode Fuzzy Hash: a896912512070f8ae0392d08e8ef425144396091b6f83b049e68b4a8154bebe7
Instruction Fuzzy Hash: 63A1BEB130470AABD714EF60C884FBAB7E8FF45314F008529EA9DC2591DB34E956DB92

Function 000FAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 000FAF18
_wcscmp.LIBCMT ref: 000FAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 000FAF51
CharUpperBuffW.USER32(?,00000000), ref: 000FAF6E
_wcscmp.LIBCMT ref: 000FAF8C
_wcsstr.LIBCMT ref: 000FAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 000FAFD5
_wcscmp.LIBCMT ref: 000FAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 000FB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 000FB055
_wcscmp.LIBCMT ref: 000FB065
GetClassNameW.USER32(00000010,?,00000400), ref: 000FB08D
GetWindowRect.USER32(00000004,?), ref: 000FB0F6

Strings

@, xrefs: 000FAEF9
ThumbnailClass, xrefs: 000FAFE0, 000FB060

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: f5701b5e92e15abe9241872757c5a475be49e0d4b3da3b6ecf48e4d68de16185
Instruction ID: 8ce968471b599967963991b7166da179c9d2486941742d68c9c4d2af16b68b1f
Opcode Fuzzy Hash: f5701b5e92e15abe9241872757c5a475be49e0d4b3da3b6ecf48e4d68de16185
Instruction Fuzzy Hash: AA81BF711082099FDB14DF50C881FBA7BE8FF45314F148469FE898A492DB34DE8ADB61

Function 000FABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 000FAC33

Strings

[CLASS:, xrefs: 000FAC83
ACTIVE, xrefs: 000FAC0E
[ALL, xrefs: 000FACD9
[ACTIVE, xrefs: 000FAC20
[LAST, xrefs: 000FACE0
LAST, xrefs: 000FABF8
HANDLE=, xrefs: 000FAC2C
ALL, xrefs: 000FACC7
REGEXP=, xrefs: 000FAC48
CLASSNAME=, xrefs: 000FAC70
[HANDLE:, xrefs: 000FAC3F
[REGEXPTITLE:, xrefs: 000FAC5B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: fc4d907db28e36829be4db4067d34f550e836a5be82100c60044c45dbfa89b12
Instruction ID: 8bddbd528f7cc7e93d18503f47a57304967d5e359326be6f01ab21f7c495a0aa
Opcode Fuzzy Hash: fc4d907db28e36829be4db4067d34f550e836a5be82100c60044c45dbfa89b12
Instruction Fuzzy Hash: 8F31B271A48209E6DA14EBA0EE43FFE77A4AB11712F244018B91A764D2EB516F089692

Function 00114FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00115013
LoadCursorW.USER32(00000000,00007F00), ref: 0011501E
LoadCursorW.USER32(00000000,00007F03), ref: 00115029
LoadCursorW.USER32(00000000,00007F8B), ref: 00115034
LoadCursorW.USER32(00000000,00007F01), ref: 0011503F
LoadCursorW.USER32(00000000,00007F81), ref: 0011504A
LoadCursorW.USER32(00000000,00007F88), ref: 00115055
LoadCursorW.USER32(00000000,00007F80), ref: 00115060
LoadCursorW.USER32(00000000,00007F86), ref: 0011506B
LoadCursorW.USER32(00000000,00007F83), ref: 00115076
LoadCursorW.USER32(00000000,00007F85), ref: 00115081
LoadCursorW.USER32(00000000,00007F82), ref: 0011508C
LoadCursorW.USER32(00000000,00007F84), ref: 00115097
LoadCursorW.USER32(00000000,00007F04), ref: 001150A2
LoadCursorW.USER32(00000000,00007F02), ref: 001150AD
LoadCursorW.USER32(00000000,00007F89), ref: 001150B8
GetCursorInfo.USER32(?), ref: 001150C8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 287845cd556143aea1be6d442c90948587be05d70a53d61791b370fe59bd4280
Instruction ID: 2389b825f77e04fd0c612a890c776c31f0abb2de5a440766ee6a031e1e1b284e
Opcode Fuzzy Hash: 287845cd556143aea1be6d442c90948587be05d70a53d61791b370fe59bd4280
Instruction Fuzzy Hash: 3F3114B1D08319AADF109FB68C8999EBFE9FF08750F50453AA50CE7280DB7865418FA1

Function 0012A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0012A259
DestroyWindow.USER32(?,?), ref: 0012A2D3

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0012A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0012A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0012A382
DestroyWindow.USER32(00000000), ref: 0012A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,000A0000,00000000), ref: 0012A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0012A3F4
GetDesktopWindow.USER32 ref: 0012A40D
GetWindowRect.USER32(00000000), ref: 0012A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0012A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0012A444

Part of subcall function 000A25DB: GetWindowLongW.USER32(?,000000EB), ref: 000A25EC

Strings

0, xrefs: 0012A26F
tooltips_class32, xrefs: 0012A346, 0012A3D4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: dd97495f4c5a43ed5cdad150b5566bb6f5065c0fae559dc41cf84e03e29c733c
Instruction ID: e77bf7342aae11859fe3a579ef33633dc6aaa4b43b8ce1b164c61c07c0102d1c
Opcode Fuzzy Hash: dd97495f4c5a43ed5cdad150b5566bb6f5065c0fae559dc41cf84e03e29c733c
Instruction Fuzzy Hash: 7071BC74140245AFD721DF28DC48FAA7BFAFB88700F48452CF985876A1C7B0E966CB52

Function 00124392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00124424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0012446F

Strings

GETTEXT, xrefs: 001245C2
GETSELECTED, xrefs: 0012457F
GETITEMCOUNT, xrefs: 00124551
SELECT, xrefs: 00124620
EXISTS, xrefs: 001244D8
EXPAND, xrefs: 00124521
COLLAPSE, xrefs: 001244B5
CHECK, xrefs: 0012448F
ISCHECKED, xrefs: 001245F2
GETTOTALCOUNT, xrefs: 00124456
UNCHECK, xrefs: 0012464B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: f284b375613ddeff71f670c291be082fa1a2063c979b3c8cd032dcaa850202f8
Instruction ID: a4ba3643fbcc7556ecda599032bdff2cabf702c4b71fb8084010e24fd8d10542
Opcode Fuzzy Hash: f284b375613ddeff71f670c291be082fa1a2063c979b3c8cd032dcaa850202f8
Instruction Fuzzy Hash: 80916E702043119FCB04EF10C451AAEB7A1AF96750F05486CF8A66B7A3CB35ED59CB92

Function 0012B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0012B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,001291C2), ref: 0012B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0012B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0012B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0012B9C3
FreeLibrary.KERNEL32(?), ref: 0012B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0012B9DF
DestroyCursor.USER32(?), ref: 0012B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0012BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0012BA17

Part of subcall function 000C2EFD: __wcsicmp_l.LIBCMT ref: 000C2F86

Strings

.dll, xrefs: 0012B86D
.exe, xrefs: 0012B84A
.icl, xrefs: 0012B82A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 3907162815-1154884017
Opcode ID: 4bb3c9de79fd44b7e08b930182080fa1aad6306de032d165d672546677cccdf5
Instruction ID: 185a61b46cbf9b830fc00b198dfe17a30669e59a1876609e3de399a7022ab0b6
Opcode Fuzzy Hash: 4bb3c9de79fd44b7e08b930182080fa1aad6306de032d165d672546677cccdf5
Instruction Fuzzy Hash: 7161FFB1904229BAEF14DF64DC81FFE7BB8EB08710F104129FA15D61C1DB74A9A1DBA0

Function 0010DC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0010DCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 0010DCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0010DCF8
__wsplitpath.LIBCMT ref: 0010DD56
_wcscat.LIBCMT ref: 0010DD6E
_wcscat.LIBCMT ref: 0010DD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0010DD95
SetCurrentDirectoryW.KERNEL32(?), ref: 0010DDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 0010DDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 0010DDFC
_wcscpy.LIBCMT ref: 0010DE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0010DE47

Strings

*.*, xrefs: 0010DE02

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 26c426d057b338d456420df8bd25f401943f745f66be82c24933eb2995f1e6ca
Instruction ID: c7bd7d352d135cae011112c0748f8cdec1aa27add8e5eb2d8b2ff821cf2bd5a1
Opcode Fuzzy Hash: 26c426d057b338d456420df8bd25f401943f745f66be82c24933eb2995f1e6ca
Instruction Fuzzy Hash: 316159725042059FDB10EFA0D845AAEB3E8FF89314F04492DF98987292EB75E945CB92

Function 00109C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00109C7F

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00109CA0
__swprintf.LIBCMT ref: 00109CF9
__swprintf.LIBCMT ref: 00109D12
_wprintf.LIBCMT ref: 00109DB9
_wprintf.LIBCMT ref: 00109DD7

Strings

^ ERROR , xrefs: 00109D4E
"%s" (%d) : ==> %s:, xrefs: 00109DD2
Line %d (File "%s"):, xrefs: 00109CF3, 00109D0C
"%s" (%d) : ==> %s:%s%s, xrefs: 00109DB4
Incorrect parameters to object property !, xrefs: 00109D5B
Error: , xrefs: 00109D81

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 6cecc23bf8dda0ff89e625724fdca4f8c0a3cb29c7b60b1069f078865548128d
Instruction ID: ffab24e38739dbcdb3b580af0d9e0388eba7c00589d946bba21f799558e2047f
Opcode Fuzzy Hash: 6cecc23bf8dda0ff89e625724fdca4f8c0a3cb29c7b60b1069f078865548128d
Instruction Fuzzy Hash: 7151BE7190060AAACF14EBE0DD56EEEB779EF05300F504069F509760A3EB712F99DB60

Function 0010A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

CharLowerBuffW.USER32(?,?), ref: 0010A3CB
GetDriveTypeW.KERNEL32 ref: 0010A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0010A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0010A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0010A4C5

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

Strings

close, xrefs: 0010A3D1
open, xrefs: 0010A3F2
open , xrefs: 0010A427
closed, xrefs: 0010A3DF, 0010A3E8
set cd door , xrefs: 0010A466
wait, xrefs: 0010A482
type cdaudio alias cd wait, xrefs: 0010A443
close cd wait, xrefs: 0010A4B0

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: a2c27d9dc58877f456de56c7ebf1748d7bd5d5f60c6fc454697051d03439e7db
Instruction ID: e5554c91ea38c17608a58b6df2463a2104b6a8236d59cf2d4e8347a93f0c3e32
Opcode Fuzzy Hash: a2c27d9dc58877f456de56c7ebf1748d7bd5d5f60c6fc454697051d03439e7db
Instruction Fuzzy Hash: 675150751143059FC700EF10C8819ABB3E4FF85718F44886DF899AB292DB71ED0ACB52

Function 000FF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,000DE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 000FF8DF
LoadStringW.USER32(00000000,?,000DE029,00000001), ref: 000FF8E8

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

GetModuleHandleW.KERNEL32(00000000,00165310,?,00000FFF,?,?,000DE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 000FF90A
LoadStringW.USER32(00000000,?,000DE029,00000001), ref: 000FF90D
__swprintf.LIBCMT ref: 000FF95D
__swprintf.LIBCMT ref: 000FF96E
_wprintf.LIBCMT ref: 000FFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 000FFA2E

Strings

^ ERROR, xrefs: 000FF9C3
Line %d (File "%s"):, xrefs: 000FF957
Error: , xrefs: 000FF9E5
%s (%d) : ==> %s: %s %s, xrefs: 000FFA12
Line %d:, xrefs: 000FF968

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 59d4998f3c45c06f29dd4ef6b34ad24483d3551e349569e9f63e8be63335ce8a
Instruction ID: 712b17380dcd327aeb209d5a187caab9a88dde111e0819f6e58d6673383644d2
Opcode Fuzzy Hash: 59d4998f3c45c06f29dd4ef6b34ad24483d3551e349569e9f63e8be63335ce8a
Instruction Fuzzy Hash: FB413D7280420DAACB14FBE0DD96EFEB778AF15311F504069B609B6093EB316F49CB61

Function 0012BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00129207,?,?), ref: 0012BA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00129207,?,?,00000000,?), ref: 0012BA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00129207,?,?,00000000,?), ref: 0012BA78
CloseHandle.KERNEL32(00000000,?,?,?,?,00129207,?,?,00000000,?), ref: 0012BA85
GlobalLock.KERNEL32(00000000), ref: 0012BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00129207,?,?,00000000,?), ref: 0012BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0012BAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,00129207,?,?,00000000,?), ref: 0012BAAD
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0012BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00132CAC,?), ref: 0012BAD7
GlobalFree.KERNEL32(00000000), ref: 0012BAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 0012BB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0012BB36
DeleteObject.GDI32(00000000), ref: 0012BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0012BB74

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 954f5e37d8614f0e5d8d140751b2447547713d771a314d459c3e80f7d743aa2e
Instruction ID: 4540c7613e88475eb3f81a10286301855cf25d8f96b1cd7597f4d5b6a9f3b6e8
Opcode Fuzzy Hash: 954f5e37d8614f0e5d8d140751b2447547713d771a314d459c3e80f7d743aa2e
Instruction Fuzzy Hash: E1411975600218FFDB219F65EC88EAABBB9FF89B11F104068F905D7260D7709D62DB60

Function 000A6A8C Relevance: 21.5, APIs: 4, Strings: 8, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 000C0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,000A6B0C,?,00008000), ref: 000C0973

Part of subcall function 000A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000A4743,?,?,000A37AE,?), ref: 000A4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 000A6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 000A6CFA

Part of subcall function 000A586D: _wcscpy.LIBCMT ref: 000A58A5

Part of subcall function 000C363D: _iswctype.LIBCMT ref: 000C3645

Strings

AU3!, xrefs: 000A6B61
>>>AUTOIT SCRIPT<<<, xrefs: 000DE496
Error opening the file, xrefs: 000DE43D, 000DE4B8
EA06, xrefs: 000DE452
/v, xrefs: 000DE4ED, 000DE511
#include depth exceeded. Make sure there are no recursive includes, xrefs: 000DE421
Unterminated string, xrefs: 000DE7E4
Bad directive syntax error, xrefs: 000DE79D

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$/v$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-4266335620
Opcode ID: 315232760d4a684c2fc7db39c1676fd18effac0724b1d94487d93cc9c1a0397c
Instruction ID: 337f6a65c6d8ede5caa82822476ff35c6c84cede9496f814d663fa415a80d2b7
Opcode Fuzzy Hash: 315232760d4a684c2fc7db39c1676fd18effac0724b1d94487d93cc9c1a0397c
Instruction Fuzzy Hash: BA029D305083419FC724EF60C881AAFBBF5BF96354F14491EF49A9B2A2DB31D949CB52

Function 0010D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0010DA10
_wcscat.LIBCMT ref: 0010DA28
_wcscat.LIBCMT ref: 0010DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0010DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 0010DA63
GetFileAttributesW.KERNEL32(?), ref: 0010DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 0010DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 0010DAA7

Strings

*.*, xrefs: 0010DAE6

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 675c456e174b017cb2338d1e35c574501902b50aaf08a79633a00a54551fdca1
Instruction ID: b4f60a8d8025756e823ec91c276a70a428f7e5ec26038053120ae25694a189e5
Opcode Fuzzy Hash: 675c456e174b017cb2338d1e35c574501902b50aaf08a79633a00a54551fdca1
Instruction Fuzzy Hash: 688192716043419FCB24DFA4D841AAEB7E4BF89314F15882EF8C9C7291EBB0D945CB52

Function 0011731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0011738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0011739B
CreateCompatibleDC.GDI32(?), ref: 001173A7
SelectObject.GDI32(00000000,?), ref: 001173B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00117408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00117444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00117468
SelectObject.GDI32(00000006,?), ref: 00117470
DeleteObject.GDI32(?), ref: 00117479
DeleteDC.GDI32(00000006), ref: 00117480
ReleaseDC.USER32(00000000,?), ref: 0011748B

Strings

(, xrefs: 00117410

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: c1db7bae3470f4d49e2e2ba198eac308f53d8a150ea81a7eb3c67dd4f48490e3
Instruction ID: d6d0ac40154b46df30f3108fe9dafacf3fc1656b5086306cad7c682c388b21fa
Opcode Fuzzy Hash: c1db7bae3470f4d49e2e2ba198eac308f53d8a150ea81a7eb3c67dd4f48490e3
Instruction Fuzzy Hash: 53513875904209EFCB25CFA8CC84EAEBBB9FF48310F14852DF95A97251C731A981CB50

Function 00102D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00102D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00102DDD
GetMenuItemCount.USER32(00165890), ref: 00102E66
DeleteMenu.USER32(00165890,00000005,00000000,000000F5,?,?), ref: 00102EF6
DeleteMenu.USER32(00165890,00000004,00000000), ref: 00102EFE
DeleteMenu.USER32(00165890,00000006,00000000), ref: 00102F06
DeleteMenu.USER32(00165890,00000003,00000000), ref: 00102F0E
GetMenuItemCount.USER32(00165890), ref: 00102F16
SetMenuItemInfoW.USER32(00165890,00000004,00000000,00000030), ref: 00102F4C
GetCursorPos.USER32(?), ref: 00102F56
SetForegroundWindow.USER32(00000000), ref: 00102F5F
TrackPopupMenuEx.USER32(00165890,00000000,?,00000000,00000000,00000000), ref: 00102F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00102F7E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 1d249204cabf6183c7c08de46d35fc009cfea22ee74eb5cafd69634c893440a8
Instruction ID: 061a1f6bfa98ff3151b7aef97e14a971347db33cc7efd164bb76b4091040e145
Opcode Fuzzy Hash: 1d249204cabf6183c7c08de46d35fc009cfea22ee74eb5cafd69634c893440a8
Instruction Fuzzy Hash: D071F370640216BEEB258F54DC8DFAABF64FF05764F20022AF655AA1E1C7F16C60DB90

Function 00120E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0011FDAD,?,?), ref: 00120E31

Strings

HKLM, xrefs: 00120EAF
HKEY_CURRENT_USER, xrefs: 00120F10
HKEY_LOCAL_MACHINE, xrefs: 00120E9A
HKEY_CLASSES_ROOT, xrefs: 00120EC4
HKEY_CURRENT_CONFIG, xrefs: 00120EEE
HKCU, xrefs: 00120F21
HKCC, xrefs: 00120EFF
HKEY_USERS, xrefs: 00120F32
HKU, xrefs: 00120F43
HKCR, xrefs: 00120ED9

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 7fb58197d5e2596c41084125abefb9e2c87a4a0cdc85784f2d29550631213188
Instruction ID: e661cd11e6e3fd4d923f470549f0098b2de99be0f1203e8ee2c0f6f0fe2cd223
Opcode Fuzzy Hash: 7fb58197d5e2596c41084125abefb9e2c87a4a0cdc85784f2d29550631213188
Instruction Fuzzy Hash: 2B41793214426ACBCF15EF10EE65AEF3760AF19300F154518FC652B293DB349D6ACBA2

Function 000FF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,000DE2A0,00000010,?,Bad directive syntax error,0012F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 000FF7C2
LoadStringW.USER32(00000000,?,000DE2A0,00000010), ref: 000FF7C9

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

_wprintf.LIBCMT ref: 000FF7FC
__swprintf.LIBCMT ref: 000FF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 000FF88D

Strings

Error: , xrefs: 000FF85B
Line %d (File "%s"):, xrefs: 000FF833
., xrefs: 000FF873
%s (%d) : ==> %s.: %s %s, xrefs: 000FF7F7
Line %d:, xrefs: 000FF818

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 887b359ee6feceb015368728a8f7a48a28db8295ec50e99167a1f4fbf9b28175
Instruction ID: 4123be66f87af716f1654935bc0e29e1c2d017594187643e80a4372c775db969
Opcode Fuzzy Hash: 887b359ee6feceb015368728a8f7a48a28db8295ec50e99167a1f4fbf9b28175
Instruction Fuzzy Hash: 12216D3290021EFBCF11EF90CC4AEFE7779BF18311F044469B5196A0A2EB719669DB50

Function 001052C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

Part of subcall function 000A7924: _memmove.LIBCMT ref: 000A79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00105330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00105346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00105357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00105369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0010537A

Strings

status PlayMe mode, xrefs: 0010532B
close PlayMe, xrefs: 00105341, 0010536E
play PlayMe, xrefs: 00105375
alias PlayMe, xrefs: 00105309
open , xrefs: 001052DF
play PlayMe wait, xrefs: 00105364

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 8313247da4366004a645298bd0fe5fdeb93ae1bf9cf7844e4216a3b1be91a87d
Instruction ID: f4331249e8898fcda2030241517d96a5de8826613066d87abb231d14012d0120
Opcode Fuzzy Hash: 8313247da4366004a645298bd0fe5fdeb93ae1bf9cf7844e4216a3b1be91a87d
Instruction Fuzzy Hash: 74119431A5012DB9D724B7A5CC4ADFF7B7CFB96B41F400429B815AA0D2DFA01D49C9B0

Function 001046B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 001046D2
gethostname.WS2_32(?,00000100), ref: 001046EC
gethostbyname.WS2_32(?), ref: 001046F9
_wcscpy.LIBCMT ref: 00104721
_memmove.LIBCMT ref: 00104734
inet_ntoa.WS2_32(?), ref: 0010473F
_strcat.LIBCMT ref: 0010474D
_wcscpy.LIBCMT ref: 00104764
WSACleanup.WS2_32 ref: 00104772
_wcscpy.LIBCMT ref: 00104780

Strings

0.0.0.0, xrefs: 0010471B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: c1c14c774746fce1b35ba91b2d62f4f6374006053456f3a7c88c46ed8e07ebc8
Instruction ID: 4e53868eb56182d6f8b37a048c8b333e5cffd81cb2e1f083df5c3b365f8a53b4
Opcode Fuzzy Hash: c1c14c774746fce1b35ba91b2d62f4f6374006053456f3a7c88c46ed8e07ebc8
Instruction Fuzzy Hash: F711A571500114BBDB24AB74AC86FDE77BCEB51711F0401BEF58596092EFB19AC28A50

Function 00104F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00104F7A

Part of subcall function 000C049F: timeGetTime.WINMM(?,7707B400,000B0E7B), ref: 000C04A3

Sleep.KERNEL32(0000000A), ref: 00104FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00104FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00104FEC
SetActiveWindow.USER32 ref: 0010500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00105019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00105038
Sleep.KERNEL32(000000FA), ref: 00105043
IsWindow.USER32 ref: 0010504F
EndDialog.USER32(00000000), ref: 00105060

Strings

BUTTON, xrefs: 00104FDE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: ee6755c651abf27b0cc0badef8a1da2989dc4c383142f2557047b618b6f88489
Instruction ID: b94304b88facbfbbb58b7791d579cd34cb489f8e4b4d15b29cfa4fa9501792b8
Opcode Fuzzy Hash: ee6755c651abf27b0cc0badef8a1da2989dc4c383142f2557047b618b6f88489
Instruction Fuzzy Hash: DF2165B0204605FFE7205F20EC89E2A776AEB4978AF141038F542819F5DBE14DE68A71

Function 0010D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

CoInitialize.OLE32(00000000), ref: 0010D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0010D67D
SHGetDesktopFolder.SHELL32(?), ref: 0010D691
CoCreateInstance.COMBASE(00132D7C,00000000,00000001,00158C1C,?), ref: 0010D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0010D74C
CoTaskMemFree.COMBASE(?), ref: 0010D7A4
_memset.LIBCMT ref: 0010D7E1
SHBrowseForFolderW.SHELL32(?), ref: 0010D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0010D840
CoTaskMemFree.COMBASE(00000000), ref: 0010D847
CoTaskMemFree.COMBASE(00000000), ref: 0010D87E
CoUninitialize.COMBASE ref: 0010D880

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: ce7648011a7167893a13bb9e6e5bbd40fa663e359086793772d0e6664193f618
Instruction ID: fd62f07dcb02f694826d756319bf6050d918d79f586bdbe344556300785a6e60
Opcode Fuzzy Hash: ce7648011a7167893a13bb9e6e5bbd40fa663e359086793772d0e6664193f618
Instruction Fuzzy Hash: 86B11C75A00109AFDB14DFA4D884DAEBBB9FF49314F048469F909EB261DB70ED45CB50

Function 000FC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 000FC283
GetWindowRect.USER32(00000000,?), ref: 000FC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 000FC2F3
GetDlgItem.USER32(?,00000002), ref: 000FC2FE
GetWindowRect.USER32(00000000,?), ref: 000FC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 000FC364
GetDlgItem.USER32(?,000003E9), ref: 000FC372
GetWindowRect.USER32(00000000,?), ref: 000FC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 000FC3C6
GetDlgItem.USER32(?,000003EA), ref: 000FC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 000FC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 000FC3FE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: cc173e7b36e97399f70413ba6251eefc9b6311ccbdaf19c663a632e862c1791e
Instruction ID: 61679cca9c7cd3917ca6b5c10b1dc4c4c730610b5be3ca481a905b3ce08b4e4d
Opcode Fuzzy Hash: cc173e7b36e97399f70413ba6251eefc9b6311ccbdaf19c663a632e862c1791e
Instruction Fuzzy Hash: 17513F71B00209BBDB18CFA9DD8AEAEBBB6EB88710F14813DF615D6690D7709D418B10

Function 000A21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 000A25DB: GetWindowLongW.USER32(?,000000EB), ref: 000A25EC

GetSysColor.USER32(0000000F), ref: 000A21D3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: b6869ad6288826746515a60db0cc68d6abc16e5182fb6ff9865bb569cd19bb4e
Instruction ID: 042db7b04dcaf795e9ebaf6ebfc0a721bf73a761a5faa1d50354144e8de0cc91
Opcode Fuzzy Hash: b6869ad6288826746515a60db0cc68d6abc16e5182fb6ff9865bb569cd19bb4e
Instruction Fuzzy Hash: 6E417031100540FADB255F6CDC88BB93BA6EB47321F554279FE658A1E6C7318C92DB21

Function 0010A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0012F910), ref: 0010A90B
GetDriveTypeW.KERNEL32(00000061,001589A0,00000061), ref: 0010A9D5
_wcscpy.LIBCMT ref: 0010A9FF

Strings

fixed, xrefs: 0010A953
all, xrefs: 0010A911
removable, xrefs: 0010A93D
network, xrefs: 0010A969
cdrom, xrefs: 0010A927
unknown, xrefs: 0010A996
ramdisk, xrefs: 0010A97F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: ed0f6f5df9ed18686298a3833e40f5995748b262d2a394820121b8e1a08e3112
Instruction ID: 7b3c9e4c94c09c852851fde01dbc6e97f286096ec48ae2f64e3360189eb3209c
Opcode Fuzzy Hash: ed0f6f5df9ed18686298a3833e40f5995748b262d2a394820121b8e1a08e3112
Instruction Fuzzy Hash: EC51B031218301DBC704EF14C992AAFB7A5EF95708F91482DF8D56B2E2DB719909CB53

Function 000A9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 000A9862
__swprintf.LIBCMT ref: 000A98AC
__i64tow.LIBCMT ref: 000DF5E6

Strings

False, xrefs: 000DF5AE
True, xrefs: 000DF5A7
%.15g, xrefs: 000A98A6
0x%p, xrefs: 000DF5C8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 4f07b8ac9910acd7e16008afee75d0570ea9cec3c6dec5c011a6723f355e4ab1
Instruction ID: ef0e35ae0e23e211e8d9dd6270bd28a4a363ca6a849a45f06a83406d0e39a46b
Opcode Fuzzy Hash: 4f07b8ac9910acd7e16008afee75d0570ea9cec3c6dec5c011a6723f355e4ab1
Instruction Fuzzy Hash: FF41A5716007069BDB249F74D842FBA73E8EF46300F20846EE54ADB296EE3599418B20

Function 00127152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0012716A
CreateMenu.USER32 ref: 00127185
SetMenu.USER32(?,00000000), ref: 00127194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00127221
IsMenu.USER32(?), ref: 00127237
CreatePopupMenu.USER32 ref: 00127241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0012726E
DrawMenuBar.USER32 ref: 00127276

Strings

F, xrefs: 00127262
0, xrefs: 00127160

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 02e93f889dc568de060812bcc5282c43e56a2ee61a2e1a1d32a8e866c1e825a9
Instruction ID: 94683301008c28e0a67e8f8bf5ef8a32a3502cd0f1433de52bc2c2be432bac1c
Opcode Fuzzy Hash: 02e93f889dc568de060812bcc5282c43e56a2ee61a2e1a1d32a8e866c1e825a9
Instruction Fuzzy Hash: 4F416A74A01219EFDB20DFA4E984E9A7BF9FF49350F144028F945A73A1D731A921CFA0

Function 001274BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0012755E
CreateCompatibleDC.GDI32(00000000), ref: 00127565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00127578
SelectObject.GDI32(00000000,00000000), ref: 00127580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0012758B
DeleteDC.GDI32(00000000), ref: 00127594
GetWindowLongW.USER32(?,000000EC), ref: 0012759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 001275B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 001275BE

Strings

static, xrefs: 001274F6

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: bc396b03013c1c7e3148ebd5c026db61c1cfa67e96ec34c093881fc64a91cbd5
Instruction ID: fc8fea71e338f6ce555630de288dacda4a34cc498184d57689330e26e479c091
Opcode Fuzzy Hash: bc396b03013c1c7e3148ebd5c026db61c1cfa67e96ec34c093881fc64a91cbd5
Instruction Fuzzy Hash: 1F315A72105225BBDF219F64EC49FEB7BB9EF09720F110228FA15960E0C731D862DBA4

Function 000C6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000C6E3E

Part of subcall function 000C8B28: __getptd_noexit.LIBCMT ref: 000C8B28

__gmtime64_s.LIBCMT ref: 000C6ED7
__gmtime64_s.LIBCMT ref: 000C6F0D
__gmtime64_s.LIBCMT ref: 000C6F2A
__allrem.LIBCMT ref: 000C6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000C6F9C
__allrem.LIBCMT ref: 000C6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000C6FD1
__allrem.LIBCMT ref: 000C6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000C7006
__invoke_watson.LIBCMT ref: 000C7077

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 73e0c48f54f28f8f61d629fcd5394d9b3caf968e59f9f30ae3968025cc55f52f
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 8571B376A00B17ABD724AF68DC41F9EB7E8AF04724F14823EF514D6282E771DD408B91

Function 00102527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00102542
GetMenuItemInfoW.USER32(00165890,000000FF,00000000,00000030), ref: 001025A3
SetMenuItemInfoW.USER32(00165890,00000004,00000000,00000030), ref: 001025D9
Sleep.KERNEL32(000001F4), ref: 001025EB
GetMenuItemCount.USER32(?), ref: 0010262F
GetMenuItemID.USER32(?,00000000), ref: 0010264B
GetMenuItemID.USER32(?,-00000001), ref: 00102675
GetMenuItemID.USER32(?,?), ref: 001026BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00102700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00102714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00102735

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 935ffa856b0bc9f6b8a817593c6f50dfab27b932e9a3b5c7e5d02b67294dc7b6
Instruction ID: fda630814fb1ae3bfbebf8e4a7087d88ca2c12c3be72a2d40b59c4b00ddbcfa4
Opcode Fuzzy Hash: 935ffa856b0bc9f6b8a817593c6f50dfab27b932e9a3b5c7e5d02b67294dc7b6
Instruction Fuzzy Hash: A6619F70900249EFDB21CF64CC8CEBE7BB9EB55304F140169F881A7291DBB2AD56DB21

Function 00126F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00126FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00126FA8
GetWindowLongW.USER32(?,000000F0), ref: 00126FCC
_memset.LIBCMT ref: 00126FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00126FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00127067

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 1e819145b4b63f4d436c82ced363bcdd687d577eaea747960be432a0bb17bd45
Instruction ID: 405f9b4c18e218d18f16852522ef3e903ccf5e6a4df41383b1ae63909e7b5b41
Opcode Fuzzy Hash: 1e819145b4b63f4d436c82ced363bcdd687d577eaea747960be432a0bb17bd45
Instruction Fuzzy Hash: 17617971A00218AFDB11DFA4DC81EEE77B9EF09710F104169FA14AB2E1C771AD65DBA0

Function 000F6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 000F6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 000F6C18
VariantInit.OLEAUT32(?), ref: 000F6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 000F6C4A
VariantCopy.OLEAUT32(?,?), ref: 000F6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 000F6CB1
VariantClear.OLEAUT32(?), ref: 000F6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 000F6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 000F6CDC
VariantClear.OLEAUT32(?), ref: 000F6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 000F6CF9

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 1495625a2ded752bc7becf8ca481ea7aa2c04472b2dbad14ab80926a7307ee8f
Instruction ID: 06d8619a997e6847deb8d474df52c1a652ce27a42010c65191f8fe21fcc8f9f2
Opcode Fuzzy Hash: 1495625a2ded752bc7becf8ca481ea7aa2c04472b2dbad14ab80926a7307ee8f
Instruction Fuzzy Hash: 0F415435A0011DAFCF10EFA4D8449FEBBB9EF08350F008079E955D7661CB75AA46DBA0

Function 00119113 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00119167
VariantInit.OLEAUT32(?), ref: 00119238
VariantInit.OLEAUT32(?), ref: 00119339
VariantClear.OLEAUT32(?), ref: 00119343
VariantClear.OLEAUT32(?), ref: 001193A0

Strings

_NewEnum, xrefs: 00119121
Incorrect Object type in FOR..IN loop, xrefs: 0011931C
get__NewEnum, xrefs: 0011913F
Null Object assignment in FOR..IN loop, xrefs: 001191C8, 001192F6, 001193AE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 2862541840-1765764032
Opcode ID: 826c4db259d14f5c6d16e76ef0744b1af5137a8cf5b99a10c49697b25dfaa768
Instruction ID: 530eae100fdc97f0120d36d0e55317fa107ce20edfc3ce78d8783dd9932e62ea
Opcode Fuzzy Hash: 826c4db259d14f5c6d16e76ef0744b1af5137a8cf5b99a10c49697b25dfaa768
Instruction Fuzzy Hash: 61916071A00215ABDF28DFA5C858FEEB7B8FF45710F108569F525AB280D7709985CBA0

Function 001183BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

CoInitialize.OLE32 ref: 00118403
CoUninitialize.COMBASE ref: 0011840E
CoCreateInstance.COMBASE(?,00000000,00000017,00132BEC,?), ref: 0011846E
IIDFromString.COMBASE(?,?), ref: 001184E1
VariantInit.OLEAUT32(?), ref: 0011857B
VariantClear.OLEAUT32(?), ref: 001185DC

Strings

NULL Pointer assignment, xrefs: 001184B3
Failed to create object, xrefs: 00118479, 0011852F
Invalid parameter, xrefs: 001184FA

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 3608f67b277ac87a2ec43afcf3a85bceaf73a300936c5ffa8ba983d233f122f7
Instruction ID: faf53d41f9a8663d1e3c49456099a44e225030b74b3c442a80c85a77a97b5e49
Opcode Fuzzy Hash: 3608f67b277ac87a2ec43afcf3a85bceaf73a300936c5ffa8ba983d233f122f7
Instruction Fuzzy Hash: EB61AB70608712AFC718DF54C848BAAB7E9EF49714F00842DF9819B691CB70ED89CB92

Function 00115732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00115793
inet_addr.WS2_32(?), ref: 001157D8
gethostbyname.WS2_32(?), ref: 001157E4
IcmpCreateFile.IPHLPAPI ref: 001157F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00115862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00115878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 001158ED
WSACleanup.WS2_32 ref: 001158F3

Strings

Ping, xrefs: 00115816

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: e9f42bcc587473c3efbb14b5e0decd2d6b133a403d9f406f9aa4dff8b22cec22
Instruction ID: ac65bb6a00d96319c02fa87a2f91c4474611e0951b35b6201f5db776c5263a86
Opcode Fuzzy Hash: e9f42bcc587473c3efbb14b5e0decd2d6b133a403d9f406f9aa4dff8b22cec22
Instruction Fuzzy Hash: 4C519E31600700EFD724AF65DC49BAAB7E5EF89710F044539F956EB2A1DB30E881DB52

Function 000B6192 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000B6248
_memmove.LIBCMT ref: 000B62E4
_memset.LIBCMT ref: 000B6308

Strings

argument not compiled in 16 bit mode, xrefs: 000F0D77
internal error: missing capturing bracket, xrefs: 000F0D7F
ERCP, xrefs: 000B61B3
argument is not a compiled regular expression, xrefs: 000F0D87
failed to get memory, xrefs: 000B6326
internal error: opcode not recognized, xrefs: 000B631B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP$argument is not a compiled regular expression$argument not compiled in 16 bit mode$failed to get memory$internal error: missing capturing bracket$internal error: opcode not recognized
API String ID: 2532777613-264027815
Opcode ID: f62224648ede18abbf56cb35b45480b2ebdbc8ccef4f7c565eb5016bdca349c4
Instruction ID: 3ba67a45faecee9a96356f14e4213cbd30b8fa66b6e745e1f741fa6183c6a7f4
Opcode Fuzzy Hash: f62224648ede18abbf56cb35b45480b2ebdbc8ccef4f7c565eb5016bdca349c4
Instruction Fuzzy Hash: 7851BF71900709DBEB24CFA5C981BEAB7F4EF04704F20856EE94ADB251E779EA44CB40

Function 0010B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0010B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0010B546
GetLastError.KERNEL32 ref: 0010B550
SetErrorMode.KERNEL32(00000000,READY), ref: 0010B5BD

Strings

INVALID, xrefs: 0010B58F
READY, xrefs: 0010B596
NOTREADY, xrefs: 0010B57C
READONLY, xrefs: 0010B588
UNKNOWN, xrefs: 0010B575

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: aa1638da36f9d2ac6ebb2cd47e8d4d926aa03e9fe5282f94225c911cd5c20033
Instruction ID: 1bc8a5088af24540489a4a76a8cb1e44ced6f31ad53b44e97f5d6cf708786ebc
Opcode Fuzzy Hash: aa1638da36f9d2ac6ebb2cd47e8d4d926aa03e9fe5282f94225c911cd5c20033
Instruction Fuzzy Hash: E3319235A04209EFCB10DFA8CC95EAE77B4FF05311F1041A6E945EB2D2DBB19A46CB51

Function 000F8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 000FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000FAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 000F9014
GetDlgCtrlID.USER32 ref: 000F901F
GetParent.USER32 ref: 000F903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 000F903E
GetDlgCtrlID.USER32(?), ref: 000F9047
GetParent.USER32(?), ref: 000F9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 000F9066

Strings

ListBox, xrefs: 000F8FD1
ComboBox, xrefs: 000F8F9C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: cc1ab08a096284a472d4e72c11b72e472b19d10a1602a7fc5be4c55036fdab33
Instruction ID: 2fc2accb62a435557a1c3c4329ae1e6a62a42b2ea6d0e459070ec29bc9edf6aa
Opcode Fuzzy Hash: cc1ab08a096284a472d4e72c11b72e472b19d10a1602a7fc5be4c55036fdab33
Instruction Fuzzy Hash: 3321D8B4A00108BFDF14ABA0CC85EFEB774EF49310F104129BA21976E2DF75585ADB21

Function 000F907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 000FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000FAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 000F90FD
GetDlgCtrlID.USER32 ref: 000F9108
GetParent.USER32 ref: 000F9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 000F9127
GetDlgCtrlID.USER32(?), ref: 000F9130
GetParent.USER32(?), ref: 000F914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 000F914F

Strings

ListBox, xrefs: 000F90BC
ComboBox, xrefs: 000F9087

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 2b6b4144bac7c287f7db5382ea1f21a8d3c0577db4fd8c44c323df24ceb84a4e
Instruction ID: d7323e4bd3c4e751c9ba4024096e2f09f593a4f7591a298c024a4d08e9f677b8
Opcode Fuzzy Hash: 2b6b4144bac7c287f7db5382ea1f21a8d3c0577db4fd8c44c323df24ceb84a4e
Instruction Fuzzy Hash: 092198B4A00108BFDF11ABA4CC85FFEBBB4EF49300F104129BA55976A2DB75545AEB21

Function 000F9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000F916F
GetClassNameW.USER32(00000000,?,00000100), ref: 000F9184
_wcscmp.LIBCMT ref: 000F9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 000F9211

Strings

largeicons, xrefs: 000F91A5
list, xrefs: 000F91F3
details, xrefs: 000F91BF
SHELLDLL_DefView, xrefs: 000F9190
smallicons, xrefs: 000F91D9

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 86ca2e330d229757bb1a253c807942d37216f813eca1cc955ef427c80b6a56e4
Instruction ID: 6b5e176061952633072dc125681e6d10e76c19fba40ec1fb389954526dc553aa
Opcode Fuzzy Hash: 86ca2e330d229757bb1a253c807942d37216f813eca1cc955ef427c80b6a56e4
Instruction Fuzzy Hash: CD11AB7A14830BB5EA212624EC07FFB779CDB15735F20002AFE10A5CE2EE5158556554

Function 001188AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001188D7
CoInitialize.OLE32(00000000), ref: 00118904
CoUninitialize.COMBASE ref: 0011890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00118A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00118B3B
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002,?,00000001,00132C0C), ref: 00118B6F
CoGetObject.OLE32(?,00000000,00132C0C,?), ref: 00118B92
SetErrorMode.KERNEL32(00000000), ref: 00118BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00118C25
VariantClear.OLEAUT32(?), ref: 00118C35

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 384a212549127558189f8bee56ba6ee7742c0b7e326fd94571e0b9affc89e44f
Instruction ID: fb4331b57e5d8f7955911eb2e3c557e45683b6d91275b0c32f166b310ab4b2c8
Opcode Fuzzy Hash: 384a212549127558189f8bee56ba6ee7742c0b7e326fd94571e0b9affc89e44f
Instruction Fuzzy Hash: B4C138B1608305AFC704DF64C8849ABB7E9FF89748F00892DF9899B251DB71ED46CB52

Function 00107990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00107A6C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 7d626f0e662828484d400ae910c964b23ab9b58a0c7a0f78b71cd906bd249ef0
Instruction ID: e7efdb5cb3527ee3900d5b23c5ffda68bb9e98d04019ed9394f6114df6f59d05
Opcode Fuzzy Hash: 7d626f0e662828484d400ae910c964b23ab9b58a0c7a0f78b71cd906bd249ef0
Instruction Fuzzy Hash: A1B18D71E0420A9FEB10DFA4C984BBEB7B4FF09321F254429E581E72C1D7B4A941CBA0

Function 001011CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001011F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00100268,?,00000001), ref: 00101204
GetWindowThreadProcessId.USER32(00000000), ref: 0010120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00100268,?,00000001), ref: 0010121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0010122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00100268,?,00000001), ref: 00101245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00100268,?,00000001), ref: 00101257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00100268,?,00000001), ref: 0010129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00100268,?,00000001), ref: 001012B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00100268,?,00000001), ref: 001012BC

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: ea134eb4fdc1c367816d14aaefe02adfbf062e2e3c78bbdb3677e1e0e2b24d9b
Instruction ID: 2133c505efc9abc21fabe311c35fca68168006c265f8e2600d569d20d7e727a1
Opcode Fuzzy Hash: ea134eb4fdc1c367816d14aaefe02adfbf062e2e3c78bbdb3677e1e0e2b24d9b
Instruction Fuzzy Hash: 5C319C75600204BFEB209F64EDA8FA977B9FB64311F214169F940C6AE0D7F89D81CB60

Function 000AFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 000AFAA6
OleUninitialize.OLE32(?,00000000), ref: 000AFB45
UnregisterHotKey.USER32(?), ref: 000AFC9C
DestroyWindow.USER32(?), ref: 000E45D6
FreeLibrary.KERNEL32(?), ref: 000E463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 000E4668

Strings

close all, xrefs: 000AFAA1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 178ed7e794d58db2ccfae692502093e6652223374e5296f9eeaccc62bcf0b0cc
Instruction ID: 876806d4326b6d185f3189839566f9bf7eb340eec36e70ddec1fd1599fa0ff62
Opcode Fuzzy Hash: 178ed7e794d58db2ccfae692502093e6652223374e5296f9eeaccc62bcf0b0cc
Instruction Fuzzy Hash: 45A16131701212DFCB69EF55C995ABDF3A4BF16710F5042ADE80AAB262CB30AD16CF51

Function 000FA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,000FA439), ref: 000FA377

Strings

NAME, xrefs: 000FA1A9
INSTANCE, xrefs: 000FA285
REGEXPCLASS, xrefs: 000FA13C
TEXT, xrefs: 000FA2AE
CLASS, xrefs: 000FA0F6
CLASSNN, xrefs: 000FA119

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: c545068a3b16248c535c954c676acf3bb48a4b022fe4ad366d8e011c74b98453
Instruction ID: a5dd957a5b843c985556a4fb7eef7dbcafee17a37077d82ec0dcdb1a3ad4aa59
Opcode Fuzzy Hash: c545068a3b16248c535c954c676acf3bb48a4b022fe4ad366d8e011c74b98453
Instruction Fuzzy Hash: 5091E970704609EACB48DFA4C442BFDFBB4BF05310F508119E95DA7682DF316959EBA1

Function 000A2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 000A2EAE

Part of subcall function 000A1DB3: GetClientRect.USER32(?,?), ref: 000A1DDC
Part of subcall function 000A1DB3: GetWindowRect.USER32(?,?), ref: 000A1E1D
Part of subcall function 000A1DB3: ScreenToClient.USER32(?,?), ref: 000A1E45

GetDC.USER32 ref: 000DCD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 000DCD45
SelectObject.GDI32(00000000,00000000), ref: 000DCD53
SelectObject.GDI32(00000000,00000000), ref: 000DCD68
ReleaseDC.USER32(?,00000000), ref: 000DCD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 000DCDFB

Strings

U, xrefs: 000DCCD0

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 45a329116e8f454d2e76c637c59e087f01c68e50071dd1ea259c67ca8670aaaf
Instruction ID: af1dd18b112877cf2880e6e12622af053c4c01b49113ac06a1029eb23bd6105b
Opcode Fuzzy Hash: 45a329116e8f454d2e76c637c59e087f01c68e50071dd1ea259c67ca8670aaaf
Instruction Fuzzy Hash: E2718F31500206EFDF61CF64CC84EAA7BB6FF49360F14427AED559A2A6C7319C91DB60

Function 00126D80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00126E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00126E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00126E52
_wcscat.LIBCMT ref: 00126EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00126EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00126EF2

Strings

SysListView32, xrefs: 00126DF6
-----, xrefs: 00126EA5

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: -----$SysListView32
API String ID: 307300125-3975388722
Opcode ID: 3150143817cb7de13ac3d058d51ab420c285b4252a242dc23c57971f6d83dd48
Instruction ID: cac09b5391e366143fcfadd57c58758423994411825947d3b28dadfc493c1903
Opcode Fuzzy Hash: 3150143817cb7de13ac3d058d51ab420c285b4252a242dc23c57971f6d83dd48
Instruction Fuzzy Hash: EE419E74A00358EBDB21DFA4DC85BEE77B8EF08350F10046AF594A72D1D7719D958B60

Function 00111A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00111A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00111A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00111ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00111AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00111AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00111B10
InternetCloseHandle.WININET(00000000), ref: 00111B57

Part of subcall function 00112483: GetLastError.KERNEL32(?,?,00111817,00000000,00000000,00000001), ref: 00112498
Part of subcall function 00112483: SetEvent.KERNEL32(?,?,00111817,00000000,00000000,00000001), ref: 001124AD

Strings

, xrefs: 00111B01

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 4049d7522f3ed1c6bbfa23a29e8fbd8d04a90e5671e096e4f1f1e21a568dabd1
Instruction ID: 71442fbbfe1bfd38cd60e7c6013e4a9834b564f9af344e0e786f26a1a272fdac
Opcode Fuzzy Hash: 4049d7522f3ed1c6bbfa23a29e8fbd8d04a90e5671e096e4f1f1e21a568dabd1
Instruction Fuzzy Hash: 21417DB1505218BFEB198F50CC89FFEBBACEF08354F00413AFA059A141E7709E959BA4

Function 00118C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0012F910), ref: 00118D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0012F910), ref: 00118D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00118ED6
SysFreeString.OLEAUT32(?), ref: 00118F00

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: e3431b2bb11480a5fbd19cc2a3428b068c3d6ce3926a65f168f628ec67e0031d
Instruction ID: 15dbe77e8040ca3a0e91d3d3d3130b3fa4a88a5057fdced6595d86013c567ec6
Opcode Fuzzy Hash: e3431b2bb11480a5fbd19cc2a3428b068c3d6ce3926a65f168f628ec67e0031d
Instruction Fuzzy Hash: B1F10B71A00209AFDF18DF94C884EEEB7B9FF49314F108568F515AB251DB31AE86CB91

Function 0011F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0011F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0011F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0011F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0011F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0011F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0011FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0011FA7C
CloseHandle.KERNEL32(?), ref: 0011FAAB
CloseHandle.KERNEL32(?), ref: 0011FB22

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 9c3dcdf11cbeee1bd2512c8dc98c00f62969abdc85d7f44ddb973fcc17f6ca53
Instruction ID: fb48ecf14fac1519f8151afb44667921157e279d2881da19471dd2c44fad1de5
Opcode Fuzzy Hash: 9c3dcdf11cbeee1bd2512c8dc98c00f62969abdc85d7f44ddb973fcc17f6ca53
Instruction Fuzzy Hash: 2DE180316043019FC718EF24C891BAEBBE5AF85354F14857DF8959B2A2DB31EC86CB52

Function 000A201B Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000A1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,000A2036,?,00000000,?,?,?,?,000A16CB,00000000,?), ref: 000A1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 000A20D3
KillTimer.USER32(-00000001,?,?,?,?,000A16CB,00000000,?,?,000A1AE2,?,?), ref: 000A216E
DestroyAcceleratorTable.USER32(00000000), ref: 000DBCA6
DeleteObject.GDI32(00000000), ref: 000DBD1C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: 3b4ed9e7b8ec7a73463eed2256348436a2380d4f3eb0d21b0dfc6f0c221a9ae6
Instruction ID: 52a3a70ebd2bbbffafa931efbda3c90aac77e08b0dced674bd5b1df2b327d66d
Opcode Fuzzy Hash: 3b4ed9e7b8ec7a73463eed2256348436a2380d4f3eb0d21b0dfc6f0c221a9ae6
Instruction Fuzzy Hash: 0E615831510B01EFCB359F59DD48B29B7F2FB51312F508539E5828BE61C7B1A8A2DBA0

Function 00104CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0010466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00103697,?), ref: 0010468B

Part of subcall function 0010466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00103697,?), ref: 001046A4

Part of subcall function 00104A31: GetFileAttributesW.KERNEL32(?,0010370B), ref: 00104A32

lstrcmpiW.KERNEL32(?,?), ref: 00104D40
_wcscmp.LIBCMT ref: 00104D5A
MoveFileW.KERNEL32(?,?), ref: 00104D75

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: ca98875b89fe95ff5c6e8290e24bea0da69967b642b7549590a84ab1ce1277d9
Instruction ID: 879ae572b63e4ccfc2fca6475e5093c0e7c6ead82a3c2e2859c343e5a33ebd4c
Opcode Fuzzy Hash: ca98875b89fe95ff5c6e8290e24bea0da69967b642b7549590a84ab1ce1277d9
Instruction Fuzzy Hash: 135141B20083459BC724DBA4D881DDFB3ECAF95350F00492EB2C9D3192EF75A589C766

Function 00128645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 001286FF

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: a4e7cd6fa576e4ae7f480261de60710d36558dc9c6acbd8d88795f104ec98458
Instruction ID: 6b28a9ad6cbcd23675f708e829911f686912bcd9e05fa4277256e1d2b40f1d29
Opcode Fuzzy Hash: a4e7cd6fa576e4ae7f480261de60710d36558dc9c6acbd8d88795f104ec98458
Instruction Fuzzy Hash: 7651C030602274BFEB249F28EC89FAD7BA5EB05324F604125F910E65A1CF75A9B0CB40

Function 000A2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 000DC2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 000DC319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 000DC331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 000DC34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 000DC370
DestroyCursor.USER32(00000000), ref: 000DC37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 000DC39C
DestroyCursor.USER32(?), ref: 000DC3AB

Part of subcall function 0012A4AF: DeleteObject.GDI32(00000000), ref: 0012A4E8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2975913752-0
Opcode ID: deb646ce20d8a775e0411cd874b46aa969a794d0860a0b4ad13238b39bac8a43
Instruction ID: 825a249b99ad625bc7ee147007296855d1012a3d01874f494130f8eea554d246
Opcode Fuzzy Hash: deb646ce20d8a775e0411cd874b46aa969a794d0860a0b4ad13238b39bac8a43
Instruction Fuzzy Hash: 24515970A1020AAFDB24DFA9CC45FAE7BF5EB19310F104529F94297690D7B0EDA1DB60

Function 000F966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 000FA84C
Part of subcall function 000FA82C: GetCurrentThreadId.KERNEL32 ref: 000FA853
Part of subcall function 000FA82C: AttachThreadInput.USER32(00000000,?,000F9683,?,00000001), ref: 000FA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 000F968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 000F96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 000F96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 000F96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 000F96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 000F96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 000F96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 000F96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 000F96FB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: bd96951706fb3c6b686bd6d70a9466d225ab3d78a469236ea53b77d7b1128c19
Instruction ID: 95ee828f3526c1171460891b6777d7efecd767051e80b81b48d6d62c68c68f9b
Opcode Fuzzy Hash: bd96951706fb3c6b686bd6d70a9466d225ab3d78a469236ea53b77d7b1128c19
Instruction Fuzzy Hash: 0E11E5B1910218BEF6206F60DC49FBA3B2DDB4C791F500439F344AB4A1CAF25C62DAA4

Function 000F8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C), ref: 000F892A
RtlAllocateHeap.NTDLL(00000000), ref: 000F8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 000F8946
GetCurrentProcess.KERNEL32(?,00000000), ref: 000F894E
DuplicateHandle.KERNEL32(00000000), ref: 000F8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002), ref: 000F8961
GetCurrentProcess.KERNEL32(?,00000000), ref: 000F8969
DuplicateHandle.KERNEL32(00000000), ref: 000F896C
CreateThread.KERNEL32(00000000,00000000,000F8992,00000000,00000000,00000000), ref: 000F8986

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
String ID:
API String ID: 1422014791-0
Opcode ID: 02e7516a1aea4eb138b45861c2e4df6522459c1185b8b3bd7b99c6b21afbad4b
Instruction ID: 11be64d71f25a2b2640a092abe8d9a09b79b413562240474f55278231d7b9220
Opcode Fuzzy Hash: 02e7516a1aea4eb138b45861c2e4df6522459c1185b8b3bd7b99c6b21afbad4b
Instruction Fuzzy Hash: 3C01BF75640308FFE720ABA5DD4EF673B6CEB89711F408425FA05DB591CA709862CB20

Function 00119B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00119B7B
NULL Pointer assignment, xrefs: 00119BA4, 00119EC8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: dec511e2d2e2a6ee8c035c61127c523e0f259afa1451f78dddb2032c8943839c
Instruction ID: 5cb92e3b02d1447d2945f1d62a8e67acce8934a21e206c51114d7359d0943803
Opcode Fuzzy Hash: dec511e2d2e2a6ee8c035c61127c523e0f259afa1451f78dddb2032c8943839c
Instruction Fuzzy Hash: 78C1C371A002099FDF18DFA8D894BEEB7F5FB48314F148479E915AB281E770AD81CB90

Function 0011975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 000F710A: CLSIDFromProgID.COMBASE ref: 000F7127
Part of subcall function 000F710A: ProgIDFromCLSID.COMBASE(?,00000000), ref: 000F7142
Part of subcall function 000F710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000F7044,80070057,?,?), ref: 000F7150
Part of subcall function 000F710A: CoTaskMemFree.COMBASE(00000000), ref: 000F7160

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00119806
_memset.LIBCMT ref: 00119813
_memset.LIBCMT ref: 00119956
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000000), ref: 00119982
CoTaskMemFree.COMBASE(?), ref: 0011998D

Strings

NULL Pointer assignment, xrefs: 001199DB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: a3f98e7a52cc277f29754fa004a2716a1d335d9769ce5feebc87bd7aa71001c3
Instruction ID: 5bb7842e47b5d1e797b28af475faf609c46bbb4b26d25a34f250bb97cfc62d70
Opcode Fuzzy Hash: a3f98e7a52cc277f29754fa004a2716a1d335d9769ce5feebc87bd7aa71001c3
Instruction Fuzzy Hash: 22912671D00229EBDB14DFA5DC51EDEBBB9BF09310F10416AF519A7281DB71AA44CFA0

Function 0011E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00103C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00103C7A
Part of subcall function 00103C55: Process32FirstW.KERNEL32(00000000,?), ref: 00103C88
Part of subcall function 00103C55: CloseHandle.KERNEL32(00000000), ref: 00103D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0011E9A4
GetLastError.KERNEL32 ref: 0011E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0011E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0011EA63
GetLastError.KERNEL32(00000000), ref: 0011EA6E
CloseHandle.KERNEL32(00000000), ref: 0011EAA3

Strings

SeDebugPrivilege, xrefs: 0011E9C2

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: e178b64f40fb7ab99026c3c3d732ee813c484175de41b3d91a3c67b8d87f17db
Instruction ID: ee717c6a6a34b487cc6b8f40bd52218a0125501cfeb8d7f137e4bc701ec92fad
Opcode Fuzzy Hash: e178b64f40fb7ab99026c3c3d732ee813c484175de41b3d91a3c67b8d87f17db
Instruction Fuzzy Hash: 1341AC302002019FDB28EF94DCA5FAEB7E5AF41714F048468F9029B2D3CB75A895CB91

Function 00102F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00103033

Strings

warning, xrefs: 0010301C
question, xrefs: 00102FEC
blank, xrefs: 00102FB5
stop, xrefs: 00103004
info, xrefs: 00102FD4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 7fe4a269ba100ff6a5647fe4a16498ab49db1a32175fe632dccf87586d5e9969
Instruction ID: 0ea0adb5fc813d98c3c819f96dcfc7d8397a145c040adefc323ac8f829c37e47
Opcode Fuzzy Hash: 7fe4a269ba100ff6a5647fe4a16498ab49db1a32175fe632dccf87586d5e9969
Instruction Fuzzy Hash: 69113A35349386BEE7199B54DC42DAF77ACDF15360B20402EF960BA5C2EBF05F4456A0

Function 001042F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00104312
LoadStringW.USER32(00000000), ref: 00104319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0010432F
LoadStringW.USER32(00000000), ref: 00104336
_wprintf.LIBCMT ref: 0010435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0010437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00104357

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 3b8d0d1ccb83e3d6a82f5b8d88f6a0cddcad8a615a685e213ca8d2bc11977fb1
Instruction ID: a1a17eafe818c972f893826a11559fa63719cabd1c3b9fcacc80d8224c37615b
Opcode Fuzzy Hash: 3b8d0d1ccb83e3d6a82f5b8d88f6a0cddcad8a615a685e213ca8d2bc11977fb1
Instruction Fuzzy Hash: 06018FF280020CBFE72097A0DD89EEA777CEB08300F4000B9BB45E6051EA705ED64B70

Function 000A2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,000DC1C7,00000004,00000000,00000000,00000000), ref: 000A2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,000DC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 000A2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,000DC1C7,00000004,00000000,00000000,00000000), ref: 000DC21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,000DC1C7,00000004,00000000,00000000,00000000), ref: 000DC286

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 273d2cbe616ee4854282fe058a4b80917fc7b56652bbcf189279bf04801c7533
Instruction ID: 5ab5b3536992925abdc22506f564a60c557838c475a2a060efd60afc7a8009cf
Opcode Fuzzy Hash: 273d2cbe616ee4854282fe058a4b80917fc7b56652bbcf189279bf04801c7533
Instruction Fuzzy Hash: 3D411B31604780ABD7758BAC9D88B7F7BE3AF57310F15843EE04782A61C7709882D722

Function 001070C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 001070DD

Part of subcall function 000C0DB6: std::exception::exception.LIBCMT ref: 000C0DEC
Part of subcall function 000C0DB6: __CxxThrowException@8.LIBCMT ref: 000C0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00107114
RtlEnterCriticalSection.NTDLL(?), ref: 00107130
_memmove.LIBCMT ref: 0010717E
_memmove.LIBCMT ref: 0010719B
RtlLeaveCriticalSection.NTDLL(?), ref: 001071AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 001071BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 001071DE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 357ec7cdccfe91109d5c791cabe9afa71c884631efebad8b681cc30468ed5bca
Instruction ID: e1600b4b37cc99ed0efc164fdf5e8ec315a41618becaaf5f0546c2368df93f9a
Opcode Fuzzy Hash: 357ec7cdccfe91109d5c791cabe9afa71c884631efebad8b681cc30468ed5bca
Instruction Fuzzy Hash: 85315D71900205EBCB10EFA4DD85EAEB778EF45710F1541B9F904AB296DB70EE61CBA0

Function 001261D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 001261EB
GetDC.USER32(00000000), ref: 001261F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001261FE
ReleaseDC.USER32(00000000,00000000), ref: 0012620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00126246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00126257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0012902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00126291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 001262B1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 6247bad1e8d39e9fb1956ba547cbf861228b89f9899dadeda85a777ee580207f
Instruction ID: 58b14335d48144636cebba09b9d506cdcef4a13ab4de2577759d8a94cee49067
Opcode Fuzzy Hash: 6247bad1e8d39e9fb1956ba547cbf861228b89f9899dadeda85a777ee580207f
Instruction Fuzzy Hash: 40317F76101210BFEB218F50DC8AFEB3BA9EF49765F044069FE089A191D7759CA2CB64

Function 000FBBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 000FBBC4
_memcmp.LIBCMT ref: 000FBBE6
_memcmp.LIBCMT ref: 000FBBFE
_memcmp.LIBCMT ref: 000FBC11
_memcmp.LIBCMT ref: 000FBC2B
_memcmp.LIBCMT ref: 000FBC3E
_memcmp.LIBCMT ref: 000FBC56
_memcmp.LIBCMT ref: 000FBC71

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b5a1c98f0ff5a118d60734d07f76500972b8b6aadd0fadbef7e5267a3121c925
Instruction ID: 5a0af59b6c0147daf1cfc9f900496dc970ea2036cc02ce3638d338ae14575746
Opcode Fuzzy Hash: b5a1c98f0ff5a118d60734d07f76500972b8b6aadd0fadbef7e5267a3121c925
Instruction Fuzzy Hash: 0E219D7160120D7BE6187721DD42FFFB79DAF15388F084024FE0496A87EBA4DE11AAE1

Function 000A1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a5d775f7eafab9c1e02a604f0b39eb58d3ec877ede14eefd037ba417024448
Instruction ID: c1f0e94aa6e09c75c04e8234fef40695b252e675bf6796c5f37b6e7230a7914a
Opcode Fuzzy Hash: b1a5d775f7eafab9c1e02a604f0b39eb58d3ec877ede14eefd037ba417024448
Instruction Fuzzy Hash: FE716B34904109FFCB14CF98CC49AFEBBB9FF8A350F148159F915AA251C734AA52CBA4

Function 0012B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01282378), ref: 0012B3EB
IsWindowEnabled.USER32(01282378), ref: 0012B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0012B4DB
SendMessageW.USER32(01282378,000000B0,?,?), ref: 0012B512
IsDlgButtonChecked.USER32(?,?), ref: 0012B54F
GetWindowLongW.USER32(01282378,000000EC), ref: 0012B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0012B589

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 4e178c7b418993b8e2cc494d027327b484cdaf12870c900c8f7e9557d506993e
Instruction ID: e73b974647caadbccf6ca5108045416cc8ddd78f4833a38ee0afdd06e8569daf
Opcode Fuzzy Hash: 4e178c7b418993b8e2cc494d027327b484cdaf12870c900c8f7e9557d506993e
Instruction Fuzzy Hash: 7471D434608264EFDB24EF54E8D4FBA77B9FF09300F144069FA42972A2D731A9A1DB50

Function 0011F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0011F448
_memset.LIBCMT ref: 0011F511
ShellExecuteExW.SHELL32(?), ref: 0011F556

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

Part of subcall function 000BFC86: _wcscpy.LIBCMT ref: 000BFCA9

GetProcessId.KERNEL32(00000000), ref: 0011F5CD
CloseHandle.KERNEL32(00000000), ref: 0011F5FC

Strings

@, xrefs: 0011F525

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: c9c6931ed4ff7a829ff825422cee16f5a0f8a7a8809c65d7cc27a7f6f21f7984
Instruction ID: 9038612d309cc9a972cab702caa4e7ad8893f97ae2db7c2126323e30a996683f
Opcode Fuzzy Hash: c9c6931ed4ff7a829ff825422cee16f5a0f8a7a8809c65d7cc27a7f6f21f7984
Instruction Fuzzy Hash: 6A61AE75A006199FCB18DF94C8819EEBBB5FF49310F14806DE815AB752CB34AD82CB90

Function 00100F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00100F8C
GetKeyboardState.USER32(?), ref: 00100FA1
SetKeyboardState.USER32(?), ref: 00101002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00101030
PostMessageW.USER32(?,00000101,00000011,?), ref: 0010104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00101095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 001010B8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b14479d3a9616f778b3c327b5670483423a042d1ff9a2c8f98c2670be2233087
Instruction ID: 874bdc5867c8917ee9d163a097f943b2e686d1700d0f82575774903ac3a0cd0a
Opcode Fuzzy Hash: b14479d3a9616f778b3c327b5670483423a042d1ff9a2c8f98c2670be2233087
Instruction Fuzzy Hash: B151E4B06047D63EFB3642348C45BBABEA96B06304F088589F1D4868D3C3E9DCD9D751

Function 00100D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00100DA5
GetKeyboardState.USER32(?), ref: 00100DBA
SetKeyboardState.USER32(?), ref: 00100E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00100E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00100E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00100EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00100EC9

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 974c508b3ed6f89fa093222c4fc18feddfee5dfbd95ee0ad540ba75097b5d0cf
Instruction ID: 6f17bf49137b404f598f585bf2611be49450887695e6b4e6d42640369be22848
Opcode Fuzzy Hash: 974c508b3ed6f89fa093222c4fc18feddfee5dfbd95ee0ad540ba75097b5d0cf
Instruction Fuzzy Hash: 8051E4B05086D53EFB338364CC45BBA7FA95B0A300F08889DE1D4568C2C3D5AC99E760

Function 001055FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0010560A
_wcsncpy.LIBCMT ref: 0010563F
_wcsncpy.LIBCMT ref: 00105671
_wcsncpy.LIBCMT ref: 001056A4
_wcsncpy.LIBCMT ref: 001056E6
_wcsncpy.LIBCMT ref: 00105720
_wcsncpy.LIBCMT ref: 0010574F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 86ade2e531821044c123afb8336d54ca9d4ac285190e452db5e77566f4c569b6
Instruction ID: b6750885a6343e436d63822ee2fecc7393fb5f136c78e8889f95462bcfab263c
Opcode Fuzzy Hash: 86ade2e531821044c123afb8336d54ca9d4ac285190e452db5e77566f4c569b6
Instruction Fuzzy Hash: 2741D679C5061876CB11EBF48C46EDFB7B9AF04310F50885AE508E3262FB34E645CBA6

Function 00103671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0010466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00103697,?), ref: 0010468B

Part of subcall function 0010466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00103697,?), ref: 001046A4

lstrcmpiW.KERNEL32(?,?), ref: 001036B7
_wcscmp.LIBCMT ref: 001036D3
MoveFileW.KERNEL32(?,?), ref: 001036EB
_wcscat.LIBCMT ref: 00103733
SHFileOperationW.SHELL32(?), ref: 0010379F

Strings

\*.*, xrefs: 0010372D

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 356ad29e06fbddfd5586badbf964be82a64ce6dc16c4f8335328a698ab3befd9
Instruction ID: c2c8546185e2b42e854f8d382690875a764ceca13b4e121482a8e1b66bce8a5c
Opcode Fuzzy Hash: 356ad29e06fbddfd5586badbf964be82a64ce6dc16c4f8335328a698ab3befd9
Instruction Fuzzy Hash: D4416EB1508344AEC755EF64C441ADFB7ECAF89380F40082EB4DAC3291EB75D689C752

Function 00127291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001272AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00127351
IsMenu.USER32(?), ref: 00127369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001273B1
DrawMenuBar.USER32 ref: 001273C4

Strings

0, xrefs: 0012729E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 5a6c2e12682406fffec4da3c560804f0554c913372f48b5621e9eab5d800bf09
Instruction ID: 6e320bb33da02459ff18b9bea338fdeb656a0cb8b37c31b323c6f5d981f0d78a
Opcode Fuzzy Hash: 5a6c2e12682406fffec4da3c560804f0554c913372f48b5621e9eab5d800bf09
Instruction Fuzzy Hash: 3D413675A04219EFDB20DF51E884E9ABBF9FB08350F148429FD45AB290D730AD60DF90

Function 00120FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00120FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00120FFE
FreeLibrary.KERNEL32(00000000), ref: 001210B5

Part of subcall function 00120FA5: RegCloseKey.ADVAPI32(?), ref: 0012101B
Part of subcall function 00120FA5: FreeLibrary.KERNEL32(?), ref: 0012106D
Part of subcall function 00120FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00121090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00121058

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: befc4ab77e8c9106b912da0a53d2f8d8b4f8e3efcb20ba7f1a478db60e67eed5
Instruction ID: 666c9e6578a2c3bccd684aa500c4029465226ab94daf4f3c650f08f89e598f53
Opcode Fuzzy Hash: befc4ab77e8c9106b912da0a53d2f8d8b4f8e3efcb20ba7f1a478db60e67eed5
Instruction Fuzzy Hash: 7831EA71901119BFDB25DF90EC89EFFB7BCEB18300F000269F501A2151EB749E969AA4

Function 001262CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 001262EC
GetWindowLongW.USER32(01282378,000000F0), ref: 0012631F
GetWindowLongW.USER32(01282378,000000F0), ref: 00126354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00126386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 001263B0
GetWindowLongW.USER32(00000000,000000F0), ref: 001263C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 001263DB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: adb4bf80303d649e20ff0e5b8080f380b8e50b3ebfc21d48646ca08c139454a5
Instruction ID: 0382fddd146e3a6f9b8466b86ca335bc000266c79e1f10132b43a410bd7701ab
Opcode Fuzzy Hash: adb4bf80303d649e20ff0e5b8080f380b8e50b3ebfc21d48646ca08c139454a5
Instruction Fuzzy Hash: FF311230640260AFDB20CF19EC84F5537E6FB4A754F1941A8F5459F6F2CB71ACA19B90

Function 000FDAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000FDB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000FDB54
SysAllocString.OLEAUT32(00000000), ref: 000FDB57
SysAllocString.OLEAUT32(?), ref: 000FDB75
SysFreeString.OLEAUT32(?), ref: 000FDB7E
StringFromGUID2.COMBASE(?,?,00000028), ref: 000FDBA3
SysAllocString.OLEAUT32(?), ref: 000FDBB1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: deda59ff3dec73208d23550233842443144d0b8452e8158cc64d3543c5cbf07a
Instruction ID: 2c6b51d97880e24441571d65ff5adf06e447f474adad6f984ff4446621af0b28
Opcode Fuzzy Hash: deda59ff3dec73208d23550233842443144d0b8452e8158cc64d3543c5cbf07a
Instruction Fuzzy Hash: AF217436600219AFDB10AFA8DC48DBB73EDEB09360B01857AFA14DB551D7709C429760

Function 00116173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00117D8B: inet_addr.WS2_32(00000000), ref: 00117DB6

socket.WS2_32(00000002,00000001,00000006), ref: 001161C6
WSAGetLastError.WS2_32(00000000), ref: 001161D5
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 0011620E
connect.WSOCK32(00000000,?,00000010), ref: 00116217
WSAGetLastError.WS2_32 ref: 00116221
closesocket.WS2_32(00000000), ref: 0011624A
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00116263

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: f1e30579487ea873af7fe35a11bed350c93af378f8282aebb508ec6db18ca4a8
Instruction ID: aa11fcd8ca6b61cb15219607351e29258da2b072504c1a6b17fd4bb0ec1fd3b5
Opcode Fuzzy Hash: f1e30579487ea873af7fe35a11bed350c93af378f8282aebb508ec6db18ca4a8
Instruction Fuzzy Hash: B231AF31600118ABDF24AF64CC85BFE7BB9EB45720F044039FD05A7292CB75AC959BA1

Function 000FF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 000FF671
__wcsnicmp.LIBCMT ref: 000FF692
__wcsnicmp.LIBCMT ref: 000FF6AC

Strings

#requireadmin, xrefs: 000FF68C
#OnAutoItStartRegister, xrefs: 000FF6A6
#notrayicon, xrefs: 000FF669

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 36bad16e06f72d521c6b9bf3833ce4084ec65268acb4a51803ab7348a45f7243
Instruction ID: 420e6a8932a105124424937099e98900324043fb32439fead4955fa6165f67d8
Opcode Fuzzy Hash: 36bad16e06f72d521c6b9bf3833ce4084ec65268acb4a51803ab7348a45f7243
Instruction Fuzzy Hash: 442126722086166AD230BB34AC03FFFB3D8EF55390F144439FA46D6992EFA19D41E295

Function 000FDBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000FDC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000FDC2F
SysAllocString.OLEAUT32(00000000), ref: 000FDC32
SysAllocString.OLEAUT32 ref: 000FDC53
SysFreeString.OLEAUT32 ref: 000FDC5C
StringFromGUID2.COMBASE(?,?,00000028), ref: 000FDC76
SysAllocString.OLEAUT32(?), ref: 000FDC84

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 257605c794889509f33e7978712ecc37396910d84a56dfff70048e2723e7e983
Instruction ID: 15a6221415546daf85da54595dfac8e33604994ce9012ad9e6d63842a8ff3871
Opcode Fuzzy Hash: 257605c794889509f33e7978712ecc37396910d84a56dfff70048e2723e7e983
Instruction Fuzzy Hash: FA213735604109BF9B24EFA8DC89DBB77EDEB09360B108136FA15CB661D6B0DC42D764

Function 001275CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 000A1D73
Part of subcall function 000A1D35: GetStockObject.GDI32(00000011), ref: 000A1D87
Part of subcall function 000A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 000A1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00127632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0012763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0012764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00127659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00127665

Strings

Msctls_Progress32, xrefs: 00127603

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3c904c8f5ad0ca9a6639441628b98c73a5855c2023a825c9c0f997474d72baaf
Instruction ID: d0e45bc1c84b8538b6ee00ab36c6a03f88a170c102bdf391f7816d2878ca6a8c
Opcode Fuzzy Hash: 3c904c8f5ad0ca9a6639441628b98c73a5855c2023a825c9c0f997474d72baaf
Instruction Fuzzy Hash: 8211B2B2110229BFFF158F64DC85EE7BF6DEF08798F014114BA04A60A0DB729C21DBA4

Function 000C9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 000C9AE6

Part of subcall function 000C3187: RtlEncodePointer.NTDLL(00000000), ref: 000C318A
Part of subcall function 000C3187: __initp_misc_winsig.LIBCMT ref: 000C31A5
Part of subcall function 000C3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000C9EA0
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 000C9EB4
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 000C9EC7
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 000C9EDA
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 000C9EED
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 000C9F00
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 000C9F13
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 000C9F26
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 000C9F39
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 000C9F4C
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 000C9F5F
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 000C9F72
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 000C9F85
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 000C9F98
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 000C9FAB
Part of subcall function 000C3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 000C9FBE

__mtinitlocks.LIBCMT ref: 000C9AEB
__mtterm.LIBCMT ref: 000C9AF4

Part of subcall function 000C9B5C: RtlDeleteCriticalSection.NTDLL(00000000), ref: 000C9C56
Part of subcall function 000C9B5C: _free.LIBCMT ref: 000C9C5D
Part of subcall function 000C9B5C: RtlDeleteCriticalSection.NTDLL(0015EC00), ref: 000C9C7F

__calloc_crt.LIBCMT ref: 000C9B19
__initptd.LIBCMT ref: 000C9B3B
GetCurrentThreadId.KERNEL32 ref: 000C9B42

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 5098bc5131fda1fcd9ea2878944dfbc50edcfd32739ce2e3377189b649d69bbd
Instruction ID: 08605646cbc338bc454e9fe711777057b939d3646c590b33cdd4870b1748eebc
Opcode Fuzzy Hash: 5098bc5131fda1fcd9ea2878944dfbc50edcfd32739ce2e3377189b649d69bbd
Instruction Fuzzy Hash: 79F06D325197116AE6747B74BC0BFCE26D0AF02734F214A2EF4649A4D3EF20994145A5

Function 000C406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,000C3F85), ref: 000C4085
GetProcAddress.KERNEL32(00000000), ref: 000C408C
RtlEncodePointer.NTDLL(00000000), ref: 000C4097
RtlDecodePointer.NTDLL(000C3F85), ref: 000C40B2

Strings

combase.dll, xrefs: 000C4080
RoUninitialize, xrefs: 000C4074

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 427531a19eb75e8caba4881da72572239a0791f84f1f975477765707bc3d82a4
Instruction ID: 01ee36dd314deba3393cf2609ea40d64d0c611008b111a24cb063928c7ca5178
Opcode Fuzzy Hash: 427531a19eb75e8caba4881da72572239a0791f84f1f975477765707bc3d82a4
Instruction Fuzzy Hash: FBE09270581300EFEA60AFA1ED09B053AB4B705B42F104038F521E19A0CBB686A6DA24

Function 00116B03 Relevance: 9.2, APIs: 6, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32(00000000,?), ref: 00116C00
WSAGetLastError.WS2_32(00000000), ref: 00116C34
htons.WS2_32(?), ref: 00116CEA
inet_ntoa.WS2_32(?), ref: 00116CA7

Part of subcall function 000FA7E9: _strlen.LIBCMT ref: 000FA7F3
Part of subcall function 000FA7E9: _memmove.LIBCMT ref: 000FA815

_strlen.LIBCMT ref: 00116D44
_memmove.LIBCMT ref: 00116DAD

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 55064c10c2d5aa0a1d81842fca0a9ce5c74914ce836bfe8f699e2f96d8f4f430
Instruction ID: 9006d4589a9e5169c078c80fef0aabc4636b45eac97cba3fb53496eba3e1e3a4
Opcode Fuzzy Hash: 55064c10c2d5aa0a1d81842fca0a9ce5c74914ce836bfe8f699e2f96d8f4f430
Instruction Fuzzy Hash: 7181C171208300ABCB14EBA4DC82FEFB7A8AF95714F14492CF9559B2D2DB719D41CB92

Function 001064B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0010660B
_memmove.LIBCMT ref: 00106546

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

_memmove.LIBCMT ref: 001065B9
_memmove.LIBCMT ref: 001066A0
_memmove.LIBCMT ref: 001066B9
_memmove.LIBCMT ref: 001066D5

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 7a9d2276f8bc6090ad2ff2e4bc0facee7f220cdfea25bb18be49390af5a0a179
Instruction ID: a29986dffc6cee0f74ec6f39454c2c2e03118ebede4a192f0fc5b5b2234b3d9d
Opcode Fuzzy Hash: 7a9d2276f8bc6090ad2ff2e4bc0facee7f220cdfea25bb18be49390af5a0a179
Instruction Fuzzy Hash: 68617A3060065A9BCF05EFA0CC82EFF37A9AF06308F054529F8995B293DB75A915DB50

Function 001201E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 00120E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0011FDAD,?,?), ref: 00120E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001202BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001202FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00120320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00120349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0012038C
RegCloseKey.ADVAPI32(00000000), ref: 00120399

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: eea3845df8e3eb6e5839c1c55af07be05313ffbacfa9bd29ea8f4b896ea88609
Instruction ID: 5e0dd9a4f1ac0f3199727886841d13cb1edf756321fbc3b1137cafa55c759bc2
Opcode Fuzzy Hash: eea3845df8e3eb6e5839c1c55af07be05313ffbacfa9bd29ea8f4b896ea88609
Instruction Fuzzy Hash: 6D515831208204AFC715EF64D885EAFBBE9FF89314F044A2DF5458B2A2DB31E915CB52

Function 00125799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 001257FB
GetMenuItemCount.USER32(00000000), ref: 00125832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0012585A
GetMenuItemID.USER32(?,?), ref: 001258C9
GetSubMenu.USER32(?,?), ref: 001258D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00125928

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 4cf9b241a9a08b20ff57cc5f572542f158642af1ca5724cb1fbb06f3263d08ec
Instruction ID: 99ab7cb65b89d30d564c2944caef26d107d28a80f751cb59cc72b70da2351e91
Opcode Fuzzy Hash: 4cf9b241a9a08b20ff57cc5f572542f158642af1ca5724cb1fbb06f3263d08ec
Instruction Fuzzy Hash: 57515C31A00625EFCF15EFA4D885AAEBBB5EF49310F104069E841AB352CB74AE51CB90

Function 000FEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000FEF06
VariantClear.OLEAUT32(00000013), ref: 000FEF78
VariantClear.OLEAUT32(00000000), ref: 000FEFD3
_memmove.LIBCMT ref: 000FEFFD
VariantClear.OLEAUT32(?), ref: 000FF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 000FF078

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 3fbfdeaace34ce3a3d1ad9bdacf356c142bed7f8077b6cbcfcb2111fa7a72bf0
Instruction ID: 83bac307e8987f3f6dbfb1298a2d6ac2408392dbc42a768755d6f2f6bb117828
Opcode Fuzzy Hash: 3fbfdeaace34ce3a3d1ad9bdacf356c142bed7f8077b6cbcfcb2111fa7a72bf0
Instruction Fuzzy Hash: 52516CB5A00209EFCB14DF58C884AAAB7F8FF4C310F158569EA49DB301E731E951CBA0

Function 0010220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00102258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001022A3
IsMenu.USER32(00000000), ref: 001022C3
CreatePopupMenu.USER32 ref: 001022F7
GetMenuItemCount.USER32(000000FF), ref: 00102355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00102386

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 9d50e074986e565c4833eb72f112d090b49c6f0de0aeae5e3eb5dee02c02ad75
Instruction ID: 4a96517cd69d1853f52c306f2ff87d754c433c6e0e12cd23953c7db1328135a9
Opcode Fuzzy Hash: 9d50e074986e565c4833eb72f112d090b49c6f0de0aeae5e3eb5dee02c02ad75
Instruction Fuzzy Hash: 1C51CE30A00209EBDF25CF68C88CBAEBBF5BF19314F148129E895AB2D0D3B48945CB51

Function 000A1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 000A179A
GetWindowRect.USER32(?,?), ref: 000A17FE
ScreenToClient.USER32(?,?), ref: 000A181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 000A182C
EndPaint.USER32(?,?), ref: 000A1876

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 51c9e07cdf41c111782ae53926e7fa1f1f38ec4596aa3707ee73e448593f0ec2
Instruction ID: 54622aa1f615bfb4df3447876f8af2406a4e5f50f5c271476ff9915faf964b6e
Opcode Fuzzy Hash: 51c9e07cdf41c111782ae53926e7fa1f1f38ec4596aa3707ee73e448593f0ec2
Instruction Fuzzy Hash: 6141A030504700EFD720DF65CC84BFA7BF9EB46724F044629F5A48B6A2CB709856DB61

Function 0012B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(001657B0,00000000,01282378,?,?,001657B0,?,0012B5A8,?,?), ref: 0012B712
EnableWindow.USER32(00000000,00000000), ref: 0012B736
ShowWindow.USER32(001657B0,00000000,01282378,?,?,001657B0,?,0012B5A8,?,?), ref: 0012B796
ShowWindow.USER32(00000000,00000004,?,0012B5A8,?,?), ref: 0012B7A8
EnableWindow.USER32(00000000,00000001), ref: 0012B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0012B7EF

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: f448e1c166defc454f03e9fa80174945736fb4f0bfd18e25f368e5a6a1eb7cd3
Instruction ID: 7f52654769e19426672b19a408e62bdbc8791e1f2377878e872b1397a495830d
Opcode Fuzzy Hash: f448e1c166defc454f03e9fa80174945736fb4f0bfd18e25f368e5a6a1eb7cd3
Instruction Fuzzy Hash: C9417F34609251AFDB26CF24E4DAB957BF1FF45310F1841B9E9488F6E2C731A8A6CB50

Function 0011709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00114E41,?,?,00000000,00000001), ref: 001170AC

Part of subcall function 001139A0: GetWindowRect.USER32(?,?), ref: 001139B3

GetDesktopWindow.USER32 ref: 001170D6
GetWindowRect.USER32(00000000), ref: 001170DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0011710F

Part of subcall function 00105244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 001052BC

GetCursorPos.USER32(?), ref: 0011713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00117199

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 23623dcc323d677bced6f8ef722a9062147e12513755d5453645215267798c86
Instruction ID: 43a7332682c17a49690d78732af7733b1787da4f4e6b4372ba9d0376a6f65121
Opcode Fuzzy Hash: 23623dcc323d677bced6f8ef722a9062147e12513755d5453645215267798c86
Instruction Fuzzy Hash: 0831B072509305ABD724DF14C849F9BBBBAFF88314F000929F58597291CB74EA5ACB92

Function 0010EB23 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

Part of subcall function 000BFC86: _wcscpy.LIBCMT ref: 000BFCA9

_wcstok.LIBCMT ref: 0010EC94
_wcscpy.LIBCMT ref: 0010ED23
_memset.LIBCMT ref: 0010ED56

Strings

X, xrefs: 0010ED93

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: aeecd8595ade94ab43c76fe68916c1abd4a61a4e1da19ed129e7915f819de19b
Instruction ID: e04997377edce158da001523b6a927c72d7bd449e572eabcf21c0b579ce342cc
Opcode Fuzzy Hash: aeecd8595ade94ab43c76fe68916c1abd4a61a4e1da19ed129e7915f819de19b
Instruction Fuzzy Hash: DBC15D716087059FC714EF64C985AAAB7E4FF86310F04492DF8999B2A2DB70EC45CB92

Function 000F8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000F80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 000F80C0
Part of subcall function 000F80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 000F80CA
Part of subcall function 000F80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 000F80D9
Part of subcall function 000F80A9: RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 000F80E0
Part of subcall function 000F80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 000F80F6

GetLengthSid.ADVAPI32(?,00000000,000F842F), ref: 000F88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 000F88D6
RtlAllocateHeap.NTDLL(00000000), ref: 000F88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 000F88F6
GetProcessHeap.KERNEL32(00000000,00000000,000F842F), ref: 000F890A
HeapFree.KERNEL32(00000000), ref: 000F8911

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Heap$Process$AllocateInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 169236558-0
Opcode ID: 741b475290f50edbb0a127dfe41247f4262289a3f15173a9e4a5c0a0f01e09fa
Instruction ID: 31a7a08123cd241d846891e300089759ee9423c94add5c12e5795a69c8d6c832
Opcode Fuzzy Hash: 741b475290f50edbb0a127dfe41247f4262289a3f15173a9e4a5c0a0f01e09fa
Instruction Fuzzy Hash: C911AC31601209FFDB649FA4DC0ABFE7BB9EB45311F54802CE98597610CB729962EB60

Function 000FB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 000FB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 000FB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000FB7CD
ReleaseDC.USER32(00000000,00000000), ref: 000FB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 000FB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 000FB7FE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: e9a948367a524604812b2ca2a7237429d58973cee84681639e5816762d88c855
Instruction ID: afeb444c5a4fb7c7e2eac4f3b6115399ea671d6d9bb11b22cdc995e7e7bb7bb9
Opcode Fuzzy Hash: e9a948367a524604812b2ca2a7237429d58973cee84681639e5816762d88c855
Instruction Fuzzy Hash: 24018475E00309BBEB10ABA6DD45E5EBFB8EB48311F004079FA08A7691D6309C11CF91

Function 000C0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 000C0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 000C019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 000C01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 000C01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 000C01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 000C01C1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d1b52384855e322065998515d744a4f094e4d303004c40fbc4a5d49e4a0f232e
Instruction ID: 1a06bd8f1c17f050b0c0215311757ee313187ecc155d4325525a2692e4f7d128
Opcode Fuzzy Hash: d1b52384855e322065998515d744a4f094e4d303004c40fbc4a5d49e4a0f232e
Instruction Fuzzy Hash: A30148B09027597DE3008F5A8C85A52FEA8FF19354F00411BA15847941C7B5A868CBE5

Function 001053E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 001053F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0010540F
GetWindowThreadProcessId.USER32(?,?), ref: 0010541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0010542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00105437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0010543E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: b02af3aaa5b31c3635a8d92ce3a851225f35dd958b75140c669b6e6304988b7b
Instruction ID: 4a07d83e39f3745a0d8f07b1d0429894d887b32e3fa00374710d2181eb7ae576
Opcode Fuzzy Hash: b02af3aaa5b31c3635a8d92ce3a851225f35dd958b75140c669b6e6304988b7b
Instruction Fuzzy Hash: A1F06231140158BBD7315B529C0DEEB7A7CEBC6B11F00017DF904D145097A01A6386B5

Function 00107230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00107243
RtlEnterCriticalSection.NTDLL(?), ref: 00107254
TerminateThread.KERNEL32(00000000,000001F6,?,000B0EE4,?,?), ref: 00107261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,000B0EE4,?,?), ref: 0010726E

Part of subcall function 00106C35: CloseHandle.KERNEL32(00000000,?,0010727B,?,000B0EE4,?,?), ref: 00106C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00107281
RtlLeaveCriticalSection.NTDLL(?), ref: 00107288

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: b3b1403dfcaee5680940be5a90fd7ae09656c9b5cc58b3aad15e3cdc2e5204e4
Instruction ID: e747b9f66e762fa5d23930659743e1fc0c7c0e22824c155668662e7adfcb968d
Opcode Fuzzy Hash: b3b1403dfcaee5680940be5a90fd7ae09656c9b5cc58b3aad15e3cdc2e5204e4
Instruction Fuzzy Hash: 18F0BE36841212FFE7611B24EE4C9EA3739EF06302F000139F103904E0CBB698A3CB50

Function 001185ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00118613
CharUpperBuffW.USER32(?,?), ref: 00118722
VariantClear.OLEAUT32(?), ref: 0011889A

Part of subcall function 00107562: VariantInit.OLEAUT32(00000000), ref: 001075A2
Part of subcall function 00107562: VariantCopy.OLEAUT32(00000000,?), ref: 001075AB
Part of subcall function 00107562: VariantClear.OLEAUT32(00000000), ref: 001075B7

Strings

Incorrect Parameter format, xrefs: 0011864B, 0011880D
AUTOIT.ERROR, xrefs: 00118728

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: d038dc1ded0d1074642d97550a4c1b1743faf8c83a819ddff85d4448a074a45c
Instruction ID: e35dc6d85650ab79f681dee9ff7cb515d350f6f1c39ec0eadfba6eaf14fe5b72
Opcode Fuzzy Hash: d038dc1ded0d1074642d97550a4c1b1743faf8c83a819ddff85d4448a074a45c
Instruction Fuzzy Hash: 1C917C706043019FC714DF64C48599BB7E4EF89714F14892EF89A9B3A2DB30E946CB52

Function 00102A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000BFC86: _wcscpy.LIBCMT ref: 000BFCA9

_memset.LIBCMT ref: 00102B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00102BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00102C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00102C97

Strings

0, xrefs: 00102B73

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 31b4a43e6297573ccd86889cf27cadb0eec2460575e860668dc6f977a78700e7
Instruction ID: 33968f0c0a090f3f6830dbd9249c8551445835ce4a2aa5bdf7713d8d92f22257
Opcode Fuzzy Hash: 31b4a43e6297573ccd86889cf27cadb0eec2460575e860668dc6f977a78700e7
Instruction Fuzzy Hash: D751BD716083019AE7249F28CA49AAFBBE8EF59314F144A2DF8D5D71D1DBB0CD44CB52

Function 000FD56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 000FD5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 000FD60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 000FD61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 000FD69D

Strings

DllGetClassObject, xrefs: 000FD610

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: a5c9ae4318f450fecc93b0e843219601059db54a2ca4c940c603d1a06e8003ab
Instruction ID: 79e60368fcb47589dc3fbf97a4d2a615f09d1455499f24dcd752dcc7cd4edffc
Opcode Fuzzy Hash: a5c9ae4318f450fecc93b0e843219601059db54a2ca4c940c603d1a06e8003ab
Instruction Fuzzy Hash: F34181B1600208EFDB15DF54C884AAA7BBAEF44310F1581AEEE09DF605D7B1DD44EBA0

Function 00102753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001027C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 001027DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00102822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00165890,00000000), ref: 0010286B

Strings

0, xrefs: 001027B5

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 7868e5f6653cc579663e16fc23c43c5d1e0f7c180b2cb4b71c7a4fbc78e7a20c
Instruction ID: 85c180c5cf094e0218fb660359e08d1f952e760b5c1a3979c41b20bc8365d346
Opcode Fuzzy Hash: 7868e5f6653cc579663e16fc23c43c5d1e0f7c180b2cb4b71c7a4fbc78e7a20c
Instruction Fuzzy Hash: F641B1752043419FD724DF24CC48B5ABBE8EF95314F148A2EF9A5972D2DBB0E805CB52

Function 0011D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0011D7C5

Part of subcall function 000A784B: _memmove.LIBCMT ref: 000A7899

Strings

cdecl, xrefs: 0011D81C
winapi, xrefs: 0011D836
stdcall, xrefs: 0011D847
none, xrefs: 0011D8A0

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: dbd68215348b7e7e1e84c5f39bf0cb305d6880ccd671703d2a9695d127bb6294
Instruction ID: 7f1363832bd045222b916a9a7d595805631421bc0c5d8fd2fb6d9d611f83ae6f
Opcode Fuzzy Hash: dbd68215348b7e7e1e84c5f39bf0cb305d6880ccd671703d2a9695d127bb6294
Instruction Fuzzy Hash: 9A318F71904619EBCF04EFA8DC519FEB3B5FF05320B108629E875AB6D2DB71A945CB80

Function 000F8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 000FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000FAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 000F8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 000F8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 000F8F57

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

Strings

ListBox, xrefs: 000F8ED3
ComboBox, xrefs: 000F8E9E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 607ed292585b04ae540386dc1b30a46e1b0a10b7350b2bff90b8e8dc140bc562
Instruction ID: 94981dfdc0f4665a13daa8422f05379695c76501e5dc9d8b409bb2e5389d92bb
Opcode Fuzzy Hash: 607ed292585b04ae540386dc1b30a46e1b0a10b7350b2bff90b8e8dc140bc562
Instruction Fuzzy Hash: CF21D571A04108BEDB14ABA09C45DFFB779DF06320F148529F925975E2DB39484EE610

Function 0011182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0011184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00111872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 001118A2
InternetCloseHandle.WININET(00000000), ref: 001118E9

Part of subcall function 00112483: GetLastError.KERNEL32(?,?,00111817,00000000,00000000,00000001), ref: 00112498
Part of subcall function 00112483: SetEvent.KERNEL32(?,?,00111817,00000000,00000000,00000001), ref: 001124AD

Strings

, xrefs: 00111893

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 8b16ddf900753d1b225e1c950d3afcec303ac2928c86fc701ce95ddea58fd8c5
Instruction ID: 9cd8e3efea9d4f72a82be035dcb74264515311d3fa1514b2d2c322b52bd6d1f0
Opcode Fuzzy Hash: 8b16ddf900753d1b225e1c950d3afcec303ac2928c86fc701ce95ddea58fd8c5
Instruction Fuzzy Hash: FD21AFB1500208BFEB159F648C85EFFB6ADEB48744F10813AF50592540DB308D9697A1

Function 001263E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 000A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 000A1D73
Part of subcall function 000A1D35: GetStockObject.GDI32(00000011), ref: 000A1D87
Part of subcall function 000A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 000A1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00126461
LoadLibraryW.KERNEL32(?), ref: 00126468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0012647D
DestroyWindow.USER32(?), ref: 00126485

Strings

SysAnimate32, xrefs: 0012643C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: bf47d83917a418ac64185af4bbed65781e756637161932b6f5f9f09694b48aab
Instruction ID: 94d5dc795c1e1ccf23de66ba9e55ed91309c1da6a33acec5dacd78a7902e56b6
Opcode Fuzzy Hash: bf47d83917a418ac64185af4bbed65781e756637161932b6f5f9f09694b48aab
Instruction Fuzzy Hash: 8F219D71200265BFEF10AFA4EC80EBB37ADEF59324F104629FA90960D0D771DCA29760

Function 00106D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00106DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00106DEF
GetStdHandle.KERNEL32(0000000C), ref: 00106E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00106E3B

Strings

nul, xrefs: 00106E36

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: fe27c3bfe8db13787883e59fab037dda0b4e93fd7332b629e715983125dcf8dc
Instruction ID: f71bd04fe490c51810f56a6b7eb2d4f4088c83d6ca2bd7444e5b57e9a1524a0b
Opcode Fuzzy Hash: fe27c3bfe8db13787883e59fab037dda0b4e93fd7332b629e715983125dcf8dc
Instruction Fuzzy Hash: B621907460030AAFDB209F69DC05A9A7BF4EF55720F204A29FCE0D72D0DBB099718B50

Function 00106E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00106E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00106EBB
GetStdHandle.KERNEL32(000000F6), ref: 00106ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00106F06

Strings

nul, xrefs: 00106F01

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 57d244449a2651e7508761f6bff07c74f75f1c11bcd04631ab7abdb98372037e
Instruction ID: 0e4ce0f3a493d17dfd16d581d060d7567ce444ba7a8be9fbda8bbc0235891d5c
Opcode Fuzzy Hash: 57d244449a2651e7508761f6bff07c74f75f1c11bcd04631ab7abdb98372037e
Instruction Fuzzy Hash: 1B216079500305ABDB20DF69DC04A9A77A8AF55720F200A29FCE1D72D0D7B0A9618B60

Function 0010AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0010AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0010ACA8
__swprintf.LIBCMT ref: 0010ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0012F910), ref: 0010ACFF

Strings

%lu, xrefs: 0010ACBB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 30cd65193fdd6f7dd91757c0305682dd38715295b702376ebf4175642381b537
Instruction ID: 03a6909285418a010dee188f81541198d6d591baef0b15ac5a98d6f7aeace3d2
Opcode Fuzzy Hash: 30cd65193fdd6f7dd91757c0305682dd38715295b702376ebf4175642381b537
Instruction Fuzzy Hash: 5C214130A00209AFCB10DFA5C945EEE7BB8EF49714F004069F909AB252DB71EA56CB61

Function 00101AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00101B19

Strings

REMOVE, xrefs: 00101B1F
KEYS, xrefs: 00101B30
EXISTS, xrefs: 00101B41
APPEND, xrefs: 00101B52

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 8c977e3fbc6e545674dfad2d66e981fcbf7e2357e334dc0b7958ab410ad1aeb2
Instruction ID: d8e31b3f31197f62d504879b28db81ae8aa8b393cca4309cab159e46c0823af5
Opcode Fuzzy Hash: 8c977e3fbc6e545674dfad2d66e981fcbf7e2357e334dc0b7958ab410ad1aeb2
Instruction Fuzzy Hash: 2E115E30910208DFCF00EF94D9519EEB7B4FF2A308B108869D864AB692EB365D1ACB50

Function 0011EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0011EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0011EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0011ED6A
CloseHandle.KERNEL32(?), ref: 0011EDEB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: b31aec71b2b15e4bc0f908f1a699784bfd8c07456baf9d04307367aa6ba68944
Instruction ID: d71a8867d86e793ec2e9f52578a852100c5164f5bab829225febc9e1e1d7e90f
Opcode Fuzzy Hash: b31aec71b2b15e4bc0f908f1a699784bfd8c07456baf9d04307367aa6ba68944
Instruction Fuzzy Hash: 6681A371604300AFD724EF68C846FAAB7E5AF45710F04882DF999DB2D2DB75AC41CB52

Function 00120037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 00120E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0011FDAD,?,?), ref: 00120E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001200FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0012013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00120183
RegCloseKey.ADVAPI32(?,?), ref: 001201AF
RegCloseKey.ADVAPI32(00000000), ref: 001201BC

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 4bf6e53552255ba0dbcc176b5f0502c8e7158d0781e68b4978c31b4c87adfbd6
Instruction ID: 26c04632f3f2da6c9b5c1deecc731b519d8c61b2218c4dafba839035e5e3bfad
Opcode Fuzzy Hash: 4bf6e53552255ba0dbcc176b5f0502c8e7158d0781e68b4978c31b4c87adfbd6
Instruction Fuzzy Hash: 09517C71208204AFC715EF54DC81EABB7E9FF88304F00892DF5958B2A2DB31E965CB52

Function 0011D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0011D927
GetProcAddress.KERNEL32(00000000,?), ref: 0011D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0011D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0011DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0011DA21

Part of subcall function 000A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00107896,?,?,00000000), ref: 000A5A2C
Part of subcall function 000A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00107896,?,?,00000000,?,?), ref: 000A5A50

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: ba858dbbc23ff0d22a9faea5e92abc7498c790378f4fce3a1101d86ea38ef56f
Instruction ID: 0a10426d2e0abcf71ffb8da77764d00cc612597298879967dd75f89cc8211d92
Opcode Fuzzy Hash: ba858dbbc23ff0d22a9faea5e92abc7498c790378f4fce3a1101d86ea38ef56f
Instruction Fuzzy Hash: 83513935A04609EFCB04EFA8D4849EEB7F4FF19314B458069E815AB312DB31AD86CF91

Function 0010E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0010E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0010E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0010E687

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0010E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0010E6B4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: edf231ef8e9bbcd570328d6ca37cd62ddc32ac0b7856225f87d13ce320cb0c22
Instruction ID: d0f9321ccdb2de54204e59e8057fb51b2967d20ac68cf5c4ba2df62e1c9b28e5
Opcode Fuzzy Hash: edf231ef8e9bbcd570328d6ca37cd62ddc32ac0b7856225f87d13ce320cb0c22
Instruction Fuzzy Hash: EF510E35A00105DFCB01EFA5D981AAEBBF5EF0A314F1484A9E849AB362CB35ED51DF50

Function 0012A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9085dbe3cbe00860287127646d2a3a4fec7e1311e06e43cb127288bcb9b17a5a
Instruction ID: ec3fc921e9bc4a53f31de47245e46512fa5de9a4d80a26a7ca859492bb7825b4
Opcode Fuzzy Hash: 9085dbe3cbe00860287127646d2a3a4fec7e1311e06e43cb127288bcb9b17a5a
Instruction Fuzzy Hash: F0412735904124BFC724DF28EC48FA9BBB8EF09320F950165F915A72E1C730AD71DA91

Function 000A2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 000A2357
ScreenToClient.USER32(001657B0,?), ref: 000A2374
GetAsyncKeyState.USER32(00000001), ref: 000A2399
GetAsyncKeyState.USER32(00000002), ref: 000A23A7

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 3dd6f6a55306c4afaad9216820a60edf60669fa08b63546114fd68916940fb2a
Instruction ID: c5294e23753c264738da1be00761117ed317d8a7ff1e42a0544248f1bfd912de
Opcode Fuzzy Hash: 3dd6f6a55306c4afaad9216820a60edf60669fa08b63546114fd68916940fb2a
Instruction Fuzzy Hash: 4F415435504215FFDF259FA8C844AEDBBB5FB06360F20436AF82592290C7346E94DFA1

Function 000F63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000F63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 000F6433
TranslateMessage.USER32(?), ref: 000F645C
DispatchMessageW.USER32(?), ref: 000F6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000F6475

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 54e26cb1337b523acd33509741141718457639627dc1aee297d1df7970ba6555
Instruction ID: aaae99e827d69aacfd5394c01c39827e39931bd50744035f6e8bc42e81cccf0b
Opcode Fuzzy Hash: 54e26cb1337b523acd33509741141718457639627dc1aee297d1df7970ba6555
Instruction Fuzzy Hash: E331927190064AAFDBA4DFB0DC44BB67BF9AB01300F540179E621C3DA1E766A499F760

Function 000F8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000F8A30
PostMessageW.USER32(?,00000201,00000001), ref: 000F8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 000F8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 000F8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 000F8AF8

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 9fe2fa0dee3d7ed80995b679cb246d26e85f01ac10b201d8ae6662849677d50e
Instruction ID: 68dd13a0cf6c3d6e2e56258d513238cffb0da2ebfdb71621de0082f2f84c8090
Opcode Fuzzy Hash: 9fe2fa0dee3d7ed80995b679cb246d26e85f01ac10b201d8ae6662849677d50e
Instruction Fuzzy Hash: 6331E27150021DEBEF14CF68DD4CAEE3BB5EB04315F108229FA24E66D0C7B09961DB91

Function 000FB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 000FB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 000FB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 000FB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 000FB27F
_wcsstr.LIBCMT ref: 000FB289

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: a91a0329848214e5be5f2f9acf8480a604c7c3e2c4d937374f7164c90f9fcfdd
Instruction ID: 3e60cb80154b663b69d1e877a765b86ebd8828829f82baf38af7f0cfce3d938b
Opcode Fuzzy Hash: a91a0329848214e5be5f2f9acf8480a604c7c3e2c4d937374f7164c90f9fcfdd
Instruction Fuzzy Hash: 24213731204204BBEB655B79DC09E7F7BACDF49710F00803DF904CA5A1EF61DC41AA60

Function 0012B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 000A2612: GetWindowLongW.USER32(?,000000EB), ref: 000A2623

GetWindowLongW.USER32(?,000000F0), ref: 0012B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0012B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0012B1CF
GetSystemMetrics.USER32(00000004), ref: 0012B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00110E90,00000000), ref: 0012B216

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: d723ed2ada6aba687f6151bed74e39b19528f894e953f36aba62b50e71732c82
Instruction ID: 4fed336422c2b3c63f52d9792b7e582701b5d68a32f8f2f258f57ac07bcd10f1
Opcode Fuzzy Hash: d723ed2ada6aba687f6151bed74e39b19528f894e953f36aba62b50e71732c82
Instruction Fuzzy Hash: F0219171918262EFCB249F38AC84A6A37A5FB05721F114738F932D75E0D73098719B90

Function 000F9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000F9320

Part of subcall function 000A7BCC: _memmove.LIBCMT ref: 000A7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 000F9352
__itow.LIBCMT ref: 000F936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 000F9392
__itow.LIBCMT ref: 000F93A3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 39493c064f17b7de89911c4e8eb9149ad097e3165ced734ffd531264e4b9abba
Instruction ID: 3ca6b6977296494ccf2f8bf35a091b9198ade396c0d6447c768fa39779bcabe9
Opcode Fuzzy Hash: 39493c064f17b7de89911c4e8eb9149ad097e3165ced734ffd531264e4b9abba
Instruction Fuzzy Hash: 3021DA3170020CBBDB219BA49C85FFE7BA9EB49710F044029FE05E71D2D6708E559791

Function 00115A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00115A6E
GetForegroundWindow.USER32 ref: 00115A85
GetDC.USER32(00000000), ref: 00115AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00115ACD
ReleaseDC.USER32(00000000,00000003), ref: 00115B08

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 371a594e8cd1687b52d14316bea4be640cbfd5e0f330dd45abafa5a90180121d
Instruction ID: 18e3f90a49e763ecff6eec7525e016a6559b38484b9b36f1fca1068ddb738875
Opcode Fuzzy Hash: 371a594e8cd1687b52d14316bea4be640cbfd5e0f330dd45abafa5a90180121d
Instruction Fuzzy Hash: C021A135A00104AFDB14EFA4DD85AAABBF5EF48310F14807DF84997762CB70AC42CB90

Function 000A12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 000A134D
SelectObject.GDI32(?,00000000), ref: 000A135C
BeginPath.GDI32(?), ref: 000A1373
SelectObject.GDI32(?,00000000), ref: 000A139C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 4aca10bf056b5c667c4ffca2c2f24162edc1cef0350e50b54418f9551b16e7e2
Instruction ID: c65f45b023ee43f8a225581945a0c65bf6a51fb038245ff46e05bc4dc4cf7995
Opcode Fuzzy Hash: 4aca10bf056b5c667c4ffca2c2f24162edc1cef0350e50b54418f9551b16e7e2
Instruction Fuzzy Hash: 26214C31800618EBDF218F66DC047AD7BEEEB01361F14822AF85097DA0D3B199E2DB90

Function 000FBC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 000FBCB3
_memcmp.LIBCMT ref: 000FBCD1
_memcmp.LIBCMT ref: 000FBCE4
_memcmp.LIBCMT ref: 000FBCFC
_memcmp.LIBCMT ref: 000FBD14

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f4ac0cfcb812be0786b2f375cb3943de61000ea6483376e136d76ddcb89bf495
Instruction ID: f959591c94337606c6956d3370b3233be8fc87bec28a06f90c44911a4d68ea5f
Opcode Fuzzy Hash: f4ac0cfcb812be0786b2f375cb3943de61000ea6483376e136d76ddcb89bf495
Instruction Fuzzy Hash: 040180B160010D7AE2186B11AD42FFFB79CDF51798F044025FE0996683FB60DE10AAE1

Function 00104A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00104ABA
__beginthreadex.LIBCMT ref: 00104AD8
MessageBoxW.USER32(?,?,?,?), ref: 00104AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00104B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00104B0A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: a9cf98bfd02f81b63dec822434497030e1d2874f931d97baa346980a83c81fb5
Instruction ID: e280275f7c5869207423e7ee6332076cec56f39932c9acfed01bfe89266fb9c3
Opcode Fuzzy Hash: a9cf98bfd02f81b63dec822434497030e1d2874f931d97baa346980a83c81fb5
Instruction Fuzzy Hash: F71104B6904208FBC7109FA8EC48A9B7FADEB45324F14426DF914D36A0D7B1C99187A0

Function 000F8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000F821E
GetLastError.KERNEL32(?,000F7CE2,?,?,?), ref: 000F8228
GetProcessHeap.KERNEL32(00000008,?,?,000F7CE2,?,?,?), ref: 000F8237
RtlAllocateHeap.NTDLL(00000000,?,000F7CE2), ref: 000F823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000F8255

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: d0dfcdf4924756b42b82ba34770c014c58ef3bb91a66ed9285ce888ab550ee7e
Instruction ID: 85ebdff3ccc129c06f61a57883cadd79f9ea3e06ea72cc54d3ecc5c1d5033200
Opcode Fuzzy Hash: d0dfcdf4924756b42b82ba34770c014c58ef3bb91a66ed9285ce888ab550ee7e
Instruction Fuzzy Hash: 64016D71600208BFDB604FA5DC48DAB7BBCEF8A754B50443DF909C2620EB319C62DB60

Function 000F710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 000F7127
ProgIDFromCLSID.COMBASE(?,00000000), ref: 000F7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000F7044,80070057,?,?), ref: 000F7150
CoTaskMemFree.COMBASE(00000000), ref: 000F7160
CLSIDFromString.COMBASE(?,?), ref: 000F716C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 23341aabddf9830115e22fd1e2ca54af647649b0ced7da2c4c2823c02041571d
Instruction ID: 636307e2dda0fae041ffbd6beb507f5011f797212be6f5ea22021dd3f6f4ee3b
Opcode Fuzzy Hash: 23341aabddf9830115e22fd1e2ca54af647649b0ced7da2c4c2823c02041571d
Instruction Fuzzy Hash: 98017176601208BBDB214F68DC44AAABBFDFB44751F140078FE08D2620D731DD56A7A0

Function 00105244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00105260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0010526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00105276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00105280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 001052BC

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 7f14bec63c738f0ccaaef17a8334274e6c8d972c0ce686b346196a79fbc21f92
Instruction ID: 646e43166f6344a396aaa6911c3519802b6e17bb209929dc90bbf71cb023ef40
Opcode Fuzzy Hash: 7f14bec63c738f0ccaaef17a8334274e6c8d972c0ce686b346196a79fbc21f92
Instruction Fuzzy Hash: 81016D31D01A1DEBDF14EFE4D8485EEBB79FF0D711F41006AE981B2180CB7055A28BA1

Function 000F810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 000F8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 000F812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000F813A
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 000F8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000F8157

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: b278fed73b65d23432d45f177ff30da16e15d9e9ed6df6db8ef357cc11d03615
Instruction ID: 4b2104e3de35f9825df91156c593c34c527e3e604015bdee4b5b530f7524bd78
Opcode Fuzzy Hash: b278fed73b65d23432d45f177ff30da16e15d9e9ed6df6db8ef357cc11d03615
Instruction Fuzzy Hash: CAF03C75200308BFEB610FA5EC88EB73BADFF49B54F104139FA4586550DB6199A3EB60

Function 000FC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 000FC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 000FC20E
MessageBeep.USER32(00000000), ref: 000FC226
KillTimer.USER32(?,0000040A), ref: 000FC242
EndDialog.USER32(?,00000001), ref: 000FC25C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: f2737ceacadc3054bffe78bd6f14e2707adfd0be56fac4e2c5405c20daa1ce41
Instruction ID: 8e219b5088cc85b6f3c208fec4fbda07a08c7cd5b21c39d1017e86d6c108b566
Opcode Fuzzy Hash: f2737ceacadc3054bffe78bd6f14e2707adfd0be56fac4e2c5405c20daa1ce41
Instruction Fuzzy Hash: 5501A73040430CABFB705B50DD4EFA677B8FB00B05F00026DA642A18E1D7E46999AB50

Function 000A13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 000A13BF
StrokeAndFillPath.GDI32(?,?,000DB888,00000000,?), ref: 000A13DB
SelectObject.GDI32(?,00000000), ref: 000A13EE
DeleteObject.GDI32 ref: 000A1401
StrokePath.GDI32(?), ref: 000A141C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: e57e0a17d2bb639e686bee31ca88effa54634dba160bdeaca4b21f3e953541e0
Instruction ID: 1156f9639017afb9ab25d3fd27b1e81f053abdb47b92d524605136e976527cc7
Opcode Fuzzy Hash: e57e0a17d2bb639e686bee31ca88effa54634dba160bdeaca4b21f3e953541e0
Instruction Fuzzy Hash: B2F0CD31004708EBDB215F5AED4C7983BFAA742326F088228F4694ACF1C77545E6DF64

Function 000F8992 Relevance: 7.5, APIs: 5, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 000F899D
CloseHandle.KERNEL32(?), ref: 000F89B2
CloseHandle.KERNEL32(?), ref: 000F89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 000F89C3
HeapFree.KERNEL32(00000000), ref: 000F89CA

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessSingleWait
String ID:
API String ID: 3751786701-0
Opcode ID: 86553a1cca88e7e70a92a1a9e9f1b151b65c01a2176ae956834462d8238219d3
Instruction ID: 129c9e61c23850acc3c6134c25fe883f0a1e285282e0a1748bbcadf2d71696ca
Opcode Fuzzy Hash: 86553a1cca88e7e70a92a1a9e9f1b151b65c01a2176ae956834462d8238219d3
Instruction Fuzzy Hash: 22E0C236004001FBDA115FE1ED0C91ABB79FB89322B508238F21981870CB3294B3DB50

Function 000B2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 000C0DB6: std::exception::exception.LIBCMT ref: 000C0DEC
Part of subcall function 000C0DB6: __CxxThrowException@8.LIBCMT ref: 000C0E01

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 000A7A51: _memmove.LIBCMT ref: 000A7AAB

__swprintf.LIBCMT ref: 000B2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 000B2D66

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 16eace386a4874600eb0f423fd93817a11447c8b3a7a9a3708b52f5bf6110627
Instruction ID: 7c6bd203a4e7aa5e00d57fd07cce8d118810023dc1013435339372c586587a82
Opcode Fuzzy Hash: 16eace386a4874600eb0f423fd93817a11447c8b3a7a9a3708b52f5bf6110627
Instruction Fuzzy Hash: 00915A71118201AFC714EF64D885DAFB7E8EF96750F00492DF496AB2A2EB31ED44CB52

Function 0010B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 000A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000A4743,?,?,000A37AE,?), ref: 000A4770

CoInitialize.OLE32(00000000), ref: 0010B9BB
CoCreateInstance.COMBASE(00132D6C,00000000,00000001,00132BDC,?), ref: 0010B9D4
CoUninitialize.COMBASE ref: 0010B9F1

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

Strings

.lnk, xrefs: 0010B99D, 0010B9AB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 013d2fe76b977fb3779691d3ad1bffaf740f182d16c0be422e755ee86671560e
Instruction ID: 559d923255ad333980e77b6601d2c9d0f8b1ce933a88737ef29b2ffb9a8d689a
Opcode Fuzzy Hash: 013d2fe76b977fb3779691d3ad1bffaf740f182d16c0be422e755ee86671560e
Instruction Fuzzy Hash: E0A169756043059FCB10DF54C884D6ABBE5FF8A714F048998F8999B3A2CB71EC46CB91

Function 000C501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 000C50AD

Part of subcall function 000D00F0: __87except.LIBCMT ref: 000D012B

Strings

pow, xrefs: 000C5085, 000C50A2

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 0ee3062bda46f5aa9d75059534ea896fd8796d20e91e6c7d6c13645e2b669aec
Instruction ID: c6de2ac65c9d846e3d4a353fb75da562c7722a262039b2fe46af38264b810aa2
Opcode Fuzzy Hash: 0ee3062bda46f5aa9d75059534ea896fd8796d20e91e6c7d6c13645e2b669aec
Instruction Fuzzy Hash: 7A519D6990970286DB617714CC057BE2BD0EB40301F348D5EF8D9C63EAEF349DC49A92

Function 000F97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001014BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,000F9296,?,?,00000034,00000800,?,00000034), ref: 001014E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 000F983F

Part of subcall function 00101487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,000F92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 001014B1

Part of subcall function 001013DE: GetWindowThreadProcessId.USER32(?,?), ref: 00101409
Part of subcall function 001013DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,000F925A,00000034,?,?,00001004,00000000,00000000), ref: 00101419
Part of subcall function 001013DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,000F925A,00000034,?,?,00001004,00000000,00000000), ref: 0010142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 000F98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 000F98F9

Strings

@, xrefs: 000F9911

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 21bd46f3dc16262f9cd1407ec20a277ed79d3c384395f8ff0a9b170ce64733e8
Instruction ID: d7661338fd4a6d96589eae017b826d73ad4ec1abf02d7665ad380ac3ccbd5f94
Opcode Fuzzy Hash: 21bd46f3dc16262f9cd1407ec20a277ed79d3c384395f8ff0a9b170ce64733e8
Instruction Fuzzy Hash: 2C413D7690021CBEDB10DFA4CC81EEEBBB8EB19300F104199FA55B7191DB756E85DBA0

Function 00127946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0012F910,00000000,?,?,?,?), ref: 001279DF
GetWindowLongW.USER32 ref: 001279FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00127A0C

Strings

SysTreeView32, xrefs: 001279B1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: e966feae6a9a096a4771cbc8d91a87d4255deb1c9a7196f527fea109c03063ff
Instruction ID: 501895320c6581ff0a67383ebb3c361a02eba199e9d8ca606fee5b78cb4be1b5
Opcode Fuzzy Hash: e966feae6a9a096a4771cbc8d91a87d4255deb1c9a7196f527fea109c03063ff
Instruction Fuzzy Hash: 2031BC31204216AFDF118E38EC45BEB77A9EB09334F244729F875A32E0D730E9A18B50

Function 001273D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00127461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00127475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00127499

Strings

SysMonthCal32, xrefs: 0012742C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b1023b1a5a28bf30708f3b05c972f2f15e65d811945c457dd055a09b38a4ae70
Instruction ID: e476b4e12b4b7fe951eb7c69325c529828489e4c62b72eaae7ac249e92175fe5
Opcode Fuzzy Hash: b1023b1a5a28bf30708f3b05c972f2f15e65d811945c457dd055a09b38a4ae70
Instruction Fuzzy Hash: F321E132500228BBDF159E54DC42FEB3B79EB48724F110114FE146B1D0DBB1ACA18BA0

Function 00127B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00127C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00127C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00127C5F

Strings

msctls_updown32, xrefs: 00127BC4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: be947b13d4733109cf4ed7a13fa6d627b2951750db298ae70f086b86106c8069
Instruction ID: 786d5724ccb0f19b25c36ebf6ef5a71908f4bbe6847235aeefba113f615f5a9f
Opcode Fuzzy Hash: be947b13d4733109cf4ed7a13fa6d627b2951750db298ae70f086b86106c8069
Instruction Fuzzy Hash: E3218CB5604219AFDB10DF28ECC1DA737EDEF4A394B140059FA119B3A1CB71EC618BA0

Function 00126CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00126D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00126D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00126D70

Strings

Listbox, xrefs: 00126D08

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 9d58ecde636f3bbddfcaaebceb698fbb98910dfeb58577ff2b0b464b28c885e2
Instruction ID: afcfa60ae40a9f9b35e5f8974ccb2b14b0ddc1cfc3e0117f097377fe0a2991fa
Opcode Fuzzy Hash: 9d58ecde636f3bbddfcaaebceb698fbb98910dfeb58577ff2b0b464b28c885e2
Instruction Fuzzy Hash: EA219532600128BFDF159F54EC45FAB377AEF89750F018128F9555B1D0C7719C6187A0

Function 0012770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00127772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00127787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00127794

Strings

msctls_trackbar32, xrefs: 00127749

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 7f0eb4f1f024afef9b4a107f85a7fa3592929f20250406764765d40d2d78e23e
Instruction ID: 1a07e6771869172b0394c471ff3caa17e1418eb26b6c806ee721d5616cd77a6f
Opcode Fuzzy Hash: 7f0eb4f1f024afef9b4a107f85a7fa3592929f20250406764765d40d2d78e23e
Instruction Fuzzy Hash: 0A113672204208BFEF205FA0DC09FEB37A9EF89B54F010128FA41A60D0C372E861CB20

Function 000A4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,000A4BD0,?,000A4DEF,?,001652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 000A4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 000A4C23

Strings

Wow64DisableWow64FsRedirection, xrefs: 000A4C1D
kernel32.dll, xrefs: 000A4C0C

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 430622fa276ea811570029d9b33f62bcd0f068b779830a52292d087464766d72
Instruction ID: b3d4f9469460ef6c4e339a24e30c13084356ed00c3851589170f8671ade1db2b
Opcode Fuzzy Hash: 430622fa276ea811570029d9b33f62bcd0f068b779830a52292d087464766d72
Instruction Fuzzy Hash: 63D0C230510713DFC7206FB0D908247B6E5EF09352F008C3D9486C6550E7F0D4D2C610

Function 000A4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,000A4B83,?), ref: 000A4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 000A4C56

Strings

kernel32.dll, xrefs: 000A4C3F
Wow64RevertWow64FsRedirection, xrefs: 000A4C50

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: c880924782afa3e887a27cf501583efc3eda02ed0b863b3d34a6b00918bcc04c
Instruction ID: dacc8859541f7abfb508f70808222ec91fdb9dab65e51da4516d45b5884bcfb7
Opcode Fuzzy Hash: c880924782afa3e887a27cf501583efc3eda02ed0b863b3d34a6b00918bcc04c
Instruction Fuzzy Hash: 6AD0C730610723DFC7208F71D90820A76E4AF06361F10883E98AACA560E7B0E8E1CA10

Function 00120DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00121039), ref: 00120DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00120E07

Strings

RegDeleteKeyExW, xrefs: 00120E01
advapi32.dll, xrefs: 00120DF0

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: d5dce1fa91e2f3997da6499f51942c4c5c2d41c838b1d636b9368aa1ba3a7e2b
Instruction ID: e3b08f1d2c29090ca8a84f8b135a68dc4bfdb99264d88659e59c5687c2c88b51
Opcode Fuzzy Hash: d5dce1fa91e2f3997da6499f51942c4c5c2d41c838b1d636b9368aa1ba3a7e2b
Instruction Fuzzy Hash: 5ED0C730420322DFC3218F70D808282B2E5AF08342F028C3E9892E6550E7B8D8F0CA00

Function 001190E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00118CF4,?,0012F910), ref: 001190EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00119100

Strings

kernel32.dll, xrefs: 001190E9
GetModuleHandleExW, xrefs: 001190FA

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 0786d0265ab10e3d5cd531d728a762312715e511eaf1aa4cb573e7ba76c7fb7d
Instruction ID: cbe6ec54f37c9cda99518fc918a2342e4710135b31d4d4a9546ff62eec53a51b
Opcode Fuzzy Hash: 0786d0265ab10e3d5cd531d728a762312715e511eaf1aa4cb573e7ba76c7fb7d
Instruction Fuzzy Hash: 08D01234610713EFD7209F31D81964676E5AF05751F15883E94A5D6550E770C4D1C650

Function 000E1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 000E1718
__swprintf.LIBCMT ref: 000E1749

Strings

WIN_XPe, xrefs: 000E1788
%.3d, xrefs: 000E1723

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: a56aa0432925878c06f5715e2a577fb6b65ddce5a548465b459833886f05020c
Instruction ID: 03da06eb54a1c87a4dd4a0d689ec7ec28740720f0d576e8a844790aab4facb10
Opcode Fuzzy Hash: a56aa0432925878c06f5715e2a577fb6b65ddce5a548465b459833886f05020c
Instruction Fuzzy Hash: F7D01771808298FECB249B929888DFD777CAB09B12F100462B842B2180E2318B95EA21

Function 000F717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ac868932418840e78acecbc9c406e1841acb612bc60c6bc30543f07b2e0d7c
Instruction ID: e865276a11d6a3036f0600a55860f64cc5dcb6368407c77966da6e0b2e4d05cf
Opcode Fuzzy Hash: c2ac868932418840e78acecbc9c406e1841acb612bc60c6bc30543f07b2e0d7c
Instruction Fuzzy Hash: F7C15C74A0421AEFCB14CF94C884EAEBBF5FF48704B158598E909DB651D730ED81EB91

Function 0011E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0011E0BE
CharLowerBuffW.USER32(?,?), ref: 0011E101

Part of subcall function 0011D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0011D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0011E301
_memmove.LIBCMT ref: 0011E314

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 814d24e3c68ec8f54e198571d424966e7ba93fe9fe693c97e126e9de4001fea7
Instruction ID: 32dfe66a9b7a822082defd2391d1d82cdbaa6214c9583afb886a3c06e93bc4bf
Opcode Fuzzy Hash: 814d24e3c68ec8f54e198571d424966e7ba93fe9fe693c97e126e9de4001fea7
Instruction Fuzzy Hash: D6C14A71608301DFC718DF68C490AAABBE4FF89714F14896EF8999B351D731E986CB81

Function 00118093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 001180C3
CoUninitialize.COMBASE ref: 001180CE

Part of subcall function 000FD56C: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 000FD5D4

VariantInit.OLEAUT32(?), ref: 001180D9
VariantClear.OLEAUT32(?), ref: 001183AA

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: b9ea7fb96732612b749c8657c23669da4a9087a0c21cf2c65990e0790261f378
Instruction ID: 6a256956206972293c98da77de09da7283d672f141bf4e5dba6c16dcfbb5ac31
Opcode Fuzzy Hash: b9ea7fb96732612b749c8657c23669da4a9087a0c21cf2c65990e0790261f378
Instruction Fuzzy Hash: 05A158757047019FCB14DF64C881BAAB7E4BF8A714F048468F9969B3A2CB34ED45CB92

Function 000F7530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.COMBASE(?,00000000), ref: 000F76EA
CoTaskMemFree.COMBASE(00000000), ref: 000F7702
CLSIDFromProgID.COMBASE(?,?), ref: 000F7727
_memcmp.LIBCMT ref: 000F7748

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 46f21da5580e5e0b24f23b25e6f3110073f421949e56228f882775402add9c7a
Instruction ID: cf5b9e0823a5303db3c4d61db5f336357883a9eda601ba20e28abfb7707d9d5a
Opcode Fuzzy Hash: 46f21da5580e5e0b24f23b25e6f3110073f421949e56228f882775402add9c7a
Instruction Fuzzy Hash: 96811B75A00209EFCB04DFA4C984EEEB7B9FF89315F204558E509EB250DB71AE06DB61

Function 000F687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000F688E
SysAllocString.OLEAUT32(00000000), ref: 000F6937
VariantCopy.OLEAUT32 ref: 000F6966
VariantClear.OLEAUT32(?), ref: 000F698D

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: af6e95d7349eb1bb7df17539ff5f4c16c6fb0d335f39d182803065fce81b1969
Instruction ID: 164f4875327f51d5e4b52fe14e602af1bed40ec4e07a7f94c50dfbad43e9c416
Opcode Fuzzy Hash: af6e95d7349eb1bb7df17539ff5f4c16c6fb0d335f39d182803065fce81b1969
Instruction Fuzzy Hash: 5F51E874704309DACB24EFA5D491A7EB3E4AF45310F20C81FE686DBA92DB76D840EB11

Function 001297F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0128DDC0,?), ref: 00129863
ScreenToClient.USER32(00000002,00000002), ref: 00129896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00129903

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 0e83234a3b93f7970089bf408861ab4be77c71145d08727dd3a4dd70ac1a1743
Instruction ID: 37f108c80f0ad4b7028c7009f04c8e0c0d409b9c88c412a4b0b6ad9e8cd04c6e
Opcode Fuzzy Hash: 0e83234a3b93f7970089bf408861ab4be77c71145d08727dd3a4dd70ac1a1743
Instruction Fuzzy Hash: 60517374A00219EFCF14CF58E880AAE7BB6FF45360F14816DF9559B2A0D731ADA1CB90

Function 000F9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 000F9AD2
__itow.LIBCMT ref: 000F9B03

Part of subcall function 000F9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 000F9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 000F9B6C
__itow.LIBCMT ref: 000F9BC3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: c807730f4acf88a4be0f393e22113e7b6373afd111f6334631536411949f8a49
Instruction ID: 8fe5a0e0d18599fe5a1e2b4f0676d3374ac9bbe648a75a53a81ec81b6fd6e359
Opcode Fuzzy Hash: c807730f4acf88a4be0f393e22113e7b6373afd111f6334631536411949f8a49
Instruction Fuzzy Hash: 7A417F70A0020CABDF25EF54D845BFE7BB9EF45760F004069BA09A6292DB709944DBA1

Function 0010B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0010B89E
GetLastError.KERNEL32(?,00000000), ref: 0010B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0010B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0010B915

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 62626b5dfceb7a8e4bb75da38e4bef74c4174f7be0f3bbd3004d4a33c92eb170
Instruction ID: f258b2d5a6b6935925ca6ce006d127d3a19eb45ca0295965f2e3e2610c81f01d
Opcode Fuzzy Hash: 62626b5dfceb7a8e4bb75da38e4bef74c4174f7be0f3bbd3004d4a33c92eb170
Instruction Fuzzy Hash: A6410739700610DFCB10EF55C584A9ABBE1AF4A714F098098ED8A9F762CB74FD42CB91

Function 00128851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001288DE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 8d9aa90a46d6a9eb2415f023ec2d2f3b402eb3f5623357192b9138cb834e5c4f
Instruction ID: 5b6e456a2e05735083576fd8663fedba42a674ef5e291ab605ba06f00d959c7f
Opcode Fuzzy Hash: 8d9aa90a46d6a9eb2415f023ec2d2f3b402eb3f5623357192b9138cb834e5c4f
Instruction Fuzzy Hash: 4431F434602128FFEF249A58EC45FB837A5EB49314F544116FA11E61A1CF70D9F1D752

Function 0012AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0012AB60
GetWindowRect.USER32(?,?), ref: 0012ABD6
PtInRect.USER32(?,?,0012C014), ref: 0012ABE6
MessageBeep.USER32(00000000), ref: 0012AC57

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: d17d2f141116159307f1ed169911afdb784b90cc9669643ec463f47c60477bc4
Instruction ID: 573502cc0876e7d89c4f52cb34182f99e332f9350aaea1086fb3893846ff2da9
Opcode Fuzzy Hash: d17d2f141116159307f1ed169911afdb784b90cc9669643ec463f47c60477bc4
Instruction Fuzzy Hash: 3E41A430600129DFCB21DF58E884B59BBF6FF49310F5480A9E458DB665D731E861CF92

Function 00100AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00100B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00100B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00100BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00100BFB

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 60ed4a1d3d88e4c5a538baae0f668652f82ed0bb0eaac38ce92f611f946b899b
Instruction ID: 61f7640c1b3b6591c728581af19f94b4b76a43896adad82e68ffe46a9e424ee6
Opcode Fuzzy Hash: 60ed4a1d3d88e4c5a538baae0f668652f82ed0bb0eaac38ce92f611f946b899b
Instruction Fuzzy Hash: 0F315834D4061CAEFF368B298C05BFABBA9AF4D318F08436AF5C1521D1C3F889959751

Function 00100C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7707C0D0,?,00008000), ref: 00100C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00100C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00100CE1
SendInput.USER32(00000001,?,0000001C,7707C0D0,?,00008000), ref: 00100D33

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1aff2e053e8448fdeb8dd342c843f28fb28e37314dd6615564d0fdbad5be99bf
Instruction ID: 48443613af059de792505ec689e096675cf301b34cc7b1f9113fcbb3443381d3
Opcode Fuzzy Hash: 1aff2e053e8448fdeb8dd342c843f28fb28e37314dd6615564d0fdbad5be99bf
Instruction Fuzzy Hash: A0314830900618AEFF368BA488147FEBB75AF4D310F04836FE4C1525D1C3B59D959761

Function 000D61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000D61FB
__isleadbyte_l.LIBCMT ref: 000D6229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000D6257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000D628D

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 01e0abeab98559f04da9177ef4b8a21cb96f9a714c1dee2494ebc12cc4612451
Instruction ID: 76393d0d46031ea5626ba2d49d933a6fe57bd1012686ae1804a5cc1579bc2b25
Opcode Fuzzy Hash: 01e0abeab98559f04da9177ef4b8a21cb96f9a714c1dee2494ebc12cc4612451
Instruction Fuzzy Hash: E631AE31604746AFDB218FA5CC45BBA7BF9BF41310F15402AE864972A2D732D951DBA0

Function 00124EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00124F02

Part of subcall function 00103641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0010365B
Part of subcall function 00103641: GetCurrentThreadId.KERNEL32 ref: 00103662
Part of subcall function 00103641: AttachThreadInput.USER32(00000000,?,00105005), ref: 00103669

GetCaretPos.USER32(?), ref: 00124F13
ClientToScreen.USER32(00000000,?), ref: 00124F4E
GetForegroundWindow.USER32 ref: 00124F54

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 4b47d2405e1237e85ed2e3a28cb272ba0aa4f9b0b5621cea2426939c5d7cba77
Instruction ID: 0f73ca8462381d43c48fb32f9a22c7581064e377ac83e06e22fa8253dfd7ae82
Opcode Fuzzy Hash: 4b47d2405e1237e85ed2e3a28cb272ba0aa4f9b0b5621cea2426939c5d7cba77
Instruction Fuzzy Hash: E7311E71E00108AFDB14EFA5C9859EFB7FDEF99300F10406AE455E7242DA759E458BA0

Function 00103C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00103C7A
Process32FirstW.KERNEL32(00000000,?), ref: 00103C88
Process32NextW.KERNEL32(00000000,?), ref: 00103CA8
CloseHandle.KERNEL32(00000000), ref: 00103D52

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 47a97cd64f28853237277f08a1a79cb9dd7d75f6a8330683aff8c8f9dbf091b7
Instruction ID: 09afa9ff673adc6be19bc692182648c4eedf1d8ba2b75ecfc9600c37831a4d27
Opcode Fuzzy Hash: 47a97cd64f28853237277f08a1a79cb9dd7d75f6a8330683aff8c8f9dbf091b7
Instruction Fuzzy Hash: 3B3193711083059FD314EF90CC85AEFBBF8AF95354F50092DF495861E2EBB19A4ACB52

Function 000F8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000F810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 000F8121
Part of subcall function 000F810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 000F812B
Part of subcall function 000F810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000F813A
Part of subcall function 000F810A: RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 000F8141
Part of subcall function 000F810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000F8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 000F86A3
_memcmp.LIBCMT ref: 000F86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000F86FC
HeapFree.KERNEL32(00000000), ref: 000F8703

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocateErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 2182266621-0
Opcode ID: 63eeafbe7cdd3a75388037b810e372a2dc67c48197863aefd099c3203806551b
Instruction ID: 877a0f41e15acedccac12a5ca12ea57fe4c980669e358afd011c0f168908fbce
Opcode Fuzzy Hash: 63eeafbe7cdd3a75388037b810e372a2dc67c48197863aefd099c3203806551b
Instruction Fuzzy Hash: 6B216B71E00108EBDB14DFA4D949BFEB7F8EF44304F158059E644A7641EB30AE45DB50

Function 000C098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 000C09AE

Part of subcall function 000A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00107896,?,?,00000000), ref: 000A5A2C
Part of subcall function 000A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00107896,?,?,00000000,?,?), ref: 000A5A50

_fprintf.LIBCMT ref: 000C09E5
OutputDebugStringW.KERNEL32(?), ref: 000F5DBB

Part of subcall function 000C4AAA: _flsall.LIBCMT ref: 000C4AC3

__setmode.LIBCMT ref: 000C0A1A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: fb858dc7754356e4c29b13eb067d82e080beda2b89efb0e3cc1c82465947457f
Instruction ID: 3705d8c166dd5e0e202c9a6b02efb6ceba825c73467238454068386d1fd0b49d
Opcode Fuzzy Hash: fb858dc7754356e4c29b13eb067d82e080beda2b89efb0e3cc1c82465947457f
Instruction Fuzzy Hash: 46110231A04608BBDB04B3F49C46EFE77A8AF52321F20011DF20556183EF60484697A2

Function 00111767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 001117A3

Part of subcall function 0011182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0011184C
Part of subcall function 0011182D: InternetCloseHandle.WININET(00000000), ref: 001118E9

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 09504016a91bd01e41b26013653dff90c54f7865a3b51203519202a651768ee3
Instruction ID: f5451aac7e814d0651d0a70a917ee15421fcdf44e01e02d673a144579fe95e2a
Opcode Fuzzy Hash: 09504016a91bd01e41b26013653dff90c54f7865a3b51203519202a651768ee3
Instruction Fuzzy Hash: 28218435200605BFEB1A9F60DC41FFAFBA9FF48710F10413EFA5596650D77198A297A0

Function 00103A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0012FAC0), ref: 00103A64
GetLastError.KERNEL32 ref: 00103A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00103A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0012FAC0), ref: 00103ADF

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: c6f143c78a4c52428b3e96d1ca0024ee4738dc181676167c40ddccfc2aa40343
Instruction ID: 52a49183b2ae0bd56ffeb3dcd4b9fcd2755d92e65054975a3bbfe008f8a8e126
Opcode Fuzzy Hash: c6f143c78a4c52428b3e96d1ca0024ee4738dc181676167c40ddccfc2aa40343
Instruction Fuzzy Hash: 12216074608201DFC710DF68D8818AAB7E8AF56764F104A2DF4E9C72E2D771DA46CB92

Function 000D50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000D5101

Part of subcall function 000C571C: __FF_MSGBANNER.LIBCMT ref: 000C5733
Part of subcall function 000C571C: __NMSG_WRITE.LIBCMT ref: 000C573A
Part of subcall function 000C571C: RtlAllocateHeap.NTDLL(01270000,00000000,00000001), ref: 000C575F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: d3e058b1d85cdc4727029131f95486bbf42f2440c3c55d774c18f73996993dff
Instruction ID: 3952f599a0aad7ae86a5d585ae6e90acdb4fe54721e4dd187f3349b755574a75
Opcode Fuzzy Hash: d3e058b1d85cdc4727029131f95486bbf42f2440c3c55d774c18f73996993dff
Instruction Fuzzy Hash: 4511A376504B11AECB312FB4AC45B9E3BE8AF543A2F10452FFD4596352DF308D8197A4

Function 00116369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00107896,?,?,00000000), ref: 000A5A2C
Part of subcall function 000A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00107896,?,?,00000000,?,?), ref: 000A5A50

gethostbyname.WS2_32(?), ref: 00116399
WSAGetLastError.WS2_32(00000000), ref: 001163A4
_memmove.LIBCMT ref: 001163D1
inet_ntoa.WS2_32(?), ref: 001163DC

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: a78cc5f0d63d495a47d7b1785c604af822be91a3fc6efdc9ba2383afa1cdc921
Instruction ID: d4df37a5e5a633b773df65623c07b2ffcff8d16db598e0bd60be0ce08a298006
Opcode Fuzzy Hash: a78cc5f0d63d495a47d7b1785c604af822be91a3fc6efdc9ba2383afa1cdc921
Instruction Fuzzy Hash: 4E117C31600109AFCB04EBE4DD46CEFB7B8BF15310B004039F505AB2A2DB31AE55DBA1

Function 000F85B0 Relevance: 6.1, APIs: 4, Instructions: 61processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 000F85E2
OpenProcessToken.ADVAPI32(00000000), ref: 000F85E9
CloseHandle.KERNEL32(00000004), ref: 000F8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 000F8632

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: 14743fd74063b00e0571c33db4c75138e7657982f37862ade8b9565f182fce2d
Instruction ID: 9041d0d2adf5aeae549c2f95b39211468c4410c0eec7721045671dfc645060b2
Opcode Fuzzy Hash: 14743fd74063b00e0571c33db4c75138e7657982f37862ade8b9565f182fce2d
Instruction Fuzzy Hash: AE11377250124DBFDF11CFA4ED48EEE7BB9EB08704F044069FE05A2560C6728D62EB20

Function 000F8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 000F8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000F8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000F8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000F8BA4

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1d4ec401d324e08e822aed85f8a3f879b50ec764cfe3e0159a43d30ac9300767
Instruction ID: fd37f1e5b3ec8dd8509462b141ca72fd0cc37aa288d0b7bf29fb20dbed82edb5
Opcode Fuzzy Hash: 1d4ec401d324e08e822aed85f8a3f879b50ec764cfe3e0159a43d30ac9300767
Instruction Fuzzy Hash: 28110A79901218BFDB11DB95C885EEDBBB4EB48710F2040A5EA00B7250DB716E51EB94

Function 00101142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000FFCED,?,00100D40,?,00008000), ref: 0010115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,000FFCED,?,00100D40,?,00008000), ref: 00101184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000FFCED,?,00100D40,?,00008000), ref: 0010118E
Sleep.KERNEL32(?,?,?,?,?,?,?,000FFCED,?,00100D40,?,00008000), ref: 001011C1

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: dd7f71ba97faab2d0fbcf7da09244df7257581b28b88a5872482b8de7460894e
Instruction ID: 5aeb946d00bffe9d7430f90028c36498c2b66bbb5052bbf8a7c77539ab863276
Opcode Fuzzy Hash: dd7f71ba97faab2d0fbcf7da09244df7257581b28b88a5872482b8de7460894e
Instruction Fuzzy Hash: 2A118E31C0061CF7CF08DFA4D848AEEBB78FF09711F414069EA80B2280CBB495A1CB91

Function 000FD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 000FD84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 000FD864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 000FD879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 000FD897

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 8e582554d206ed01f97239ac54c63ffe44b320ca97db8d21b5a60d71edaa3a31
Instruction ID: 047eb59958794d7dce81ab2ecabef726bfdc91f217dc22768827ef80a40e3f85
Opcode Fuzzy Hash: 8e582554d206ed01f97239ac54c63ffe44b320ca97db8d21b5a60d71edaa3a31
Instruction Fuzzy Hash: FA115E75605308EBE3309F50DC08FA6BBBDEB40B40F10856EA616D6850DBB1E55BABA1

Function 000D6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 000D6FDB

Part of subcall function 000D76C2: __fltout2.LIBCMT ref: 000D76EB

__cftog_l.LIBCMT ref: 000D7001
__cftoe_l.LIBCMT ref: 000D7033

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 7ba37ef8b5b3389f16d5f76ecdb90f3e6b14aa21293be9762e078aa85d1c1007
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 28014E7244824AFBCF265F84DC05CED3F62BB18350B588456FA5C58271E237C9B1ABA1

Function 0012B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0012B2E4
ScreenToClient.USER32(?,?), ref: 0012B2FC
ScreenToClient.USER32(?,?), ref: 0012B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0012B33B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 4e8c6f40b99110ce537f0fcf6a0a403f5e9a5f3ac340631040ce21afdf8e7e39
Instruction ID: 38910aa45d117c937f35dd963c145cfc8c9824742dcffdb5339623f87fe50b9a
Opcode Fuzzy Hash: 4e8c6f40b99110ce537f0fcf6a0a403f5e9a5f3ac340631040ce21afdf8e7e39
Instruction Fuzzy Hash: DE114779D00209EFDB51CF99D4849EEBBF5FF08310F104166E914E3620D735AA658F50

Function 0012B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0012B644
_memset.LIBCMT ref: 0012B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00166F20,00166F64), ref: 0012B682
CloseHandle.KERNEL32 ref: 0012B694

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: dc9c2e9eaafad4e3a0b930daa8eef7eb5b6cb077efc5a063cba6527951a21cf8
Instruction ID: 609d6501f6cbe66f35298824e3c3d9cefd3f9a57142aaa201de4e66e9e562de6
Opcode Fuzzy Hash: dc9c2e9eaafad4e3a0b930daa8eef7eb5b6cb077efc5a063cba6527951a21cf8
Instruction Fuzzy Hash: 11F082B25403107BE3106771BC26FBB3A9CEB18395F004074FA09E9992D7B24C61C7A8

Function 00106BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00106BE6

Part of subcall function 001076C4: _memset.LIBCMT ref: 001076F9

_memmove.LIBCMT ref: 00106C09
_memset.LIBCMT ref: 00106C16
RtlLeaveCriticalSection.NTDLL(?), ref: 00106C26

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: bf6aaee4809d95c83f26ad54c41a2a6f7979ea7e0eccd26ecd19e9c51383a6db
Instruction ID: d372b7f4cbb2c6a1d2c2661455fecca6789d36d15bdcb2b3b53271eafddca5f5
Opcode Fuzzy Hash: bf6aaee4809d95c83f26ad54c41a2a6f7979ea7e0eccd26ecd19e9c51383a6db
Instruction Fuzzy Hash: 25F0543A100100BBCF016F95DC85E8ABB29EF55320F048065FE095E267CB71E852CBB4

Function 000A2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 000A2231
SetTextColor.GDI32(?,000000FF), ref: 000A223B
SetBkMode.GDI32(?,00000001), ref: 000A2250
GetStockObject.GDI32(00000005), ref: 000A2258
GetWindowDC.USER32(?,00000000), ref: 000DBE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 000DBE90
GetPixel.GDI32(00000000,?,00000000), ref: 000DBEA9
GetPixel.GDI32(00000000,00000000,?), ref: 000DBEC2
GetPixel.GDI32(00000000,?,?), ref: 000DBEE2
ReleaseDC.USER32(?,00000000), ref: 000DBEED

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 6671ff2b53ffe26fe87159b7999f5882de88fb702c52eeb51d29dc5c8a7c9b97
Instruction ID: 10bd625fe8e207236a21ba585a4f6439b85629adb468ca83f6539d4956f29ab1
Opcode Fuzzy Hash: 6671ff2b53ffe26fe87159b7999f5882de88fb702c52eeb51d29dc5c8a7c9b97
Instruction Fuzzy Hash: 4EE03932104244FADB615FA8EC0DBD83B60EB05332F00837AFA69880E1877149A2DB22

Function 000F8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000F871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,000F82E6), ref: 000F8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,000F82E6), ref: 000F872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,000F82E6), ref: 000F8736

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: dcdd25b85f8fee16c9e26d27ce7cb0b627184511aefc98a28ab28b0c1cc2b4d7
Instruction ID: 807f77c01eccbe345990f9cd953fce687abffb243351639c320d948fda081327
Opcode Fuzzy Hash: dcdd25b85f8fee16c9e26d27ce7cb0b627184511aefc98a28ab28b0c1cc2b4d7
Instruction Fuzzy Hash: 25E04F36615311EBD770AFB06D0CB973BB8EF55791F14883CB245C9440DA248493D750

Function 000FB2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 000FB4BE

Strings

AutoIt3GUI, xrefs: 000FB436
Container, xrefs: 000FB43B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: d60cbd0613a8178fb485bdbb6791be87790e884eb19be5b8635b2f9056cf1652
Instruction ID: cc9600659058cd31e3f2802b08e81033cf46f31808a1edc234ede2847a6a9a59
Opcode Fuzzy Hash: d60cbd0613a8178fb485bdbb6791be87790e884eb19be5b8635b2f9056cf1652
Instruction Fuzzy Hash: 12915870200605AFDB64DF64C884B6AB7E9FF48B00F20846DFA4ACB691DB71E841DF50

Function 0010AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 000BFC86: _wcscpy.LIBCMT ref: 000BFCA9

Part of subcall function 000A9837: __itow.LIBCMT ref: 000A9862
Part of subcall function 000A9837: __swprintf.LIBCMT ref: 000A98AC

__wcsnicmp.LIBCMT ref: 0010B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0010B0F6

Strings

LPT, xrefs: 0010B027

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 58c2ee660a7fdf4da5ae1a325be331e2379962143cb8ee1674656f508b93b399
Instruction ID: 3960b4df2186df66027dff7175f76cc1ccb25adb11e8539c96911604e4e523e8
Opcode Fuzzy Hash: 58c2ee660a7fdf4da5ae1a325be331e2379962143cb8ee1674656f508b93b399
Instruction Fuzzy Hash: 6461A075A04219EFCB18DF94D891EFEB7B4EF09710F114069F956AB291DBB0AE80CB50

Function 000B2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 000B2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 000B2981

Strings

@, xrefs: 000B2975

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: a074f9c67c0d1f514fa0355703151428e8a1c9424ee08dc120b2bd2714804b76
Instruction ID: e8dbd473b19bdc82f665475ce220d7308709f964835b8f79915ff157de929bdf
Opcode Fuzzy Hash: a074f9c67c0d1f514fa0355703151428e8a1c9424ee08dc120b2bd2714804b76
Instruction Fuzzy Hash: F7514771518744ABE320EF50D886BEFBBE8FB86344F41885DF2D8410A2DF358569CB66

Function 00109734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 000A4F0B: __fread_nolock.LIBCMT ref: 000A4F29

_wcscmp.LIBCMT ref: 00109824
_wcscmp.LIBCMT ref: 00109837

Strings

FILE, xrefs: 00109770

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 8e472e865cced5fe04272bbfd3b73c2e90e96f13e6fd1a6a301c4ed25a2d202c
Instruction ID: 66eaebff88700709a0bab95d962f9a7ed0cedef82762302d83cca41b8d369c16
Opcode Fuzzy Hash: 8e472e865cced5fe04272bbfd3b73c2e90e96f13e6fd1a6a301c4ed25a2d202c
Instruction Fuzzy Hash: 42419575A00219BADF219AE4CC56FEFB7B9DF86710F00447AF944A7182DBB199048B61

Function 0011258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0011259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 001125D4

Strings

|, xrefs: 001125A5

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 686fe055fa129613a74c4c14a0083df049692e0f70f3afe5d8a6f1d038feffd7
Instruction ID: 242cfce5a9a61a2d27ba3457c2d9d2a235ab197e262599cfceb811b67046c4ff
Opcode Fuzzy Hash: 686fe055fa129613a74c4c14a0083df049692e0f70f3afe5d8a6f1d038feffd7
Instruction Fuzzy Hash: 4031F471804219EBCF15EFA0CC85EEEBFB9FF09350F104069ED19A6162EB315956DB60

Function 00127A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00127B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00127B76

Strings

', xrefs: 00127ACA

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 34e91f5c089b3c7c74e63e7973fdbf81814a8d86df43417fd103a7b378d55c0a
Instruction ID: 918edae67d861860357a6e53560176eb4728c18f54ba7a554b0b9db87b6c6bd9
Opcode Fuzzy Hash: 34e91f5c089b3c7c74e63e7973fdbf81814a8d86df43417fd103a7b378d55c0a
Instruction Fuzzy Hash: 27413874A0521A9FDB14CF68D980BEABBB9FF08310F14016AE904EB381D770A961CF90

Function 00126A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00126B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00126B53

Strings

static, xrefs: 00126AB3

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ebe7c1f60cdc32a1b7accf1f7ba8720d5f0aa46bdd5c3318b8e983af5f94ea71
Instruction ID: 196e2c174a5a6f864ba88c559c502ad53b2847cec881cd1156187e0eef362294
Opcode Fuzzy Hash: ebe7c1f60cdc32a1b7accf1f7ba8720d5f0aa46bdd5c3318b8e983af5f94ea71
Instruction Fuzzy Hash: 4C316D71200614AEDB109F68DC81AFB77B9FF48760F10862DF9A9D7190DB35ACA2C760

Function 001028A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00102911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0010294C

Strings

0, xrefs: 0010290A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 261bb29b1fd9306503fcb1a6943edd7f69a793b8b27290fe0b183dcf10c72b7c
Instruction ID: 5870e5f11bd179915a9dd2b64539e21a6d842d7053c75dd9ce0e00cb31ab390b
Opcode Fuzzy Hash: 261bb29b1fd9306503fcb1a6943edd7f69a793b8b27290fe0b183dcf10c72b7c
Instruction Fuzzy Hash: 80319131600315EBEF28CF98C989BAEBBF9EF45358F144029E9C5A61E1D7F09944CB51

Function 001139E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00113A66

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Strings

, $, xrefs: 00113AA6
AUTOITCALLVARIABLE%d, xrefs: 00113A58

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: d4a86a92a1d43aac673c218fa23d36c81f4612b95bdca270f9eb9efa696543cc
Instruction ID: d1e90c49b38f8eeeef4d5934cfb9c3993d7a731750899656755a4b94bab65047
Opcode Fuzzy Hash: d4a86a92a1d43aac673c218fa23d36c81f4612b95bdca270f9eb9efa696543cc
Instruction Fuzzy Hash: E4218D30600219AFCF14EFA4DC82EEE77B5AF45310F404468F969BB186DB30EA85CB61

Function 001266D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00126761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0012676C

Strings

Combobox, xrefs: 0012672E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: e1c5b7feec51fe016adfa4ff4b8f2d64e0777a5d87ab7773384f0b6f833de3bf
Instruction ID: 95aeb124a38f27b643d6fca649a11b7c72cf532c084200ae91f6284c8b5d6a9d
Opcode Fuzzy Hash: e1c5b7feec51fe016adfa4ff4b8f2d64e0777a5d87ab7773384f0b6f833de3bf
Instruction Fuzzy Hash: 0B11B275200218AFEF218F54EC80EEB376BEB48368F100129F9149B2D0D771DC6197A0

Function 00126C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 000A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 000A1D73
Part of subcall function 000A1D35: GetStockObject.GDI32(00000011), ref: 000A1D87
Part of subcall function 000A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 000A1D91

GetWindowRect.USER32(00000000,?), ref: 00126C71
GetSysColor.USER32(00000012), ref: 00126C8B

Strings

static, xrefs: 00126C4E

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6d7e915695354507be951c44f8debd7ebca0987cdc518e97d230c1e5a49bde28
Instruction ID: f80062260a398f3adae5069292393af4bd98ea1f6b903e2539baca306dff8ead
Opcode Fuzzy Hash: 6d7e915695354507be951c44f8debd7ebca0987cdc518e97d230c1e5a49bde28
Instruction Fuzzy Hash: 0421267261021AAFDF14DFA8DC45EEA7BB8FB08314F004629F995D2290D735E861DB60

Function 00126920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 001269A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 001269B1

Strings

edit, xrefs: 00126986

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f8100c753a722ba0f0d5e7a279890e3fc70a558a14fad724c4c1de4604cd5bf0
Instruction ID: fea640042b7a9d6c36f156d6514382d827aeb4d40c450409ecdb61f1415f3cd2
Opcode Fuzzy Hash: f8100c753a722ba0f0d5e7a279890e3fc70a558a14fad724c4c1de4604cd5bf0
Instruction Fuzzy Hash: 5C114F71500124AFEF108F64EC45EEB3769EB05378F504728F9A5971E0CB75DCA19760

Function 001029AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00102A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00102A41

Strings

0, xrefs: 00102A18

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: cde5e52e137e35103fbd644ee16b8925863a29aa53f81f544ea2ccf94b9189b3
Instruction ID: a71357989515be133858869493ae55bbe969fcf34681835961cf1c79f7e26891
Opcode Fuzzy Hash: cde5e52e137e35103fbd644ee16b8925863a29aa53f81f544ea2ccf94b9189b3
Instruction Fuzzy Hash: 9311E232A01124EBCF34DF98DC48BAA77B9AB45344F154061E895E76D0DBB0AD0AC791

Function 001121D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0011222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00112255

Strings

<local>, xrefs: 0011221D

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: b6b9281384ab8f8fa5324fe1598a09963d571773f8b0792b888bb497fe1e64e9
Instruction ID: 838149780b079993e65bb14fe21060b39cc8dddc2be9f00a8ca46cbfd40cb585
Opcode Fuzzy Hash: b6b9281384ab8f8fa5324fe1598a09963d571773f8b0792b888bb497fe1e64e9
Instruction Fuzzy Hash: F6110E70501225BADB2C8F118C88EFBFBA8FF1A351F10823AF91586000E3B058E5DAF0

Function 000F8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 000FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000FAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 000F8E73

Strings

ListBox, xrefs: 000F8E3D
ComboBox, xrefs: 000F8E12

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: db786b1a79387efa4bcb7f431190ae1a6c3b413927360e8591d915be5e73045e
Instruction ID: 8b537c0beb1c0d4b17818de93259b0d042d4b03c228fd176d3b943eebe5951e6
Opcode Fuzzy Hash: db786b1a79387efa4bcb7f431190ae1a6c3b413927360e8591d915be5e73045e
Instruction Fuzzy Hash: 0601F1B1701218ABCB14EBE0CC468FE7368EF06320B004A19B9355B6E2EF31580CE750

Function 000F8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 000FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000FAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 000F8D6B

Strings

ListBox, xrefs: 000F8D35
ComboBox, xrefs: 000F8D0A

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: fc96d05769f515091c95413fa99e013f877078359d14094d365a9a4a9d80575a
Instruction ID: 8f04fb240269b9e39ba79a7eb27001d51cedd8b6b299d2277a3b91df41a7a66d
Opcode Fuzzy Hash: fc96d05769f515091c95413fa99e013f877078359d14094d365a9a4a9d80575a
Instruction Fuzzy Hash: C801B1B1B4110CABCB24EBE0CD52AFF77A89F16300F104019B9156B6D2DE145A0CA262

Function 000F8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000A7DE1: _memmove.LIBCMT ref: 000A7E22

Part of subcall function 000FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 000FAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 000F8DEE

Strings

ListBox, xrefs: 000F8DBA
ComboBox, xrefs: 000F8D8F

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: cdff86fd187f1d106f984558ead3e78bdb52c25c861f91327e7692ba57e6994d
Instruction ID: b7059ffa385f6289c0fbebfd6e402bb25e38d4477c625ce180810353e72a23b0
Opcode Fuzzy Hash: cdff86fd187f1d106f984558ead3e78bdb52c25c861f91327e7692ba57e6994d
Instruction Fuzzy Hash: 0C0184B1A41109A7DB25E6E4CD42AFF77A89F16300F104019B916676D2DA154E0DE271

Function 00104F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00104F46
_wcscmp.LIBCMT ref: 00104F58

Strings

#32770, xrefs: 00104F52

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 7f720161b7c9ea295aef7070e9e3c02be7f80b3a050e7ffe5df9234123962dbb
Instruction ID: ac59521651e08949f2ea6c5d635df4304e2a3651257db46e914be87bc00c539c
Opcode Fuzzy Hash: 7f720161b7c9ea295aef7070e9e3c02be7f80b3a050e7ffe5df9234123962dbb
Instruction Fuzzy Hash: E6E0D13350022967D7209B599C45FA7F7BCDB45B71F00006BFD04D7051D6609B5687D0

Function 000DB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000DB314: _memset.LIBCMT ref: 000DB321

Part of subcall function 000C0940: InitializeCriticalSectionAndSpinCount.KERNEL32(00164158,00000000,00164144,000DB2F0,?,?,?,000A100A), ref: 000C0945

IsDebuggerPresent.KERNEL32(?,?,?,000A100A), ref: 000DB2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,000A100A), ref: 000DB303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000DB2FE

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: d7348a44e9871629396867c8145eb763cd383cf411b86043718604e72d001374
Instruction ID: 23b0976415b0b5b85ddfbd6ef49adf37789c8bdb66486533c7aaeb8f57dca76f
Opcode Fuzzy Hash: d7348a44e9871629396867c8145eb763cd383cf411b86043718604e72d001374
Instruction Fuzzy Hash: C6E03270200710CBD720AF68E904B867AE8EF00744F018A2EE486C6B51EBB4E586CBB1

Function 000F7C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 000F7C82

Part of subcall function 000C3358: _doexit.LIBCMT ref: 000C3362

Strings

AutoIt, xrefs: 000F7C76
Error allocating memory., xrefs: 000F7C7B

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 678d273a5d71b86c6d624958c63da5025a07da74fbf90173795f8fcaec31f082
Instruction ID: 2dd4b25e2d6c25a520e82c13bca40aa7d5b6b11c4593ea58ec8956bdbfb0bd90
Opcode Fuzzy Hash: 678d273a5d71b86c6d624958c63da5025a07da74fbf90173795f8fcaec31f082
Instruction Fuzzy Hash: 2DD05B323C435C76D11533A9BC07FDE75888F05B52F144429FF08995D34AD5499151E5

Function 000E1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 000E1775

Part of subcall function 0011BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,000E195E,?), ref: 0011BFFE
Part of subcall function 0011BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0011C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 000E196D

Strings

WIN_XPe, xrefs: 000E1788

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 83836703e42ba59d65905ade6c023cd30bba2ecc76e7a9a39aeca2bcad82c3f8
Instruction ID: ff0c4625c24ed86987d4495b7619a68ab7f2e0a27b9ef10600a41c97dfb7a06f
Opcode Fuzzy Hash: 83836703e42ba59d65905ade6c023cd30bba2ecc76e7a9a39aeca2bcad82c3f8
Instruction Fuzzy Hash: 3CF0ED71808149EFDB25DB92C988AECBBF8BB18701F5400AAE142B6590D7714FC6DF61

Function 00125964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0012596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00125981

Part of subcall function 00105244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 001052BC

Strings

Shell_TrayWnd, xrefs: 00125967

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 44181f7fb6610f3e3976c90e68a567be8e6dd9e413a9f86f6de86b0baff43900
Instruction ID: 4574328917cefde8b296839a0ee5a7604b6e50803c1a5824e82b2a65377f481c
Opcode Fuzzy Hash: 44181f7fb6610f3e3976c90e68a567be8e6dd9e413a9f86f6de86b0baff43900
Instruction Fuzzy Hash: F4D0C931394311B6E674BB709C0BFD76A25AF10B51F000839B699AA5D0DAE09852CA54

Function 00125998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001259AE
PostMessageW.USER32(00000000), ref: 001259B5

Part of subcall function 00105244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 001052BC

Strings

Shell_TrayWnd, xrefs: 001259A7

Memory Dump Source

Source File: 00000008.00000002.1326919453.00000000000A1000.00000040.00000001.01000000.00000006.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000008.00000002.1326899137.00000000000A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.0000000000154000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000015E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.000000000016D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1326919453.00000000001A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327111505.00000000001AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1327132281.00000000001AB000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_a0000_EmbeddedExe1.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 70785b4adb7ed7270f956d2767cdd507fc01e7c1d0911511735b47525955048a
Instruction ID: 930e3dde1befd32944069ae83746b32c8b240f6140466015fde516e26fbb7c0b
Opcode Fuzzy Hash: 70785b4adb7ed7270f956d2767cdd507fc01e7c1d0911511735b47525955048a
Instruction Fuzzy Hash: 17D0C931380311BAE674BB709C0BFD76A25AF14B51F000839B695AA5D0DAE0A852CA54

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uVpytXGpQz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uVpytXGpQz.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Temp\EmbeddedExe1.exe

C:\Users\user\AppData\Local\Temp\EmbeddedExe2.exe

C:\Users\user\AppData\Local\Temp\aut7F73.tmp

C:\Users\user\AppData\Local\Temp\aut907B.tmp

C:\Users\user\AppData\Local\Temp\autC3B0.tmp

C:\Users\user\AppData\Local\Temp\vitraillist

C:\Users\user\AppData\Local\poufs\caulds.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caulds.vbs

Static File Info

Windows Analysis Report
uVpytXGpQz.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre