Edit tour

Windows Analysis Report
Xre0Nmqk09.exe

Overview

General Information

Sample name:	Xre0Nmqk09.exe renamed because original name is a hash value
Original sample name:	e47bbcc86c09be704eb8ffde9dcb0c70f0996fa9bf2e0e5df5b42ebb66fe97e0.exe
Analysis ID:	1588803
MD5:	a529f43a61267b1f6f42059dba8e179b
SHA1:	57224be49c5bde441959d2c68489d5c635b164a8
SHA256:	e47bbcc86c09be704eb8ffde9dcb0c70f0996fa9bf2e0e5df5b42ebb66fe97e0
Tags:	exeRedLineStealeruser-adrian__luca
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected PureLog Stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Xre0Nmqk09.exe (PID: 7744 cmdline: "C:\Users\user\Desktop\Xre0Nmqk09.exe" MD5: A529F43A61267B1F6F42059DBA8E179B)

RegSvcs.exe (PID: 7804 cmdline: "C:\Users\user\Desktop\Xre0Nmqk09.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

Xre0Nmqk09.exe (PID: 7812 cmdline: "C:\Users\user\Desktop\Xre0Nmqk09.exe" MD5: A529F43A61267B1F6F42059DBA8E179B)

RegSvcs.exe (PID: 7844 cmdline: "C:\Users\user\Desktop\Xre0Nmqk09.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

Xre0Nmqk09.exe (PID: 7856 cmdline: "C:\Users\user\Desktop\Xre0Nmqk09.exe" MD5: A529F43A61267B1F6F42059DBA8E179B)

RegSvcs.exe (PID: 7872 cmdline: "C:\Users\user\Desktop\Xre0Nmqk09.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.thelamalab.com", "Username": "billing@thelamalab.com", "Password": "Thel@malab@20!9"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2623567257.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2622508052.0000000000400000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000003.00000002.1391379435.0000000003B40000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40365:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x403d7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40461:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x404f3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4055d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x405cf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40665:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x406f5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f47d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f579:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f60b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f675:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f6e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f77d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f80d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000005.00000002.1403377308.0000000001B50000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000000.00000002.1379475830.0000000003E60000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2623567257.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2623567257.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2623567257.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7872	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.RegSvcs.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
6.2.RegSvcs.exe.52d0ee8.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.52d0ee8.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.52d0ee8.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.52d0ee8.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d67d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d779:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d80b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d875:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d8e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d97d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3da0d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.2.RegSvcs.exe.3de2f90.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.3de2f90.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.3de2f90.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.3de2f90.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d67d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d779:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d80b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d875:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d8e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d97d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3da0d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.3de2f90.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.3de2f90.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.3de2f90.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.3de2f90.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f47d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f579:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f60b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f675:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f6e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f77d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f80d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.5580000.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.5580000.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.5580000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.5580000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f47d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f579:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f60b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f675:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f6e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f77d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f80d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.3d96458.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.3d96458.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.3d96458.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.3d96458.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d67d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d779:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d80b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d875:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d8e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d97d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3da0d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.52d0ee8.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.52d0ee8.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.52d0ee8.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.52d0ee8.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f47d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f579:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f60b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f675:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f6e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f77d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f80d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.5580000.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.5580000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.5580000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.5580000.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d67d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d779:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d80b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d875:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d8e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d97d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3da0d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.29afebe.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.29afebe.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.29afebe.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.29afebe.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f47d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f579:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f60b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f675:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f6e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f77d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f80d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.29aefd6.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.29aefd6.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.29aefd6.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.29aefd6.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40365:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x403d7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40461:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x404f3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4055d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x405cf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40665:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x406f5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Xre0Nmqk09.exe.3e60000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.2.RegSvcs.exe.52d0000.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.52d0000.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.52d0000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.52d0000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40365:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x403d7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40461:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x404f3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4055d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x405cf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40665:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x406f5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.3d95570.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.3d95570.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.3d95570.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.3d95570.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40365:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8ce9d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x403d7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8cf0f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40461:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8cf99:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x404f3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8d02b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4055d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8d095:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x405cf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8d107:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40665:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8d19d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x406f5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8d22d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.29aefd6.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.29aefd6.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.29aefd6.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.Xre0Nmqk09.exe.3b40000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.2.RegSvcs.exe.29aefd6.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e565:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e5d7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e661:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e6f3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e75d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e7cf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e865:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3e8f5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.52d0000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.52d0000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.52d0000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.52d0000.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e565:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e5d7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e661:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e6f3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e75d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e7cf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e865:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3e8f5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.Xre0Nmqk09.exe.1b50000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8B 88 44 24 2B 88 44 24 2F B0 EC 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.2.RegSvcs.exe.29afebe.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.29afebe.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.29afebe.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.29afebe.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d67d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d779:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d80b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d875:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d8e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d97d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3da0d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.3d95570.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.3d95570.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.3d95570.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.3d95570.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e565:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e5d7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e661:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e6f3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e75d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e7cf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e865:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3e8f5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.3d96458.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.3d96458.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.3d96458.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.RegSvcs.exe.3d96458.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f47d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8bfb5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8c027:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f579:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8c0b1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f60b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8c143:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f675:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8c1ad:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f6e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8c21f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f77d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8c2b5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f80d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8c345:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 64 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 162.251.80.30, DesusertionIsIpv6: false, DesusertionPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7872, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49772

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:41:26.551070+0100	2030171	1	A Network Trojan was detected	192.168.2.9	49772	162.251.80.30	587	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:41:41.776076+0100	2855542	1	A Network Trojan was detected	192.168.2.9	49772	162.251.80.30	587	TCP

ETPRO MALWARE Agent Tesla Exfil via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:41:41.776076+0100	2855245	1	A Network Trojan was detected	192.168.2.9	49772	162.251.80.30	587	TCP

ETPRO MALWARE Win32/Agent Tesla SMTP Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:41:26.551070+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.9	49772	162.251.80.30	587	TCP

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:41:26.551070+0100	2840032	1	A Network Trojan was detected	192.168.2.9	49772	162.251.80.30	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 6.2.RegSvcs.exe.3de2f90.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.thelamalab.com", "Username": "billing@thelamalab.com", "Password": "Thel@malab@20!9"}

Multi AV Scanner detection for submitted file

Source: Xre0Nmqk09.exe	Virustotal: Detection: 68%			Perma Link
Source: Xre0Nmqk09.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Xre0Nmqk09.exe

Joe Sandbox ML: detected

Source: Xre0Nmqk09.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Xre0Nmqk09.exe, 00000000.00000003.1375352350.0000000003EB0000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000000.00000003.1375557544.0000000004050000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000003.00000003.1389659922.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000003.00000003.1389243370.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000005.00000003.1399915358.0000000003880000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000005.00000003.1398650007.0000000003690000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Xre0Nmqk09.exe, 00000000.00000003.1375352350.0000000003EB0000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000000.00000003.1375557544.0000000004050000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000003.00000003.1389659922.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000003.00000003.1389243370.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000005.00000003.1399915358.0000000003880000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000005.00000003.1398650007.0000000003690000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006D4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_006D4696
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DC93C FindFirstFileW,FindClose,	0_2_006DC93C
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_006DC9C7
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006DF200
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006DF35D
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_006DF65E
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006D3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_006D3A2B
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006D3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_006D3D4E
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_006DBF27

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.9:49772 -> 162.251.80.30:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.9:49772 -> 162.251.80.30:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.9:49772 -> 162.251.80.30:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.9:49772 -> 162.251.80.30:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.9:49772 -> 162.251.80.30:587

Source: global traffic

TCP traffic: 192.168.2.9:49772 -> 162.251.80.30:587

Source: Joe Sandbox View

IP Address: 162.251.80.30 162.251.80.30

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: global traffic

TCP traffic: 192.168.2.9:49772 -> 162.251.80.30:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006E25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_006E25E2

Source: global traffic

DNS traffic detected: DNS query: mail.thelamalab.com

Source: RegSvcs.exe, 00000006.00000002.2623567257.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.thelamalab.com
Source: RegSvcs.exe, 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006E425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_006E425A

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006E4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_006E4458

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

0_2_006E425A

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006D0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_006D0219

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006FCDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_006FCDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.RegSvcs.exe.52d0ee8.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.RegSvcs.exe.3de2f90.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.3de2f90.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.5580000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.3d96458.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.52d0ee8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.5580000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.29afebe.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.29aefd6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Xre0Nmqk09.exe.3e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.RegSvcs.exe.52d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.3d95570.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.Xre0Nmqk09.exe.3b40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.RegSvcs.exe.29aefd6.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.52d0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.Xre0Nmqk09.exe.1b50000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.RegSvcs.exe.29afebe.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.3d95570.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.3d96458.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000006.00000002.2622508052.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000003.00000002.1391379435.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000005.00000002.1403377308.0000000001B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000002.1379475830.0000000003E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00673B4C
Source: Xre0Nmqk09.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Xre0Nmqk09.exe, 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_493dce6f-8
Source: Xre0Nmqk09.exe, 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a937d81c-d
Source: Xre0Nmqk09.exe, 00000003.00000002.1390555868.0000000000725000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_67da332e-c
Source: Xre0Nmqk09.exe, 00000003.00000002.1390555868.0000000000725000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8963b0ae-6
Source: Xre0Nmqk09.exe, 00000005.00000000.1390210862.0000000000725000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fad24012-1
Source: Xre0Nmqk09.exe, 00000005.00000000.1390210862.0000000000725000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d403b7e4-5
Source: Xre0Nmqk09.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_96140d12-8
Source: Xre0Nmqk09.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_19fd1dc4-0

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006D4021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_006D4021

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006C8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_006C8858

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006D545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_006D545F

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0069DBB5	0_2_0069DBB5
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0067E060	0_2_0067E060
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006F804A	0_2_006F804A
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00684140	0_2_00684140
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00692405	0_2_00692405
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006A6522	0_2_006A6522
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006F0665	0_2_006F0665
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006A267E	0_2_006A267E
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00686843	0_2_00686843
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0069283A	0_2_0069283A
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0067E800	0_2_0067E800
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006A89DF	0_2_006A89DF
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00688A0E	0_2_00688A0E
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006F0AE2	0_2_006F0AE2
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006A6A94	0_2_006A6A94
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006CEB07	0_2_006CEB07
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006D8B13	0_2_006D8B13
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0069CD61	0_2_0069CD61
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006A7006	0_2_006A7006
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0068710E	0_2_0068710E
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00683190	0_2_00683190
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00671287	0_2_00671287
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006933C7	0_2_006933C7
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0069F419	0_2_0069F419
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006916C4	0_2_006916C4
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00685680	0_2_00685680
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006858C0	0_2_006858C0
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006978D3	0_2_006978D3
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00691BB8	0_2_00691BB8
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006A9D05	0_2_006A9D05
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0067FE40	0_2_0067FE40
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0069BFE6	0_2_0069BFE6
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00691FD0	0_2_00691FD0
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_015F1478	0_2_015F1478
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 3_2_01251C08	3_2_01251C08
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 5_2_00EA1448	5_2_00EA1448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00408C60	6_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0040DC11	6_2_0040DC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00407C3F	6_2_00407C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00418CCC	6_2_00418CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00406CA0	6_2_00406CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004028B0	6_2_004028B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041A4BE	6_2_0041A4BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00418244	6_2_00418244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00401650	6_2_00401650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00402F20	6_2_00402F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004193C4	6_2_004193C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00418788	6_2_00418788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00402F89	6_2_00402F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00402B90	6_2_00402B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004073A0	6_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02A7CB28	6_2_02A7CB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02A7D740	6_2_02A7D740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02A7CE70	6_2_02A7CE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02A70FD0	6_2_02A70FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02A71030	6_2_02A71030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_063DC760	6_2_063DC760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_063D4DD8	6_2_063D4DD8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: String function: 00677F41 appears 35 times
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: String function: 00690D27 appears 70 times
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: String function: 00698B40 appears 42 times

Source: Xre0Nmqk09.exe, 00000000.00000003.1375853923.0000000003FD3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Xre0Nmqk09.exe
Source: Xre0Nmqk09.exe, 00000000.00000003.1375557544.000000000417D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Xre0Nmqk09.exe
Source: Xre0Nmqk09.exe, 00000000.00000002.1379475830.0000000003E60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9d02a015-5a5b-4340-adbb-c530e02a0bc4.exe4 vs Xre0Nmqk09.exe
Source: Xre0Nmqk09.exe, 00000003.00000003.1389243370.0000000003E5D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Xre0Nmqk09.exe
Source: Xre0Nmqk09.exe, 00000003.00000002.1391379435.0000000003B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9d02a015-5a5b-4340-adbb-c530e02a0bc4.exe4 vs Xre0Nmqk09.exe
Source: Xre0Nmqk09.exe, 00000003.00000003.1388654596.0000000003CB3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Xre0Nmqk09.exe
Source: Xre0Nmqk09.exe, 00000005.00000003.1398023354.00000000037B3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Xre0Nmqk09.exe
Source: Xre0Nmqk09.exe, 00000005.00000003.1401022731.00000000039AD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Xre0Nmqk09.exe
Source: Xre0Nmqk09.exe, 00000005.00000002.1403377308.0000000001B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9d02a015-5a5b-4340-adbb-c530e02a0bc4.exe4 vs Xre0Nmqk09.exe

Source: Xre0Nmqk09.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.RegSvcs.exe.52d0ee8.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.RegSvcs.exe.3de2f90.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.3de2f90.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.5580000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.3d96458.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.52d0ee8.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.5580000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.29afebe.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.29aefd6.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Xre0Nmqk09.exe.3e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.RegSvcs.exe.52d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.3d95570.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.Xre0Nmqk09.exe.3b40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.RegSvcs.exe.29aefd6.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.52d0000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.Xre0Nmqk09.exe.1b50000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.RegSvcs.exe.29afebe.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.3d95570.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.3d96458.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000006.00000002.2622508052.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000003.00000002.1391379435.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000005.00000002.1403377308.0000000001B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000002.1379475830.0000000003E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/4@1/1

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006DA2D5 GetLastError,FormatMessageW,

0_2_006DA2D5

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006C8713 AdjustTokenPrivileges,CloseHandle,		0_2_006C8713
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006C8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_006C8CC3

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006DB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_006DB59E

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006EF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_006EF121

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006DC602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_006DC602

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_00674FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00674FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

File created: C:\Users\user\AppData\Local\Temp\aut49BE.tmp

Jump to behavior

Source: Xre0Nmqk09.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Xre0Nmqk09.exe	Virustotal: Detection: 68%
Source: Xre0Nmqk09.exe	ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\Xre0Nmqk09.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Users\user\Desktop\Xre0Nmqk09.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Users\user\Desktop\Xre0Nmqk09.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Users\user\Desktop\Xre0Nmqk09.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Users\user\Desktop\Xre0Nmqk09.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Xre0Nmqk09.exe

Static file information: File size 1205760 > 1048576

Source: Xre0Nmqk09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Xre0Nmqk09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Xre0Nmqk09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Xre0Nmqk09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Xre0Nmqk09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Xre0Nmqk09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Xre0Nmqk09.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Xre0Nmqk09.exe, 00000000.00000003.1375352350.0000000003EB0000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000000.00000003.1375557544.0000000004050000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000003.00000003.1389659922.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000003.00000003.1389243370.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000005.00000003.1399915358.0000000003880000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000005.00000003.1398650007.0000000003690000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Xre0Nmqk09.exe, 00000000.00000003.1375352350.0000000003EB0000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000000.00000003.1375557544.0000000004050000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000003.00000003.1389659922.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000003.00000003.1389243370.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000005.00000003.1399915358.0000000003880000.00000004.00001000.00020000.00000000.sdmp, Xre0Nmqk09.exe, 00000005.00000003.1398650007.0000000003690000.00000004.00001000.00020000.00000000.sdmp

Source: Xre0Nmqk09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Xre0Nmqk09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Xre0Nmqk09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Xre0Nmqk09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Xre0Nmqk09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006EC304 LoadLibraryA,GetProcAddress,

0_2_006EC304

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00698B85 push ecx; ret	0_2_00698B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041C40C push cs; iretd	6_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00423149 push eax; ret	6_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041C50E push cs; iretd	6_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004231C8 push eax; ret	6_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0040E21D push ecx; ret	6_2_0040E230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041C6BE push ebx; ret	6_2_0041C6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02A743A9 push es; iretd	6_2_02A743AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02A74361 push ecx; iretd	6_2_02A74364

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_00674A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00674A35
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006F55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_006F55FD

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006933C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006933C7

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	API/Special instruction interceptor: Address: 15F109C
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	API/Special instruction interceptor: Address: 125182C
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	API/Special instruction interceptor: Address: EA106C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 6_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

6_2_004019F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1067			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 4007			Jump to behavior

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

API coverage: 4.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006D4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_006D4696
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DC93C FindFirstFileW,FindClose,	0_2_006DC93C
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_006DC9C7
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006DF200
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006DF35D
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_006DF65E
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006D3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_006D3A2B
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006D3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_006D3D4E
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006DBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_006DBF27

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_00674AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00674AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98419	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98310	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97858	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97433	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000006.00000002.2625120020.00000000054A3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006E41FD BlockInput,

0_2_006E41FD

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_00673B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00673B4C

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006A5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_006A5CCC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

6_2_004019F0

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006EC304 LoadLibraryA,GetProcAddress,

0_2_006EC304

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_015F1368 mov eax, dword ptr fs:[00000030h]	0_2_015F1368
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_015F1308 mov eax, dword ptr fs:[00000030h]	0_2_015F1308
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_015EFCD8 mov eax, dword ptr fs:[00000030h]	0_2_015EFCD8
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 3_2_01251A98 mov eax, dword ptr fs:[00000030h]	3_2_01251A98
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 3_2_01250468 mov eax, dword ptr fs:[00000030h]	3_2_01250468
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 3_2_01251AF8 mov eax, dword ptr fs:[00000030h]	3_2_01251AF8
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 5_2_00EA12D8 mov eax, dword ptr fs:[00000030h]	5_2_00EA12D8
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 5_2_00E9FCA8 mov eax, dword ptr fs:[00000030h]	5_2_00E9FCA8
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 5_2_00EA1338 mov eax, dword ptr fs:[00000030h]	5_2_00EA1338

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006C81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_006C81F7

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0069A364 SetUnhandledExceptionFilter,	0_2_0069A364
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_0069A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0069A395
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0040CE09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0040E61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00416F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004123F1 SetUnhandledExceptionFilter,	6_2_004123F1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: BCF008

Jump to behavior

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006C8C93 LogonUserW,

0_2_006C8C93

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_00673B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00673B4C

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_00674A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00674A35

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006D4EF5 mouse_event,

0_2_006D4EF5

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Xre0Nmqk09.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

0_2_006C81F7

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006D4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_006D4C03

Source: Xre0Nmqk09.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Xre0Nmqk09.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_0069886B cpuid

0_2_0069886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: GetLocaleInfoA,

6_2_00417A20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006A50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_006A50D7

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006B2230 GetUserNameW,

0_2_006B2230

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_006A418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_006A418A

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe

Code function: 0_2_00674AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00674AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2623567257.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623567257.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623567257.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7872, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Xre0Nmqk09.exe	Binary or memory string: WIN_81
Source: Xre0Nmqk09.exe	Binary or memory string: WIN_XP
Source: Xre0Nmqk09.exe	Binary or memory string: WIN_XPe
Source: Xre0Nmqk09.exe	Binary or memory string: WIN_VISTA
Source: Xre0Nmqk09.exe	Binary or memory string: WIN_7
Source: Xre0Nmqk09.exe	Binary or memory string: WIN_8
Source: Xre0Nmqk09.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623567257.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7872, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2623567257.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623567257.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623567257.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7872, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3de2f90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5580000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29aefd6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.52d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.29afebe.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d95570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3d96458.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006E6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_006E6596
Source: C:\Users\user\Desktop\Xre0Nmqk09.exe	Code function: 0_2_006E6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_006E6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	148 System Information Discovery	Distributed Component Object Model	21 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	251 Security Software Discovery	SSH	3 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Xre0Nmqk09.exe	68%	Virustotal		Browse
Xre0Nmqk09.exe	68%	ReversingLabs	Win32.Trojan.AutoitInject
Xre0Nmqk09.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://mail.thelamalab.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.thelamalab.com	162.251.80.30	true	true		unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.thelamalab.com	RegSvcs.exe, 00000006.00000002.2623567257.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	RegSvcs.exe, 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.251.80.30	mail.thelamalab.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588803
Start date and time:	2025-01-11 05:40:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Xre0Nmqk09.exe renamed because original name is a hash value
Original Sample Name:	e47bbcc86c09be704eb8ffde9dcb0c70f0996fa9bf2e0e5df5b42ebb66fe97e0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/4@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 48 Number of non-executed functions: 286
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:41:38	API Interceptor	25x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.251.80.30	new booking 9086432659087.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	shipping doc -GY298035826.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	w6dnPra4mx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	shipping doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	shipping advice.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	xCSONUFhmq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	5n2U8ZZZbc.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	iJCj3AQIBC.exe	Get hash	malicious	RevengeRAT	Browse	13.107.246.45
	leUmNO9XPu.exe	Get hash	malicious	HawkEye, MailPassView	Browse	13.107.246.45
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse	13.107.246.45
	of5HklY9qP.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	yMXFgPOdf2.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	1dVtYIvfHz.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
mail.thelamalab.com	new booking 9086432659087.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	shipping doc -GY298035826.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	w6dnPra4mx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	shipping doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	shipping advice.exe	Get hash	malicious	AgentTesla	Browse	162.251.80.30
	new p o.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	SecuriteInfo.com.Win32.PWSX-gen.27121.31008.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	8BzIVoQT3w.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	EpH9QFlrm2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	PO23100076.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	199.79.62.115
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.176
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.176
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.176
	http://www.technoafriwave.rw	Get hash	malicious	Unknown	Browse	207.174.214.183

Process:	C:\Users\user\Desktop\Xre0Nmqk09.exe
File Type:	data
Category:	dropped
Size (bytes):	267776
Entropy (8bit):	7.894152477097438
Encrypted:	false
SSDEEP:	6144:pUuesFePrwqiJvjmwi1mt9ummj8mRoWvF+r/sjh/mPBCLE91Nc7:euXejwqixj9IWcmhm/Arsjh/mPBCLE96
MD5:	72499DAAB028A3C086F2EB7FB4C8B9A3
SHA1:	4C824830159904661DF9B6919DCDA2BA09993365
SHA-256:	E03C03199A48EF6D138360D8E839CD2C237D335872B44B57F849A10DCBE86E6F
SHA-512:	FE6E634B7FFD7C7AF0062180DA9891E37F83B3A8BC6F2022A6C1F0914DD2B0EA5764DCDE6DDC327789FEB4A48C3910E6ABA809C41D2B5A0EC3851EDF1D670161
Malicious:	false
Reputation:	low
Preview:	.i.GVOAKQMW3..MS.D2P3XGU.AKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3X.UOAEJ.Y3.L.r.E~.../<<a;'"0A7(m02*\?Gx%0o3>;m>]v...s)]4VvJXEeKUMW3VE%C.i.!.&k$.?g$.).u:3l".L[..9~>.5y<.M.4.-ag\./).+}b"+.&.(wn(-iC.M..6'm:.3W3VEMSSD2P3XGUOA5.U13VEM..D2.2\G!.A.UMW3VEMS.D.Q8YNUO.JUM-1VEMSSk.P3XWUOA.TMW3.EMCSD2R3XBUOAKUMW6VEMSSD2PS\GUKAK.vU3TEM.SD"P3HGUOA[UMG3VEMSST2P3XGUOAKUM.&TE.SSD201Xw.NAKUMW3VEMSSD2P3XGUOAKUMW3..LSOD2P3XGUOAKUMW3VEMSSD2P3XGUO.FWM.3VEMSSD2P3XG.NA.TMW3VEMSSD2P3XGUOAKUMW3VEMS}0W(GXGUW.JUMG3VE.RSD6P3XGUOAKUMW3VEmSS$."W934OA.8MW3.DMS=D2P.YGUOAKUMW3VEMS.D2..<&!.AKU.g3VEmQSD$P3XMWOAKUMW3VEMSSDrP3.i'<3(UMW..DMS3F2P.YGUoCKUMW3VEMSSD2PsXG.OAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3

C:\Users\user\AppData\Local\Temp\aut49BE.tmp

Download File

Process:	C:\Users\user\Desktop\Xre0Nmqk09.exe
File Type:	data
Category:	dropped
Size (bytes):	267776
Entropy (8bit):	7.894152477097438
Encrypted:	false
SSDEEP:	6144:pUuesFePrwqiJvjmwi1mt9ummj8mRoWvF+r/sjh/mPBCLE91Nc7:euXejwqixj9IWcmhm/Arsjh/mPBCLE96
MD5:	72499DAAB028A3C086F2EB7FB4C8B9A3
SHA1:	4C824830159904661DF9B6919DCDA2BA09993365
SHA-256:	E03C03199A48EF6D138360D8E839CD2C237D335872B44B57F849A10DCBE86E6F
SHA-512:	FE6E634B7FFD7C7AF0062180DA9891E37F83B3A8BC6F2022A6C1F0914DD2B0EA5764DCDE6DDC327789FEB4A48C3910E6ABA809C41D2B5A0EC3851EDF1D670161
Malicious:	false
Reputation:	low
Preview:	.i.GVOAKQMW3..MS.D2P3XGU.AKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3X.UOAEJ.Y3.L.r.E~.../<<a;'"0A7(m02*\?Gx%0o3>;m>]v...s)]4VvJXEeKUMW3VE%C.i.!.&k$.?g$.).u:3l".L[..9~>.5y<.M.4.-ag\./).+}b"+.&.(wn(-iC.M..6'm:.3W3VEMSSD2P3XGUOA5.U13VEM..D2.2\G!.A.UMW3VEMS.D.Q8YNUO.JUM-1VEMSSk.P3XWUOA.TMW3.EMCSD2R3XBUOAKUMW6VEMSSD2PS\GUKAK.vU3TEM.SD"P3HGUOA[UMG3VEMSST2P3XGUOAKUM.&TE.SSD201Xw.NAKUMW3VEMSSD2P3XGUOAKUMW3..LSOD2P3XGUOAKUMW3VEMSSD2P3XGUO.FWM.3VEMSSD2P3XG.NA.TMW3VEMSSD2P3XGUOAKUMW3VEMS}0W(GXGUW.JUMG3VE.RSD6P3XGUOAKUMW3VEmSS$."W934OA.8MW3.DMS=D2P.YGUOAKUMW3VEMS.D2..<&!.AKU.g3VEmQSD$P3XMWOAKUMW3VEMSSDrP3.i'<3(UMW..DMS3F2P.YGUoCKUMW3VEMSSD2PsXG.OAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3

C:\Users\user\AppData\Local\Temp\aut4E61.tmp

Download File

Process:	C:\Users\user\Desktop\Xre0Nmqk09.exe
File Type:	data
Category:	dropped
Size (bytes):	267776
Entropy (8bit):	7.894152477097438
Encrypted:	false
SSDEEP:	6144:pUuesFePrwqiJvjmwi1mt9ummj8mRoWvF+r/sjh/mPBCLE91Nc7:euXejwqixj9IWcmhm/Arsjh/mPBCLE96
MD5:	72499DAAB028A3C086F2EB7FB4C8B9A3
SHA1:	4C824830159904661DF9B6919DCDA2BA09993365
SHA-256:	E03C03199A48EF6D138360D8E839CD2C237D335872B44B57F849A10DCBE86E6F
SHA-512:	FE6E634B7FFD7C7AF0062180DA9891E37F83B3A8BC6F2022A6C1F0914DD2B0EA5764DCDE6DDC327789FEB4A48C3910E6ABA809C41D2B5A0EC3851EDF1D670161
Malicious:	false
Reputation:	low
Preview:	.i.GVOAKQMW3..MS.D2P3XGU.AKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3X.UOAEJ.Y3.L.r.E~.../<<a;'"0A7(m02*\?Gx%0o3>;m>]v...s)]4VvJXEeKUMW3VE%C.i.!.&k$.?g$.).u:3l".L[..9~>.5y<.M.4.-ag\./).+}b"+.&.(wn(-iC.M..6'm:.3W3VEMSSD2P3XGUOA5.U13VEM..D2.2\G!.A.UMW3VEMS.D.Q8YNUO.JUM-1VEMSSk.P3XWUOA.TMW3.EMCSD2R3XBUOAKUMW6VEMSSD2PS\GUKAK.vU3TEM.SD"P3HGUOA[UMG3VEMSST2P3XGUOAKUM.&TE.SSD201Xw.NAKUMW3VEMSSD2P3XGUOAKUMW3..LSOD2P3XGUOAKUMW3VEMSSD2P3XGUO.FWM.3VEMSSD2P3XG.NA.TMW3VEMSSD2P3XGUOAKUMW3VEMS}0W(GXGUW.JUMG3VE.RSD6P3XGUOAKUMW3VEmSS$."W934OA.8MW3.DMS=D2P.YGUOAKUMW3VEMS.D2..<&!.AKU.g3VEmQSD$P3XMWOAKUMW3VEMSSDrP3.i'<3(UMW..DMS3F2P.YGUoCKUMW3VEMSSD2PsXG.OAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3

C:\Users\user\AppData\Local\Temp\aut5305.tmp

Download File

Process:	C:\Users\user\Desktop\Xre0Nmqk09.exe
File Type:	data
Category:	dropped
Size (bytes):	267776
Entropy (8bit):	7.894152477097438
Encrypted:	false
SSDEEP:	6144:pUuesFePrwqiJvjmwi1mt9ummj8mRoWvF+r/sjh/mPBCLE91Nc7:euXejwqixj9IWcmhm/Arsjh/mPBCLE96
MD5:	72499DAAB028A3C086F2EB7FB4C8B9A3
SHA1:	4C824830159904661DF9B6919DCDA2BA09993365
SHA-256:	E03C03199A48EF6D138360D8E839CD2C237D335872B44B57F849A10DCBE86E6F
SHA-512:	FE6E634B7FFD7C7AF0062180DA9891E37F83B3A8BC6F2022A6C1F0914DD2B0EA5764DCDE6DDC327789FEB4A48C3910E6ABA809C41D2B5A0EC3851EDF1D670161
Malicious:	false
Reputation:	low
Preview:	.i.GVOAKQMW3..MS.D2P3XGU.AKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3X.UOAEJ.Y3.L.r.E~.../<<a;'"0A7(m02*\?Gx%0o3>;m>]v...s)]4VvJXEeKUMW3VE%C.i.!.&k$.?g$.).u:3l".L[..9~>.5y<.M.4.-ag\./).+}b"+.&.(wn(-iC.M..6'm:.3W3VEMSSD2P3XGUOA5.U13VEM..D2.2\G!.A.UMW3VEMS.D.Q8YNUO.JUM-1VEMSSk.P3XWUOA.TMW3.EMCSD2R3XBUOAKUMW6VEMSSD2PS\GUKAK.vU3TEM.SD"P3HGUOA[UMG3VEMSST2P3XGUOAKUM.&TE.SSD201Xw.NAKUMW3VEMSSD2P3XGUOAKUMW3..LSOD2P3XGUOAKUMW3VEMSSD2P3XGUO.FWM.3VEMSSD2P3XG.NA.TMW3VEMSSD2P3XGUOAKUMW3VEMS}0W(GXGUW.JUMG3VE.RSD6P3XGUOAKUMW3VEmSS$."W934OA.8MW3.DMS=D2P.YGUOAKUMW3VEMS.D2..<&!.AKU.g3VEmQSD$P3XMWOAKUMW3VEMSSDrP3.i'<3(UMW..DMS3F2P.YGUoCKUMW3VEMSSD2PsXG.OAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3VEMSSD2P3XGUOAKUMW3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.159443480691975
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Xre0Nmqk09.exe
File size:	1'205'760 bytes
MD5:	a529f43a61267b1f6f42059dba8e179b
SHA1:	57224be49c5bde441959d2c68489d5c635b164a8
SHA256:	e47bbcc86c09be704eb8ffde9dcb0c70f0996fa9bf2e0e5df5b42ebb66fe97e0
SHA512:	5de2164c1387239d42ef74c39acdd5a0f4c2f60e4232d9a916cc18e093a0d6e0b3b59eb334d07526e8b2159bd872c06a5255a63e990c43841a75532bb7a99de2
SSDEEP:	24576:NAHnh+eWsN3skA4RV1Hom2KXMmHaD5cQVN6Rd5bm25:sh+ZkldoPK8YaD5c+4Xb3
TLSH:	D845BD0273D1C036FFABA2739B6AF64156BD79254123852F13982D79BC701B2273E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6769F2DA [Mon Dec 23 23:31:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F405D7EB0FDh
jmp 00007F405D7DDEB4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F405D7DE03Ah
cmp edi, eax
jc 00007F405D7DE39Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F405D7DE039h
rep movsb
jmp 00007F405D7DE34Ch
cmp ecx, 00000080h
jc 00007F405D7DE204h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F405D7DE040h
bt dword ptr [004BF324h], 01h
jc 00007F405D7DE510h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F405D7DE1DDh
test edi, 00000003h
jne 00007F405D7DE1EEh
test esi, 00000003h
jne 00007F405D7DE1CDh
bt edi, 02h
jnc 00007F405D7DE03Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F405D7DE043h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F405D7DE095h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x5be68	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x5be68	0x5c000	0d2fb827ae7301495e4054eed83ba3ff	False	0.9280077063519022	data	7.895841384506996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x5312f	data			1.0003262105792148
RT_GROUP_ICON	0x1238e8	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x123960	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x123974	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x123988	0x14	data	English	Great Britain	1.25
RT_VERSION	0x12399c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x123a78	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:41:26.551070+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.9	49772	162.251.80.30	587	TCP
2025-01-11T05:41:26.551070+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.9	49772	162.251.80.30	587	TCP
2025-01-11T05:41:26.551070+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.9	49772	162.251.80.30	587	TCP
2025-01-11T05:41:41.776076+0100	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	192.168.2.9	49772	162.251.80.30	587	TCP
2025-01-11T05:41:41.776076+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49772	162.251.80.30	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:41:39.565629959 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:39.570538044 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:39.570601940 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:40.289736986 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:40.290621996 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:40.295425892 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:40.457645893 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:40.458590984 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:40.463418961 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:40.642855883 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:40.643773079 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:40.649801970 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.048427105 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.048693895 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:41.053690910 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.219286919 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.219490051 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:41.224313021 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.601001978 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.601154089 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:41.605937958 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.768174887 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.776020050 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:41.776076078 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:41.776089907 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:41.776113033 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:41:41.780858040 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.780869961 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.781047106 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:41.781058073 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:42.063213110 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:41:42.113950014 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:43:19.272432089 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:43:19.277355909 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:43:19.641000032 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:43:19.641047955 CET	587	49772	162.251.80.30	192.168.2.9
Jan 11, 2025 05:43:19.641294003 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:43:19.642863989 CET	49772	587	192.168.2.9	162.251.80.30
Jan 11, 2025 05:43:19.647768021 CET	587	49772	162.251.80.30	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:41:39.257951975 CET	55904	53	192.168.2.9	1.1.1.1
Jan 11, 2025 05:41:39.558589935 CET	53	55904	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:41:39.257951975 CET	192.168.2.9	1.1.1.1	0x1cba	Standard query (0)	mail.thelamalab.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:41:28.903670073 CET	1.1.1.1	192.168.2.9	0xce55	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:41:28.903670073 CET	1.1.1.1	192.168.2.9	0xce55	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:41:39.558589935 CET	1.1.1.1	192.168.2.9	0x1cba	No error (0)	mail.thelamalab.com		162.251.80.30	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 11, 2025 05:41:40.289736986 CET	587	49772	162.251.80.30	192.168.2.9	220-md-114.webhostbox.net ESMTP Exim 4.96.2 #2 Sat, 11 Jan 2025 10:11:40 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 11, 2025 05:41:40.290621996 CET	49772	587	192.168.2.9	162.251.80.30	EHLO 760639
Jan 11, 2025 05:41:40.457645893 CET	587	49772	162.251.80.30	192.168.2.9	250-md-114.webhostbox.net Hello 760639 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 11, 2025 05:41:40.458590984 CET	49772	587	192.168.2.9	162.251.80.30	AUTH login YmlsbGluZ0B0aGVsYW1hbGFiLmNvbQ==
Jan 11, 2025 05:41:40.642855883 CET	587	49772	162.251.80.30	192.168.2.9	334 UGFzc3dvcmQ6
Jan 11, 2025 05:41:41.048427105 CET	587	49772	162.251.80.30	192.168.2.9	235 Authentication succeeded
Jan 11, 2025 05:41:41.048693895 CET	49772	587	192.168.2.9	162.251.80.30	MAIL FROM:<billing@thelamalab.com>
Jan 11, 2025 05:41:41.219286919 CET	587	49772	162.251.80.30	192.168.2.9	250 OK
Jan 11, 2025 05:41:41.219490051 CET	49772	587	192.168.2.9	162.251.80.30	RCPT TO:<jinhux31@gmail.com>
Jan 11, 2025 05:41:41.601001978 CET	587	49772	162.251.80.30	192.168.2.9	250 Accepted
Jan 11, 2025 05:41:41.601154089 CET	49772	587	192.168.2.9	162.251.80.30	DATA
Jan 11, 2025 05:41:41.768174887 CET	587	49772	162.251.80.30	192.168.2.9	354 Enter message, ending with "." on a line by itself
Jan 11, 2025 05:41:41.776113033 CET	49772	587	192.168.2.9	162.251.80.30	.
Jan 11, 2025 05:41:42.063213110 CET	587	49772	162.251.80.30	192.168.2.9	250 OK id=1tWTJd-000vlf-2G
Jan 11, 2025 05:43:19.272432089 CET	49772	587	192.168.2.9	162.251.80.30	QUIT
Jan 11, 2025 05:43:19.641000032 CET	587	49772	162.251.80.30	192.168.2.9	221 md-114.webhostbox.net closing connection

Target ID:	0
Start time:	23:41:32
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\Xre0Nmqk09.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Xre0Nmqk09.exe"
Imagebase:	0x670000
File size:	1'205'760 bytes
MD5 hash:	A529F43A61267B1F6F42059DBA8E179B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000000.00000002.1379475830.0000000003E60000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:41:33
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Xre0Nmqk09.exe"
Imagebase:	0x110000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:41:34
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\Xre0Nmqk09.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Xre0Nmqk09.exe"
Imagebase:	0x670000
File size:	1'205'760 bytes
MD5 hash:	A529F43A61267B1F6F42059DBA8E179B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000003.00000002.1391379435.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:41:35
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Xre0Nmqk09.exe"
Imagebase:	0x3c0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:41:35
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\Xre0Nmqk09.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Xre0Nmqk09.exe"
Imagebase:	0x670000
File size:	1'205'760 bytes
MD5 hash:	A529F43A61267B1F6F42059DBA8E179B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000005.00000002.1403377308.0000000001B50000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:41:36
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Xre0Nmqk09.exe"
Imagebase:	0x880000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2623567257.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000006.00000002.2622508052.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000006.00000002.2624873311.00000000052D0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000006.00000002.2625442326.0000000005580000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.2624500171.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.2623193568.000000000296E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2623567257.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2623567257.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2623567257.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	8.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	162

Executed Functions

Function 00673B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00673B7A
IsDebuggerPresent.KERNEL32 ref: 00673B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,007362F8,007362E0,?,?), ref: 00673BFD

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

Part of subcall function 00680A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00673C26,007362F8,?,?,?), ref: 00680ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00673C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,007293F0,00000010), ref: 006AD4BC
SetCurrentDirectoryW.KERNEL32(?,007362F8,?,?,?), ref: 006AD4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00725D40,007362F8,?,?,?), ref: 006AD57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 006AD581

Part of subcall function 00673A58: GetSysColorBrush.USER32(0000000F), ref: 00673A62
Part of subcall function 00673A58: LoadCursorW.USER32(00000000,00007F00), ref: 00673A71
Part of subcall function 00673A58: LoadIconW.USER32(00000063), ref: 00673A88
Part of subcall function 00673A58: LoadIconW.USER32(000000A4), ref: 00673A9A
Part of subcall function 00673A58: LoadIconW.USER32(000000A2), ref: 00673AAC
Part of subcall function 00673A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00673AD2
Part of subcall function 00673A58: RegisterClassExW.USER32(?), ref: 00673B28

Part of subcall function 006739E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00673A15
Part of subcall function 006739E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00673A36
Part of subcall function 006739E7: ShowWindow.USER32(00000000,?,?), ref: 00673A4A
Part of subcall function 006739E7: ShowWindow.USER32(00000000,?,?), ref: 00673A53

Part of subcall function 006743DB: _memset.LIBCMT ref: 00674401
Part of subcall function 006743DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 006744A6

Strings

%p, xrefs: 00673C56
runas, xrefs: 006AD575
This is a third-party compiled AutoIt script., xrefs: 006AD4B4

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%p
API String ID: 529118366-4165251529
Opcode ID: 0f565ae812391b7d2e52e2bb51f711490f2ca75d99d9126243c598724538523c
Instruction ID: d4acab895c269814a38d57d7dbff6e46c1cca0389884bd7d33333251cf17bf86
Opcode Fuzzy Hash: 0f565ae812391b7d2e52e2bb51f711490f2ca75d99d9126243c598724538523c
Instruction Fuzzy Hash: B651E671D04248BADF11EBB4DC06AFE7B77BF05300F04C169F459A62A2DA784A45DB29

Function 00674FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00674EEE,?,?,00000000,00000000), ref: 00674FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00674EEE,?,?,00000000,00000000), ref: 00675010
LoadResource.KERNEL32(?,00000000,?,?,00674EEE,?,?,00000000,00000000,?,?,?,?,?,?,00674F8F), ref: 006ADD60
SizeofResource.KERNEL32(?,00000000,?,?,00674EEE,?,?,00000000,00000000,?,?,?,?,?,?,00674F8F), ref: 006ADD75
LockResource.KERNEL32(Ng,?,?,00674EEE,?,?,00000000,00000000,?,?,?,?,?,?,00674F8F,00000000), ref: 006ADD88

Strings

SCRIPT, xrefs: 00675006
Ng, xrefs: 006ADD85

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$Ng
API String ID: 3051347437-838098663
Opcode ID: 32f323d82a7b61a7a96ad8b94a9b03f5effc00cf9b12d763fb63e65362b22aea
Instruction ID: 7ebd9a793b54dceff6b4643a8a56b9d2580e84ba28bdc0f69d5c874dcd6babdf
Opcode Fuzzy Hash: 32f323d82a7b61a7a96ad8b94a9b03f5effc00cf9b12d763fb63e65362b22aea
Instruction Fuzzy Hash: F3115E75200700AFD7218B65DC59F677BBAFFC9B51F108168F40A86260DBA1EC00C660

Function 00674AFE Relevance: 10.7, APIs: 7, Instructions: 223COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00674B2B

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

GetCurrentProcess.KERNEL32(?,006FFAEC,00000000,00000000,?), ref: 00674BF8
IsWow64Process.KERNEL32(00000000), ref: 00674BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00674C45
FreeLibrary.KERNEL32(00000000), ref: 00674C50
GetSystemInfo.KERNEL32(00000000), ref: 00674C81
GetSystemInfo.KERNEL32(00000000), ref: 00674C8D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 66d9efb39bfbe99318ae296fae782b6dc8a74a37362cd2abc148c8d61a7f9ac7
Instruction ID: b28104b6641987376ea783c9c0176974a1ff71f01f92dae0b32d25fa311b90f3
Opcode Fuzzy Hash: 66d9efb39bfbe99318ae296fae782b6dc8a74a37362cd2abc148c8d61a7f9ac7
Instruction Fuzzy Hash: 2A91B43154A7C0DEC732DB6885551EABFE6AF6A300B44899ED0CF93B41D720ED48CB69

Function 006D4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,006AE7C1), ref: 006D46A6
FindFirstFileW.KERNELBASE(?,?), ref: 006D46B7
FindClose.KERNEL32(00000000), ref: 006D46C7

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 8d19d992f104e7e36e54738f7fe09462630118159c83d276a4d69cc90a5b06e6
Instruction ID: ec534e46bb9b3c81a10a8d57b66b79977b5d0650e79276922595879305302dd1
Opcode Fuzzy Hash: 8d19d992f104e7e36e54738f7fe09462630118159c83d276a4d69cc90a5b06e6
Instruction Fuzzy Hash: BFE0D8328104005B47106778EC4D4FA775E9E46335F100716F936C12E0EBB09D50C5D5

Function 00680B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00680BBB
timeGetTime.WINMM ref: 00680E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00680FB3
TranslateMessage.USER32(?), ref: 00680FC7
DispatchMessageW.USER32(?), ref: 00680FD5
Sleep.KERNEL32(0000000A), ref: 00680FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 0068105A
DestroyWindow.USER32 ref: 00681066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00681080
Sleep.KERNEL32(0000000A,?,?), ref: 006B52AD
TranslateMessage.USER32(?), ref: 006B608A
DispatchMessageW.USER32(?), ref: 006B6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006B60AC

Strings

@TRAY_ID, xrefs: 006B5BB9
@GUI_CTRLHANDLE, xrefs: 006B540E
@GUI_WINHANDLE, xrefs: 006B53B9
prs, xrefs: 006B5BDE
prs, xrefs: 006B53D8
prs, xrefs: 006B5383
prs, xrefs: 006B542D
@COM_EVENTOBJ, xrefs: 006B591A
@GUI_CTRLID, xrefs: 006B5364

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$prs$prs$prs$prs
API String ID: 4003667617-202710817
Opcode ID: 677b228234e5f4104189a517e4cabfdc4517fbfafd995e7e6faa89c2dbb85f6c
Instruction ID: a99c22d5da334f0675a7c543f2ef6582e8408160543151b6faff7d93361d0493
Opcode Fuzzy Hash: 677b228234e5f4104189a517e4cabfdc4517fbfafd995e7e6faa89c2dbb85f6c
Instruction Fuzzy Hash: CBB2D2B0608741DFE764DF24C884BEAB7E6BF84304F148A1DE54A873A1DB75E885CB46

Function 006D93DF Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D91E9: __time64.LIBCMT ref: 006D91F3

Part of subcall function 00675045: _fseek.LIBCMT ref: 0067505D

__wsplitpath.LIBCMT ref: 006D94BE

Part of subcall function 0069432E: __wsplitpath_helper.LIBCMT ref: 0069436E

_wcscpy.LIBCMT ref: 006D94D1
_wcscat.LIBCMT ref: 006D94E4
__wsplitpath.LIBCMT ref: 006D9509
_wcscat.LIBCMT ref: 006D951F
_wcscat.LIBCMT ref: 006D9532

Part of subcall function 006D922F: _memmove.LIBCMT ref: 006D9268
Part of subcall function 006D922F: _memmove.LIBCMT ref: 006D9277

_wcscmp.LIBCMT ref: 006D9479

Part of subcall function 006D99BE: _wcscmp.LIBCMT ref: 006D9AAE
Part of subcall function 006D99BE: _wcscmp.LIBCMT ref: 006D9AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 006D96DC
_wcsncpy.LIBCMT ref: 006D974F
DeleteFileW.KERNEL32(?,?), ref: 006D9785
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 006D979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006D97AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006D97BE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: c5f7f0f5bcc4bc92bb48baeb2bb2c90dab13581244a7f9d0928ff8f6eee598f7
Instruction ID: c788d765a15fe48faab62110af5ed828b0541f2d6158549648dc049fd9b01524
Opcode Fuzzy Hash: c5f7f0f5bcc4bc92bb48baeb2bb2c90dab13581244a7f9d0928ff8f6eee598f7
Instruction Fuzzy Hash: B3C13CB1D00219AADF61DF95CC85EDEB7BEEF45300F0040AAF609E7251EB709A858F65

Function 00673015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 75windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00673074
RegisterClassExW.USER32(00000030), ref: 0067309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006730AF
InitCommonControlsEx.COMCTL32(?), ref: 006730CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006730DC
LoadIconW.USER32(000000A9), ref: 006730F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00673101

Strings

AutoIt v3 GUI, xrefs: 00673090
0, xrefs: 00673056
TaskbarCreated, xrefs: 006730A4
+, xrefs: 0067305D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: e46e53f8c385a347826ffaa4c18aca1f65bf63424db63a219350a81038888786
Instruction ID: 7c5561e8bae8dfc3443ed35fc07db07c4ee8b123cbb5ae2054244adf70d7f689
Opcode Fuzzy Hash: e46e53f8c385a347826ffaa4c18aca1f65bf63424db63a219350a81038888786
Instruction Fuzzy Hash: 723158B1840309AFEB00DFA4EC85BD9BBF1FF09311F14862AE540E62A1D3BA4584CF95

Function 00673041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00673074
RegisterClassExW.USER32(00000030), ref: 0067309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006730AF
InitCommonControlsEx.COMCTL32(?), ref: 006730CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006730DC
LoadIconW.USER32(000000A9), ref: 006730F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00673101

Strings

AutoIt v3 GUI, xrefs: 00673090
0, xrefs: 00673056
TaskbarCreated, xrefs: 006730A4
+, xrefs: 0067305D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 13d4c9b16e1696b6cf388d1c3236edf11a1b47543f82cef47684cd8ef62708b2
Instruction ID: 1d5a88a1cdd3e4167581cca7bdb94107e1c6a20efdc9294aa4c06c504a682fa8
Opcode Fuzzy Hash: 13d4c9b16e1696b6cf388d1c3236edf11a1b47543f82cef47684cd8ef62708b2
Instruction Fuzzy Hash: 4121C8B1900218BFEB00EF94EC89BDDBBF5FB08701F00952AF610A62A0D7B54544CF95

Function 006771EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00674864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007362F8,?,006737C0,?), ref: 00674882

Part of subcall function 0069074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,006772C5), ref: 00690771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00677308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 006AECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 006AED32
RegCloseKey.ADVAPI32(?), ref: 006AED70
_wcscat.LIBCMT ref: 006AEDC9

Strings

Include, xrefs: 006AECE8, 006AED29
\Include\, xrefs: 006772C5
\, xrefs: 006AEDEC
Software\AutoIt v3\AutoIt, xrefs: 006772FE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: b9d3f18ce461453aa7014506def9ac2aff2722f45a7543ab4971dd7a06d83ddd
Instruction ID: 9a00792b44aad35b24283aa005c6c7767a97fa9ec6b906afc27c7795448f9f82
Opcode Fuzzy Hash: b9d3f18ce461453aa7014506def9ac2aff2722f45a7543ab4971dd7a06d83ddd
Instruction Fuzzy Hash: 1771B2B14083019ED768EF25DC818ABBBF9FF45750F40852EF445C72A1EB359948CB69

Function 00673633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowtimeregistryCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 006736D2
KillTimer.USER32(?,00000001), ref: 006736FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0067371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0067372A
CreatePopupMenu.USER32 ref: 0067373E
PostQuitMessage.USER32(00000000), ref: 0067375F

Strings

%p, xrefs: 006AD2D1, 006AD31F
TaskbarCreated, xrefs: 00673725

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%p
API String ID: 129472671-406408202
Opcode ID: b7799c920da9988a62ea8ddbc2d31a268eb298c5b4fbda7be07de40fe5a49499
Instruction ID: ab31abd76dec515cfdcb5f9de1e73335d94255fe8b9c2e0cbfff4d75933b72bf
Opcode Fuzzy Hash: b7799c920da9988a62ea8ddbc2d31a268eb298c5b4fbda7be07de40fe5a49499
Instruction Fuzzy Hash: 504129B1100115BBEF146F24EC49BFA3797EB45301F14C229F50AC63A2DB69EE41E769

Function 00673A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00673A62
LoadCursorW.USER32(00000000,00007F00), ref: 00673A71
LoadIconW.USER32(00000063), ref: 00673A88
LoadIconW.USER32(000000A4), ref: 00673A9A
LoadIconW.USER32(000000A2), ref: 00673AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00673AD2
RegisterClassExW.USER32(?), ref: 00673B28

Part of subcall function 00673041: GetSysColorBrush.USER32(0000000F), ref: 00673074
Part of subcall function 00673041: RegisterClassExW.USER32(00000030), ref: 0067309E
Part of subcall function 00673041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006730AF
Part of subcall function 00673041: InitCommonControlsEx.COMCTL32(?), ref: 006730CC
Part of subcall function 00673041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006730DC
Part of subcall function 00673041: LoadIconW.USER32(000000A9), ref: 006730F2
Part of subcall function 00673041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00673101

Strings

#, xrefs: 00673B0D
AutoIt v3, xrefs: 00673B17
0, xrefs: 00673B06

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: c43fb69fce937c92db93b071797ebc9b25c209f42f57ff27bca7d4da5478baeb
Instruction ID: a2effee1c7ff45cf0b6ee4da085a3cb5d525c2e9e2b857e8a56c88631fd9e052
Opcode Fuzzy Hash: c43fb69fce937c92db93b071797ebc9b25c209f42f57ff27bca7d4da5478baeb
Instruction Fuzzy Hash: 83214D70900308BFEB109FA4EC49B9E7FB5FB08712F11C12AF944A62A1D3BA5554DF98

Function 00673778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267COMMON

Download Yara Rule

Strings

CMDLINE, xrefs: 00673834
bs, xrefs: 006AD44E
/AutoIt3ExecuteLine, xrefs: 006738B9
/AutoIt3OutputDebug, xrefs: 006738A4
/AutoIt3ExecuteScript, xrefs: 006738CE
CMDLINERAW, xrefs: 0067380D
/ErrorStdOut, xrefs: 0067388F
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 006737C0

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$bs
API String ID: 1825951767-2207656441
Opcode ID: 19de7605fd9018800c60055c4551e7c1fe7422d97abf89b2e40c1048b538145d
Instruction ID: 04ce5af2d50f66fa9ed8eda20d32d2ca6a10e7c51166a68be658ee9904c33be8
Opcode Fuzzy Hash: 19de7605fd9018800c60055c4551e7c1fe7422d97abf89b2e40c1048b538145d
Instruction Fuzzy Hash: EAA1627181022DAADF44EBA0CC95DEEB77ABF14300F00842EF41AA7291EF745A09CB65

Function 0067F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 006903A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 006903D3
Part of subcall function 006903A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 006903DB
Part of subcall function 006903A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006903E6
Part of subcall function 006903A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006903F1
Part of subcall function 006903A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 006903F9
Part of subcall function 006903A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00690401

Part of subcall function 00686259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0067FA90), ref: 006862B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0067FB2D
OleInitialize.OLE32(00000000), ref: 0067FBAA
CloseHandle.KERNEL32(00000000), ref: 006B49F2

Strings

%p, xrefs: 0067F8F6, 0067F908, 0067FACE, 0067FBB1
<gs, xrefs: 0067FA90
\ds, xrefs: 0067F957
cs, xrefs: 0067F94B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <gs$\ds$%p$cs
API String ID: 1986988660-2848024899
Opcode ID: df02fde079c789f1ee79632327830e9cffc7b7910cc19f5dcf9f6aaf0114b117
Instruction ID: 7a5dc03e00d97ab313dce89a011c345504d5f60bda65ceab88c68585193b0d11
Opcode Fuzzy Hash: df02fde079c789f1ee79632327830e9cffc7b7910cc19f5dcf9f6aaf0114b117
Instruction Fuzzy Hash: CB81BBB0D05280AEE784EF39E9416557BE6FB9970A750C23ED019C7262EB3D8604CF6D

Function 015F0458 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 015F0529
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 015F074F

Memory Dump Source

Source File: 00000000.00000002.1378935431.00000000015ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Xre0Nmqk09.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: 659b84d6e750ceabf803801e40be0c593ba4d9d98f41051273645a5f448766c7
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: D0A1F674E00209EBDF14CFA4C998BAEBBB6BF48304F248559E611BB2C1D7759A41CF54

Function 006739E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00673A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00673A36
ShowWindow.USER32(00000000,?,?), ref: 00673A4A
ShowWindow.USER32(00000000,?,?), ref: 00673A53

Strings

edit, xrefs: 00673A30
AutoIt v3, xrefs: 00673A0D, 00673A12, 00673A13

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: a6aac0f11fa0f2ce828b0da36506642405d6ae313be18589210921ac008c90b5
Instruction ID: 7cb57f8435370f4adcaaac88a41afaa03111df445e088af33889cc6fd6c30e87
Opcode Fuzzy Hash: a6aac0f11fa0f2ce828b0da36506642405d6ae313be18589210921ac008c90b5
Instruction Fuzzy Hash: 0BF030706002947EFA301717AC08E373E7EEBC7F61B02C029B900A2170C5A95810CAB4

Function 015F0218 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147fileCOMMON

Download Yara Rule

APIs

Part of subcall function 015F0108: Sleep.KERNELBASE(000001F4), ref: 015F0119

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 015F0345

Strings

P3XGUOAKUMW3VEMSSD2, xrefs: 015F03A8, 015F03AB

Memory Dump Source

Source File: 00000000.00000002.1378935431.00000000015ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Xre0Nmqk09.jbxd

Similarity

API ID: CreateFileSleep
String ID: P3XGUOAKUMW3VEMSSD2
API String ID: 2694422964-3268898088
Opcode ID: 19e5696bfe0e4dde0b62711eec24509025f4f61f86bc55ad81dfeb04e712e6c4
Instruction ID: 0fdc91d77ef6867ccb6e2788b43fd4d3746a1e43d9b54dd6d1c36ff655e3a4cc
Opcode Fuzzy Hash: 19e5696bfe0e4dde0b62711eec24509025f4f61f86bc55ad81dfeb04e712e6c4
Instruction Fuzzy Hash: 98519F70D04249EBEF11DBA4C818BEFBBB5AF55300F044199E609BB2C1D7B90B04CBA5

Function 0067410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 006AD5EC

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

_memset.LIBCMT ref: 0067418D
_wcscpy.LIBCMT ref: 006741E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006741F1

Strings

Line: , xrefs: 006AD615

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 0b4603ecae3a358ae159a62ea5c6f8011e4324417a447b804016807f82e190a1
Instruction ID: 98268ef7f56c37e26edbdee91471e54f085db2f5874d01a9b135948fb8a3d5bd
Opcode Fuzzy Hash: 0b4603ecae3a358ae159a62ea5c6f8011e4324417a447b804016807f82e190a1
Instruction Fuzzy Hash: C631D371408314AAE761EB60DC49BEB77EAAF44300F10C51EF199921A2EF749648C79A

Function 006769CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00674F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007362F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00674F6F

_free.LIBCMT ref: 006AE68C
_free.LIBCMT ref: 006AE6D3

Part of subcall function 00676BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00676D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 006AE462
Bad directive syntax error, xrefs: 006AE6BB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 0d77d291bed7626ac96229f7ad6fe3acd5cf2225ada0e2550a49c5c091ebf8fb
Instruction ID: 6fc75d3876c8a832c8d69004d7efbde66a3d34f8fb30346517a989d8fd9c9faa
Opcode Fuzzy Hash: 0d77d291bed7626ac96229f7ad6fe3acd5cf2225ada0e2550a49c5c091ebf8fb
Instruction Fuzzy Hash: 5B918C71910219AFCF44EFA4C8919EDB7BAFF1A300B10846EF815AB291EB359D05CF64

Function 006735B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,006735A1,SwapMouseButtons,00000004,?), ref: 006735D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,006735A1,SwapMouseButtons,00000004,?,?,?,?,00672754), ref: 006735F5
RegCloseKey.KERNELBASE(00000000,?,?,006735A1,SwapMouseButtons,00000004,?,?,?,?,00672754), ref: 00673617

Strings

Control Panel\Mouse, xrefs: 006735D2

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 1c4afb262aa3cc2cf37e1cd89829907175ede30022071c2041186aac3052edd0
Instruction ID: eda3a76da945a0f2f5249b9b08994be987a9e5d49e0653df75bed142c4b99739
Opcode Fuzzy Hash: 1c4afb262aa3cc2cf37e1cd89829907175ede30022071c2041186aac3052edd0
Instruction Fuzzy Hash: 64114571611228BFDB20CF64DC80EFEBBBAEF04740F109469E809D7310E6719E40ABA0

Function 015EF108 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 015EF935
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015EF959
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015EF97B
TerminateProcess.KERNELBASE(00000000,00000000,?), ref: 015EFC84

Memory Dump Source

Source File: 00000000.00000002.1378935431.00000000015ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Xre0Nmqk09.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadTerminateThreadWow64
String ID:
API String ID: 572931308-0
Opcode ID: a08d661af1579fd21ac3dcfb20f4bf99dc511b72db546338f3390fc10d84f6f3
Instruction ID: c30f7385dd9cda684bba28cc3abf3f404b56e43a99a35d163acd8e71d42a368b
Opcode Fuzzy Hash: a08d661af1579fd21ac3dcfb20f4bf99dc511b72db546338f3390fc10d84f6f3
Instruction Fuzzy Hash: 30620930A14258DBEB24CBA4C854BDEB776FF58300F1091A9D60DEB390EB759E81CB59

Function 006D97E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00675045: _fseek.LIBCMT ref: 0067505D

Part of subcall function 006D99BE: _wcscmp.LIBCMT ref: 006D9AAE
Part of subcall function 006D99BE: _wcscmp.LIBCMT ref: 006D9AC1

_free.LIBCMT ref: 006D992C
_free.LIBCMT ref: 006D9933
_free.LIBCMT ref: 006D999E

Part of subcall function 00692F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00699C64), ref: 00692FA9
Part of subcall function 00692F95: GetLastError.KERNEL32(00000000,?,00699C64), ref: 00692FBB

_free.LIBCMT ref: 006D99A6

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 04d26628c3312264504d8e26a493efd654ea5775377f53fe0e751bf36bb491d8
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: 0D5150B1D04218AFDF649F64CC81A9EBB7AEF48310F1444AEB609A7341DB715E90CF59

Function 0069493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006949D0
__flush.LIBCMT ref: 006949F0
__write.LIBCMT ref: 00694A23
__flsbuf.LIBCMT ref: 00694A51

Part of subcall function 00698D68: __getptd_noexit.LIBCMT ref: 00698D68

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 48277aec15c6a869f795d69ee64fb081d4d716d748e1e98a1e8f207ed9dcd67b
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 9641B170A006069FDF288EA9C880DAF77AFAF85360B24816DE855C7F44EE719D428B44

Function 00674DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00674E1A

Strings

EA06, xrefs: 006ADCF5
AU3!P/p, xrefs: 00674E14

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/p$EA06
API String ID: 4104443479-1365913961
Opcode ID: bf05d32f781d4c24815221c36c90161c3215b5b8e06ad0b6b5269b097f57e39f
Instruction ID: 7b12da08131816e9fb0d264fd8c1d7f8854cb88079c0802447f29181d3ead549
Opcode Fuzzy Hash: bf05d32f781d4c24815221c36c90161c3215b5b8e06ad0b6b5269b097f57e39f
Instruction Fuzzy Hash: 1F41A031A045549BDF219B6488597FE7FA7AF41320F18C069FC8B9B382DF654D4187E1

Function 006773E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006AEE62
GetOpenFileNameW.COMDLG32(?), ref: 006AEEAC

Part of subcall function 006748AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006748A1,?,?,006737C0,?), ref: 006748CE

Part of subcall function 006909D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006909F4

Strings

X, xrefs: 006AEE7A

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 8ea3035cb43b3207096f62161567d7f749fd0dff8380524f14b929b7c84a2172
Instruction ID: 0582505e035271659e9f45f5e097358e3529c1167d34770c1f8b9dbf84d9746a
Opcode Fuzzy Hash: 8ea3035cb43b3207096f62161567d7f749fd0dff8380524f14b929b7c84a2172
Instruction Fuzzy Hash: A621C630A002589BDF51DF94C845BEE7BFEAF49300F04805AE508EB241DBB8594A8FA5

Function 006D9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 006D9B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 006D9B99

Strings

aut, xrefs: 006D9B93

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: a24641b1ac21919e067b83027182f81450aadd18af915ecba485214adf5ff2f9
Instruction ID: 1a41a9a2cd7b6559b2df1862b05de3a87d40257bec1ad40d6a6c066133f0033b
Opcode Fuzzy Hash: a24641b1ac21919e067b83027182f81450aadd18af915ecba485214adf5ff2f9
Instruction Fuzzy Hash: 1ED05E7954030EBBDB10ABD8EC0EFAA772CEB04700F0042A1BE54D11A2DEB49698CB91

Function 006ECDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2cfc7c8f0ff5e8025f1f5df05ebbac0d15eb8f72451071a94718830894386e
Instruction ID: db37c54837e1c7cb889c17caa14c5cf838004041ca99ad0774b82c439175142c
Opcode Fuzzy Hash: 9f2cfc7c8f0ff5e8025f1f5df05ebbac0d15eb8f72451071a94718830894386e
Instruction Fuzzy Hash: C2F17A70A083409FC754DF29C484A6ABBE6FF88314F14892EF9999B351D731E946CF82

Function 006743DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00674401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 006744A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 006744C3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 3bce71cfb9c4ed253d3823809839c2bf37a10d19011ffd985cf5523dc3025f72
Instruction ID: 4584f91b91f903b193b73e2c98ceae9f5a42f4b592cf4e7e648788c409bc8154
Opcode Fuzzy Hash: 3bce71cfb9c4ed253d3823809839c2bf37a10d19011ffd985cf5523dc3025f72
Instruction Fuzzy Hash: 28318FB05043019FD720DF24D8887ABBBF9FB49305F00892EE59E83351DB75A948CB96

Function 0069594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00695963

Part of subcall function 0069A3AB: __NMSG_WRITE.LIBCMT ref: 0069A3D2
Part of subcall function 0069A3AB: __NMSG_WRITE.LIBCMT ref: 0069A3DC

__NMSG_WRITE.LIBCMT ref: 0069596A

Part of subcall function 0069A408: GetModuleFileNameW.KERNEL32(00000000,007343BA,00000104,?,00000001,00000000), ref: 0069A49A
Part of subcall function 0069A408: ___crtMessageBoxW.LIBCMT ref: 0069A548

Part of subcall function 006932DF: ___crtCorExitProcess.LIBCMT ref: 006932E5
Part of subcall function 006932DF: ExitProcess.KERNEL32 ref: 006932EE

Part of subcall function 00698D68: __getptd_noexit.LIBCMT ref: 00698D68

RtlAllocateHeap.NTDLL(015B0000,00000000,00000001,00000000,?,?,?,00691013,?), ref: 0069598F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: dcd225c16689230db3bcd0cba876f6af16256ce0fcd7ffd8b8636d4fcbda1c61
Instruction ID: bbe44b280d0e29a9b1aac89222ab1992f3b0999f5e4af426280fbbb969bab75e
Opcode Fuzzy Hash: dcd225c16689230db3bcd0cba876f6af16256ce0fcd7ffd8b8636d4fcbda1c61
Instruction Fuzzy Hash: B601D232200B51EEFE663B64D842AAE728F9F42735F10002EF506EBB81DA709D018369

Function 006D9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,006D97D2,?,?,?,?,?,00000004), ref: 006D9B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,006D97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 006D9B5B
CloseHandle.KERNEL32(00000000,?,006D97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 006D9B62

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: fde5fb266b731dc4075d81dd4a8b791e5f6014175690c4da4b47a3837889f84a
Instruction ID: 2ba435cfd05662e43205fb16abf3f07a9bd48d13af676263f3aa16a788118283
Opcode Fuzzy Hash: fde5fb266b731dc4075d81dd4a8b791e5f6014175690c4da4b47a3837889f84a
Instruction Fuzzy Hash: 1AE08632580214B7D7211B54EC09FDE7B1AAF05761F144121FB14691E087B12521D7D8

Function 006D8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006D8FA5

Part of subcall function 00692F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00699C64), ref: 00692FA9
Part of subcall function 00692F95: GetLastError.KERNEL32(00000000,?,00699C64), ref: 00692FBB

_free.LIBCMT ref: 006D8FB6
_free.LIBCMT ref: 006D8FC8

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 27cfe816ad5c93395b0ce5546dbf4d76fa500cd56ac6737daaa8814c82fe458c
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 79E012A1A097026ECE64AB78AD54ED367EF5F48390B18081EB409DB742DE24F8518128

Function 0067AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 006B002B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 8a99044d283c448c73c57d2e398653ae37504fd9d74a38664b9646c65bd46c69
Instruction ID: ffa529e2633b954870b67d75dc334bba83b3702352d589b4919dd289b4df300c
Opcode Fuzzy Hash: 8a99044d283c448c73c57d2e398653ae37504fd9d74a38664b9646c65bd46c69
Instruction Fuzzy Hash: C32237B0508241DFDB64DF54C494B6ABBE2BF85300F14C96DE89A8B362D731ED81DB86

Function 015F0198 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 015F01F2

Strings

D, xrefs: 015F01AC

Memory Dump Source

Source File: 00000000.00000002.1378935431.00000000015ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Xre0Nmqk09.jbxd

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: c44042240367ae80eaa8206569f06584b606a7a7c9118113533914ad92b6354f
Instruction ID: 3965384d6b5f46eef598c71cb7389a49f398227f0232e379dd25e142b7bfdf76
Opcode Fuzzy Hash: c44042240367ae80eaa8206569f06584b606a7a7c9118113533914ad92b6354f
Instruction Fuzzy Hash: 0701FB71A4030DABDB20EBE0CC49FEE7779BB54701F44851DBB16AA1C1EA7496088BA1

Function 015EF105 Relevance: 3.4, APIs: 2, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 015EF935
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015EF959
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015EF97B
TerminateProcess.KERNELBASE(00000000,00000000,?), ref: 015EFC84

Memory Dump Source

Source File: 00000000.00000002.1378935431.00000000015ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Xre0Nmqk09.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadTerminateThreadWow64
String ID:
API String ID: 572931308-0
Opcode ID: b327fbffe67f088a8ec06bc3364a8d9e1395271827ab643009cfd88a26bb8519
Instruction ID: e241bae0dedc354f02449f9654e25b5bfd443f5e85b8da9a213ab55bd7c258fb
Opcode Fuzzy Hash: b327fbffe67f088a8ec06bc3364a8d9e1395271827ab643009cfd88a26bb8519
Instruction Fuzzy Hash: B712DE20E18658C6EB24DF64D8507DEB272FF68300F1094E9910DEB7A5E77A4E81CF5A

Function 00677BB1 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00677C0B
_memmove.LIBCMT ref: 00677C76

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 888ce228c65e5e126e2c0d83d6bef63a0f4650b727a1fb86e52d4496ebb79edc
Instruction ID: 10d59b149c8a7cad5485830e02157cb6f3149e0a6c8f462bf6d73cd988f75d3e
Opcode Fuzzy Hash: 888ce228c65e5e126e2c0d83d6bef63a0f4650b727a1fb86e52d4496ebb79edc
Instruction Fuzzy Hash: 6C31D4B1604506AFC714DF28C8D1EA9F3AAFF48320725C62DE919CB791DB30E860CB90

Function 0067492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00674992

Part of subcall function 006935AC: __lock.LIBCMT ref: 006935B2
Part of subcall function 006935AC: DecodePointer.KERNEL32(00000001,?,006749A7,006C81BC), ref: 006935BE
Part of subcall function 006935AC: EncodePointer.KERNEL32(?,?,006749A7,006C81BC), ref: 006935C9

Part of subcall function 00674A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00674A73
Part of subcall function 00674A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00674A88

Part of subcall function 00673B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00673B7A
Part of subcall function 00673B4C: IsDebuggerPresent.KERNEL32 ref: 00673B8C
Part of subcall function 00673B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,007362F8,007362E0,?,?), ref: 00673BFD
Part of subcall function 00673B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00673C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 006749D2

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 3536537ce4fd12b86748f2efb118d5740db1370c4a71768f97c6d0cd4751a9d6
Instruction ID: fef912a0c3b355c97330e55de293b313919329c0e783ea617d3e62a821e6285f
Opcode Fuzzy Hash: 3536537ce4fd12b86748f2efb118d5740db1370c4a71768f97c6d0cd4751a9d6
Instruction Fuzzy Hash: 6811AC71908311ABD700EF29EC0591AFBF9FF99710F00C52EF048832A2DB749544CB9A

Function 00690FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0069594C: __FF_MSGBANNER.LIBCMT ref: 00695963
Part of subcall function 0069594C: __NMSG_WRITE.LIBCMT ref: 0069596A
Part of subcall function 0069594C: RtlAllocateHeap.NTDLL(015B0000,00000000,00000001,00000000,?,?,?,00691013,?), ref: 0069598F

std::exception::exception.LIBCMT ref: 0069102C
__CxxThrowException@8.LIBCMT ref: 00691041

Part of subcall function 006987DB: RaiseException.KERNEL32(?,?,?,0072BAF8,00000000,?,?,?,?,00691046,?,0072BAF8,?,00000001), ref: 00698830

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: b84f9fb5d4448ada9249649475d361c93e0c22cf1d5faebe3bb4592c4b2c3663
Instruction ID: fcb31a194e95326f41e545e74a1c42809b82d6ae039a07bf07f8b202f47a03c1
Opcode Fuzzy Hash: b84f9fb5d4448ada9249649475d361c93e0c22cf1d5faebe3bb4592c4b2c3663
Instruction Fuzzy Hash: 56F0A93550025DA6CF21AA94EC059DF77AE9F02350F30052AF8149AA92DF769E819294

Function 006955D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00698D68: __getptd_noexit.LIBCMT ref: 00698D68

__lock_file.LIBCMT ref: 0069561B

Part of subcall function 00696E4E: __lock.LIBCMT ref: 00696E71

__fclose_nolock.LIBCMT ref: 00695626

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: b14ac47beb5ad3d3561c4341bd8467de14ae226d2ea74220d6201de50c24fb44
Instruction ID: 67528152ef347ae7573b02831d9b1c28bb85b271ef7c4863e9a279aa38e9a9fa
Opcode Fuzzy Hash: b14ac47beb5ad3d3561c4341bd8467de14ae226d2ea74220d6201de50c24fb44
Instruction Fuzzy Hash: 8AF02B71800B009EDF627F35880276E77AB1F41334F55410DF412AB9D1CF7C4A019B59

Function 00690E48 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00690EF7

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 2efb89a920f2fd5c7df2aad1c010cbbc2f1521efda5d8d0b4ec0e436f7707c37
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 4D31B371A00105DFEB18DF58D4809A9F7AAFF59310B648AA5E909CBB51D731EEC1DB80

Function 006B00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 006B00E1

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: caf7f809efe22ceedf8d616597cd83a1c5e2f5cf11d71e19f17ece3bd0d288fa
Instruction ID: d09044d9c810189435b4795f679147417112c389019961e064f665bc591ee830
Opcode Fuzzy Hash: caf7f809efe22ceedf8d616597cd83a1c5e2f5cf11d71e19f17ece3bd0d288fa
Instruction Fuzzy Hash: 0E4147B4508341CFDB24CF54C484B5ABBE2BF85308F19899CE8994B762C732E885CB52

Function 00677CB3 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00677D13

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 68d7cc2c9334143b23bac9bf692d8915d71cbab29f30bc7ab7360eecc2f6c154
Instruction ID: f05e97ef1c4f8bfc3a518c1f13f90d5a996ea7ddf3a1dd7cb774448d4945e5c7
Opcode Fuzzy Hash: 68d7cc2c9334143b23bac9bf692d8915d71cbab29f30bc7ab7360eecc2f6c154
Instruction Fuzzy Hash: 14213671604609EBDF20AF60FC417797BBAFF15350F21C56EE48AC5191EB3098A18B4A

Function 00674F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00674D13: FreeLibrary.KERNEL32(00000000,?), ref: 00674D4D

Part of subcall function 0069548B: __wfsopen.LIBCMT ref: 00695496

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007362F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00674F6F

Part of subcall function 00674CC8: FreeLibrary.KERNEL32(00000000), ref: 00674D02

Part of subcall function 00674DD0: _memmove.LIBCMT ref: 00674E1A

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 0f18ce6ca65cea3b4daf0ad2d7c963ce554e405d8e131e144d47e1e33fa85d42
Instruction ID: bdbfc1dbd4b783c78ddbab4a55801a1fa88541a156920deb841024116000f323
Opcode Fuzzy Hash: 0f18ce6ca65cea3b4daf0ad2d7c963ce554e405d8e131e144d47e1e33fa85d42
Instruction Fuzzy Hash: 1F11C431700209AACB55FF70CC0ABAE77AA9F81700F10C42DF546A6281DF759A059BA4

Function 006B01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 006B01BB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 53f3718def1d02c0990dff7860ace996fd2ae9a45f219777b3650e67889c5db1
Instruction ID: a456af6b9ae1a08923c9b9393935376cda2006833fba58192944cc2fcb92eccb
Opcode Fuzzy Hash: 53f3718def1d02c0990dff7860ace996fd2ae9a45f219777b3650e67889c5db1
Instruction Fuzzy Hash: 972133B4508341CFDB24DF64C444A5BBBE2BF84304F04896CE99A4B721C732E885CB52

Function 00694A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00694AD6

Part of subcall function 00698D68: __getptd_noexit.LIBCMT ref: 00698D68

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: e37d43f8ad40edd9d41c3d5ce4d894666c66c3b5e44297511e7427d84b4c35cc
Instruction ID: 0e8120cf190f52d468789bf65316be6b0f09788407355751a4b36072a6a76235
Opcode Fuzzy Hash: e37d43f8ad40edd9d41c3d5ce4d894666c66c3b5e44297511e7427d84b4c35cc
Instruction Fuzzy Hash: 43F0A4719402099FDF91AF74CC06BDE37ABAF01325F084518B4149B5D5CF788A52DF59

Function 00674FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,007362F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00674FDE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 72d52b4d69be7dbbae9f44c70f798e5e108653b9d0f1def6e68b490f5df821df
Instruction ID: a8511c51a6b3b91140ba9c75f8f65e2197e4a6f95b89e3baf7b9bb9077cf9c51
Opcode Fuzzy Hash: 72d52b4d69be7dbbae9f44c70f798e5e108653b9d0f1def6e68b490f5df821df
Instruction Fuzzy Hash: CCF03971105712CFCB349F64E498862BBE6BF44329321CA3EE1DB82A10CB35A840DF40

Function 006909D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006909F4

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 1007208b1c341a7488843e79f852250eb2ddad76a6cca0e28fff968b7edae99f
Instruction ID: cedf295cde8706f16b55c025126d547996e542b0c5739749a4adb44d875e5cd6
Opcode Fuzzy Hash: 1007208b1c341a7488843e79f852250eb2ddad76a6cca0e28fff968b7edae99f
Instruction Fuzzy Hash: 1FE0CD3690422857C720E69C9C05FFA77EEDF89790F0441B5FC0CD7204D9A09D818694

Function 0069548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00695496

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 28e828051b8ea6e48d21f440fcb5c6d35e0fbde2574f1a9473b733f4c5589313
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: BDB0927684020C77DE822E82EC02A593B5E9B40B78F808020FB0C18562A673A6A09689

Function 015F0104 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 015F0119

Memory Dump Source

Source File: 00000000.00000002.1378935431.00000000015ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Xre0Nmqk09.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 2efbad2a00b35fdb99a5b5675fff596bb8ab22d7de5059badc1d5574adab5dbe
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 5AE09A7498110DAFDB00DFA4D94969D7BB4EF04301F1005A5FD05D6681DA309A648A62

Function 015F0108 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 015F0119

Memory Dump Source

Source File: 00000000.00000002.1378935431.00000000015ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Xre0Nmqk09.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: f6a1af5fc9001b3e3f9423312f249303f37b61bc541718fb2583c620924c26e6
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 27E0E67498110DDFDB00DFB4D94969D7BB4FF04301F100165FD01D2281D6309D60CA62

Non-executed Functions

Function 006FCDAC Relevance: 77.6, APIs: 40, Strings: 4, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 006FCE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006FCE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 006FCED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006FCF00
SendMessageW.USER32 ref: 006FCF29
_wcsncpy.LIBCMT ref: 006FCFA1
GetKeyState.USER32(00000011), ref: 006FCFC2
GetKeyState.USER32(00000009), ref: 006FCFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006FCFE5
GetKeyState.USER32(00000010), ref: 006FCFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006FD018
SendMessageW.USER32 ref: 006FD03F
SendMessageW.USER32(?,00001030,?,006FB602), ref: 006FD145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 006FD15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 006FD16E
SetCapture.USER32(?), ref: 006FD177
ClientToScreen.USER32(?,?), ref: 006FD1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 006FD1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006FD203
ReleaseCapture.USER32 ref: 006FD20E
GetCursorPos.USER32(?), ref: 006FD248
ScreenToClient.USER32(?,?), ref: 006FD255
SendMessageW.USER32(?,00001012,00000000,?), ref: 006FD2B1
SendMessageW.USER32 ref: 006FD2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 006FD31C
SendMessageW.USER32 ref: 006FD34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 006FD36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 006FD37B
GetCursorPos.USER32(?), ref: 006FD39B
ScreenToClient.USER32(?,?), ref: 006FD3A8
GetParent.USER32(?), ref: 006FD3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 006FD431
SendMessageW.USER32 ref: 006FD462
ClientToScreen.USER32(?,?), ref: 006FD4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 006FD4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 006FD51A
SendMessageW.USER32 ref: 006FD53D
ClientToScreen.USER32(?,?), ref: 006FD58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 006FD5C3

Part of subcall function 006725DB: GetWindowLongW.USER32(?,000000EB), ref: 006725EC

GetWindowLongW.USER32(?,000000F0), ref: 006FD65F

Strings

@GUI_DRAGID, xrefs: 006FD1AA
@U=u, xrefs: 006FCE91, 006FCF00, 006FCF29, 006FCFE5, 006FD018, 006FD03F, 006FD145, 006FD2B1, 006FD2DF, 006FD31C, 006FD34B, 006FD431, 006FD462, 006FD51A, 006FD53D
F, xrefs: 006FD543
prs, xrefs: 006FD1BD

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$@U=u$F$prs
API String ID: 3977979337-469367293
Opcode ID: 1fb6ab80725e2951796dec38fe00d263e41239f8c73d2e7bb7db035a8da2599b
Instruction ID: f5ddec59c1ea2db97121879403a635c692e529171f7cd13d340c09fb0d92c5f1
Opcode Fuzzy Hash: 1fb6ab80725e2951796dec38fe00d263e41239f8c73d2e7bb7db035a8da2599b
Instruction Fuzzy Hash: 64429A74208249EFD721CF28C944ABABBE7FF49324F14452DF695873A1CB31A851CB96

Function 006F804A Relevance: 61.8, APIs: 33, Strings: 2, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 006F873F

Strings

%d/%02d/%02d, xrefs: 006F8478
@U=u, xrefs: 006F80E0, 006F8134, 006F81E7, 006F822E, 006F8256, 006F83BB, 006F8456, 006F84A0, 006F84EA, 006F850A, 006F85EC, 006F8625, 006F8676, 006F86E1, 006F873F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d$@U=u
API String ID: 3850602802-2764005415
Opcode ID: 3b42bc381ed0b7e5f6985e8f4656dcf0102ed6af94454d48fa43845ca1950272
Instruction ID: 8e46a8a528ef783545197abcff3b3f922e2f8b280a914c24fec85e2720024f95
Opcode Fuzzy Hash: 3b42bc381ed0b7e5f6985e8f4656dcf0102ed6af94454d48fa43845ca1950272
Instruction Fuzzy Hash: 1412AE71500208AFEB259F24CC49FBE7BBAEF85710F2441A9FA15EB2A1DF709941CB50

Function 0068710E Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006875C2
_memset.LIBCMT ref: 006876B1
_memmove.LIBCMT ref: 00687C4B
_memmove.LIBCMT ref: 00687E4F

Strings

DEFINE, xrefs: 006C25AF
0wr, xrefs: 006C1F5B
\b(?=\w), xrefs: 006C3C34
[:<:]], xrefs: 006875F1
Oah, xrefs: 006C287E
[:>:]], xrefs: 0068760A
Q\E, xrefs: 006881C1
\b(?<=\w), xrefs: 006C3C41

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove$_memset
String ID: 0wr$DEFINE$Oah$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-3592995527
Opcode ID: 05af2191ec1f2780b3623ad00ef21a13a39d2e73ebb4b5bfc8dcb86494af4051
Instruction ID: 2eb0f07e2e093e68b59ba2a9effdde2f8a7d5f4fb9d504239fcd28b0b720a60a
Opcode Fuzzy Hash: 05af2191ec1f2780b3623ad00ef21a13a39d2e73ebb4b5bfc8dcb86494af4051
Instruction Fuzzy Hash: 9C937F71A042169BDB24DF58C891BFDB7B2FF48710F24816EE955AB381E7709E82CB50

Function 00674A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00674A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006ADA8E
IsIconic.USER32(?), ref: 006ADA97
ShowWindow.USER32(?,00000009), ref: 006ADAA4
SetForegroundWindow.USER32(?), ref: 006ADAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 006ADAC4
GetCurrentThreadId.KERNEL32 ref: 006ADACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 006ADAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 006ADAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 006ADAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 006ADAF8
SetForegroundWindow.USER32(?), ref: 006ADAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 006ADB10
keybd_event.USER32(00000012,00000000), ref: 006ADB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 006ADB25
keybd_event.USER32(00000012,00000000), ref: 006ADB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 006ADB33
keybd_event.USER32(00000012,00000000), ref: 006ADB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 006ADB42
keybd_event.USER32(00000012,00000000), ref: 006ADB47
SetForegroundWindow.USER32(?), ref: 006ADB4A
AttachThreadInput.USER32(?,?,00000000), ref: 006ADB71

Strings

Shell_TrayWnd, xrefs: 006ADA89

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: f5bd627c11fea187dffd1e961fe72802f2e5c3b3d5bf1e67d6de680b24ea6f78
Instruction ID: 06c8937bb8c9861885b7dbcecb63e95f4cc4f533f03c292058b30bba17917082
Opcode Fuzzy Hash: f5bd627c11fea187dffd1e961fe72802f2e5c3b3d5bf1e67d6de680b24ea6f78
Instruction Fuzzy Hash: 3E315271A40318BBEB216F619C49FBE7E6EEF45B50F114025FA05EA2D0CAB05D01EFA4

Function 006C8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 006C8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006C8D0D
Part of subcall function 006C8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006C8D3A
Part of subcall function 006C8CC3: GetLastError.KERNEL32 ref: 006C8D47

_memset.LIBCMT ref: 006C889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 006C88ED
CloseHandle.KERNEL32(?), ref: 006C88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 006C8915
GetProcessWindowStation.USER32 ref: 006C892E
SetProcessWindowStation.USER32(00000000), ref: 006C8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 006C8952

Part of subcall function 006C8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006C8851), ref: 006C8728
Part of subcall function 006C8713: CloseHandle.KERNEL32(?,?,006C8851), ref: 006C873A

Strings

winsta0, xrefs: 006C8910
default, xrefs: 006C894D
, xrefs: 006C88AA

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 24b37879f15cb579aa56140743a5ae5a10f4b917777546ae6be3d1d38129541d
Instruction ID: 3b7b9f73b9ccefc5d6b7eb761adce08ac7e1264144f95ff4caa175fdfeac356d
Opcode Fuzzy Hash: 24b37879f15cb579aa56140743a5ae5a10f4b917777546ae6be3d1d38129541d
Instruction Fuzzy Hash: EE812471900259AEDF219FA4DC45EFEBBBAEF04304F18416EF910A7261DB318A14DB64

Function 006E425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(006FF910), ref: 006E4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 006E4292
GetClipboardData.USER32(0000000D), ref: 006E429A
CloseClipboard.USER32 ref: 006E42A6
GlobalLock.KERNEL32(00000000), ref: 006E42C2
CloseClipboard.USER32 ref: 006E42CC
GlobalUnlock.KERNEL32(00000000), ref: 006E42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 006E42EE
GetClipboardData.USER32(00000001), ref: 006E42F6
GlobalLock.KERNEL32(00000000), ref: 006E4303
GlobalUnlock.KERNEL32(00000000), ref: 006E4337
CloseClipboard.USER32 ref: 006E4447

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: a7ab6d05462c35b5a5f69d10a54d5a2fdb9da82699853754d0a17145ed98e628
Instruction ID: 732941dbb92a946a934776c3c1a852df91f20025be13c3d22607fbb629840d64
Opcode Fuzzy Hash: a7ab6d05462c35b5a5f69d10a54d5a2fdb9da82699853754d0a17145ed98e628
Instruction Fuzzy Hash: 4E518D31204342AFD311AF75DC86FBE77AAAF84B00F10452DB65AD62A1DF70DA05CB66

Function 006DC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 006DC9F8
FindClose.KERNEL32(00000000), ref: 006DCA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006DCA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006DCA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 006DCAAF
__swprintf.LIBCMT ref: 006DCAFB
__swprintf.LIBCMT ref: 006DCB3E

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

__swprintf.LIBCMT ref: 006DCB92

Part of subcall function 006938D8: __woutput_l.LIBCMT ref: 00693931

__swprintf.LIBCMT ref: 006DCBE0

Part of subcall function 006938D8: __flsbuf.LIBCMT ref: 00693953
Part of subcall function 006938D8: __flsbuf.LIBCMT ref: 0069396B

__swprintf.LIBCMT ref: 006DCC2F
__swprintf.LIBCMT ref: 006DCC7E
__swprintf.LIBCMT ref: 006DCCCD

Strings

%4d, xrefs: 006DCB38
%02d, xrefs: 006DCB86, 006DCB90, 006DCBDE, 006DCC2D, 006DCC7C, 006DCCCB
%4d%02d%02d%02d%02d%02d, xrefs: 006DCAF5

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 94fe8403045b3e5ba74e34308fc79a789324a87f140f756329dd0282e5cda67f
Instruction ID: 013124d0332a3ddbced1e2c6d1250c4a1ba2d5510838359a069b5df322740204
Opcode Fuzzy Hash: 94fe8403045b3e5ba74e34308fc79a789324a87f140f756329dd0282e5cda67f
Instruction Fuzzy Hash: CAA131B1508305ABC740EB54C985DAFB7EEFF94700F40492EF59AC7291EA34DA09CB66

Function 006DF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 006DF221
_wcscmp.LIBCMT ref: 006DF236
_wcscmp.LIBCMT ref: 006DF24D
GetFileAttributesW.KERNEL32(?), ref: 006DF25F
SetFileAttributesW.KERNEL32(?,?), ref: 006DF279
FindNextFileW.KERNEL32(00000000,?), ref: 006DF291
FindClose.KERNEL32(00000000), ref: 006DF29C
FindFirstFileW.KERNEL32(*.*,?), ref: 006DF2B8
_wcscmp.LIBCMT ref: 006DF2DF
_wcscmp.LIBCMT ref: 006DF2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 006DF308
SetCurrentDirectoryW.KERNEL32(0072A5A0), ref: 006DF326
FindNextFileW.KERNEL32(00000000,00000010), ref: 006DF330
FindClose.KERNEL32(00000000), ref: 006DF33D
FindClose.KERNEL32(00000000), ref: 006DF34F

Strings

*.*, xrefs: 006DF2B3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 1059a3eb425d3efc0699ffb9492f37422c352f5bb151a95a31799d1190e12b31
Instruction ID: fd8ba4bb88efdb1f94c3074841c54c345480216d6cac2925a5adfd025da1f526
Opcode Fuzzy Hash: 1059a3eb425d3efc0699ffb9492f37422c352f5bb151a95a31799d1190e12b31
Instruction Fuzzy Hash: 0031C3769002196BDF20DBF4EC98AEE77AE9F08360F114176E805D3390EB75DB45CA94

Function 006F0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006F0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,006FF910,00000000,?,00000000,?,?), ref: 006F0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 006F0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 006F0D1D
RegCloseKey.ADVAPI32(?), ref: 006F103D
RegCloseKey.ADVAPI32(00000000), ref: 006F104A

Strings

REG_SZ, xrefs: 006F0D5B
REG_EXPAND_SZ, xrefs: 006F0CBA
REG_MULTI_SZ, xrefs: 006F0E05
REG_BINARY, xrefs: 006F0FD8
REG_DWORD, xrefs: 006F0F0E
REG_QWORD, xrefs: 006F0F8B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: d2362cf100d7bf058fa7ed64b5f4fa23f8c0d6b9e847ef3c9abcfa795a236c54
Instruction ID: e55da2a6a26af1930ada615ad7c019775028c814b433e7679d298f640e28e3aa
Opcode Fuzzy Hash: d2362cf100d7bf058fa7ed64b5f4fa23f8c0d6b9e847ef3c9abcfa795a236c54
Instruction Fuzzy Hash: F4026C752006119FDB54EF14C891E2AB7E6FF89724F04885DFA8A9B362CB30ED41CB95

Function 006DF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 006DF37E
_wcscmp.LIBCMT ref: 006DF393
_wcscmp.LIBCMT ref: 006DF3AA

Part of subcall function 006D45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 006D45DC

FindNextFileW.KERNEL32(00000000,?), ref: 006DF3D9
FindClose.KERNEL32(00000000), ref: 006DF3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 006DF400
_wcscmp.LIBCMT ref: 006DF427
_wcscmp.LIBCMT ref: 006DF43E
SetCurrentDirectoryW.KERNEL32(?), ref: 006DF450
SetCurrentDirectoryW.KERNEL32(0072A5A0), ref: 006DF46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 006DF478
FindClose.KERNEL32(00000000), ref: 006DF485
FindClose.KERNEL32(00000000), ref: 006DF497

Strings

*.*, xrefs: 006DF3FB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: e03bad368ec05b9f4b9ff291f534baa1243e116457471d5d2f73b274e935633e
Instruction ID: fd8bca4188b6b7badf0fdf3287fa8cd57a89f807eb97d7be18b73368fcc1ea4d
Opcode Fuzzy Hash: e03bad368ec05b9f4b9ff291f534baa1243e116457471d5d2f73b274e935633e
Instruction Fuzzy Hash: AC31F8729012197FCF109BA4EC88AEF77AE9F49320F150176E801E33A1DB74DE45CA94

Function 00686843 Relevance: 22.1, Strings: 17, Instructions: 883COMMON

Download Yara Rule

Strings

BSR_ANYCRLF), xrefs: 006C1757
LF), xrefs: 006C16DD
UTF16), xrefs: 006C1508
UTF), xrefs: 006C1533
CRLF), xrefs: 006C16FA
opxls0opxls0opxls0opxls0opxls8opxls5opxlscopxls0opxls7opxls4opxls4opxlscopxls8opxlsbopxls4opxls5opxls0opxls8opxls9opxls9opxlsbopxl, xrefs: 0068690D
LIMIT_RECURSION=, xrefs: 006C1635
ANY), xrefs: 006C1717
CR), xrefs: 006C16C0
PJq, xrefs: 006868B3
NO_START_OPT), xrefs: 006C1588
LIMIT_MATCH=, xrefs: 006C15A9
UCP), xrefs: 006C1546
Oah, xrefs: 006C1888, 006C192F, 006C19DD
BSR_UNICODE), xrefs: 006C1771
ANYCRLF), xrefs: 006C1734
NO_AUTO_POSSESS), xrefs: 006C1567

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oah$PJq$UCP)$UTF)$UTF16)$opxls0opxls0opxls0opxls0opxls8opxls5opxlscopxls0opxls7opxls4opxls4opxlscopxls8opxlsbopxls4opxls5opxls0opxls8opxls9opxls9opxlsbopxl
API String ID: 0-2183263460
Opcode ID: c1921b699cdb8ebe8168fdb002a02268e576dc423322bca0c6274d64e61f53e1
Instruction ID: ea22890c04f16c230147e4d53cc180740b6f3c79faaa3e7624a12842611e3389
Opcode Fuzzy Hash: c1921b699cdb8ebe8168fdb002a02268e576dc423322bca0c6274d64e61f53e1
Instruction Fuzzy Hash: 50726F71E002199BDB14DF59C890BFEB7B6EF4A310F14816AE949EB381DB749D81CB90

Function 006C81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006C8766
Part of subcall function 006C874A: GetLastError.KERNEL32(?,006C822A,?,?,?), ref: 006C8770
Part of subcall function 006C874A: GetProcessHeap.KERNEL32(00000008,?,?,006C822A,?,?,?), ref: 006C877F
Part of subcall function 006C874A: HeapAlloc.KERNEL32(00000000,?,006C822A,?,?,?), ref: 006C8786
Part of subcall function 006C874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006C879D

Part of subcall function 006C87E7: GetProcessHeap.KERNEL32(00000008,006C8240,00000000,00000000,?,006C8240,?), ref: 006C87F3
Part of subcall function 006C87E7: HeapAlloc.KERNEL32(00000000,?,006C8240,?), ref: 006C87FA
Part of subcall function 006C87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,006C8240,?), ref: 006C880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006C825B
_memset.LIBCMT ref: 006C8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 006C828F
GetLengthSid.ADVAPI32(?), ref: 006C82A0
GetAce.ADVAPI32(?,00000000,?), ref: 006C82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006C82F9
GetLengthSid.ADVAPI32(?), ref: 006C8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 006C8325
HeapAlloc.KERNEL32(00000000), ref: 006C832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 006C834D
CopySid.ADVAPI32(00000000), ref: 006C8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 006C8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006C83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 006C83BF

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 1a4975a264170f873c0508a145cc7d3071d1b06869bea6e63d88831d5ac2fc48
Instruction ID: 4b3fd3af101abf8463d5ac4d33d544e760c5f4513ea8848be5d49f43410eb56c
Opcode Fuzzy Hash: 1a4975a264170f873c0508a145cc7d3071d1b06869bea6e63d88831d5ac2fc48
Instruction Fuzzy Hash: 64612A71A00219AFDF109F95DC84EFEBBBAFF04700B14926DF815A7291DB359A05CB60

Function 006F0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006F10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006F0038,?,?), ref: 006F10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006F0737

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 006F07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 006F086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 006F0AAD
RegCloseKey.ADVAPI32(00000000), ref: 006F0ABA

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 351cdbc83c380e671c92275277368e1a1311f2272dc1fa3c841bb3e84e3757c0
Instruction ID: 35d87f76b7c5de73172befdf70d7b875c67c1afb9c8f76d137f03d9df8282177
Opcode Fuzzy Hash: 351cdbc83c380e671c92275277368e1a1311f2272dc1fa3c841bb3e84e3757c0
Instruction Fuzzy Hash: 2EE15C31204304AFDB14DF28C891E6ABBEAEF89714B04856DF94ADB362DA31ED01CB55

Function 006D0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 006D0241
GetAsyncKeyState.USER32(000000A0), ref: 006D02C2
GetKeyState.USER32(000000A0), ref: 006D02DD
GetAsyncKeyState.USER32(000000A1), ref: 006D02F7
GetKeyState.USER32(000000A1), ref: 006D030C
GetAsyncKeyState.USER32(00000011), ref: 006D0324
GetKeyState.USER32(00000011), ref: 006D0336
GetAsyncKeyState.USER32(00000012), ref: 006D034E
GetKeyState.USER32(00000012), ref: 006D0360
GetAsyncKeyState.USER32(0000005B), ref: 006D0378
GetKeyState.USER32(0000005B), ref: 006D038A

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 31d72b12f208b2af82d368fc4780a8544d3357ed003d7101d63c384fe303068c
Instruction ID: 9868aa1a9e7d055cc42599e57b887650199119f1ecbedd389dfc3e7e27954435
Opcode Fuzzy Hash: 31d72b12f208b2af82d368fc4780a8544d3357ed003d7101d63c384fe303068c
Instruction Fuzzy Hash: CC41A434D047CA6AFF719B6488087F5BEA26F12340F58409FD5C6463C2EB949AC8C7A2

Function 00684140 Relevance: 15.1, APIs: 1, Strings: 7, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00684520
opxls0opxls0opxls0opxls0opxls8opxls5opxlscopxls0opxls7opxls4opxls4opxlscopxls8opxlsbopxls4opxls5opxls0opxls8opxls9opxls9opxlsbopxl, xrefs: 0068448E, 00684499
VUUU, xrefs: 006844DB
VUUU, xrefs: 006844ED
VUUU, xrefs: 006B7B0C
ERCP, xrefs: 0068421F
Oah, xrefs: 00684984, 006B8173

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID: ERCP$Oah$VUUU$VUUU$VUUU$VUUU$opxls0opxls0opxls0opxls0opxls8opxls5opxlscopxls0opxls7opxls4opxls4opxlscopxls8opxlsbopxls4opxls5opxls0opxls8opxls9opxls9opxlsbopxl
API String ID: 0-3214653728
Opcode ID: dcb473074bf8dafb0eb18fb29e15240b436e25f7f81d9821e1cbe9505fb61475
Instruction ID: 34da8b04677aba4d69bc3c81ac6a5b1ad52388bff74f4e5c92029bb2c502605c
Opcode Fuzzy Hash: dcb473074bf8dafb0eb18fb29e15240b436e25f7f81d9821e1cbe9505fb61475
Instruction Fuzzy Hash: B0A25DB0E0421A8BDF24DF58C9907EDB7B2BF54314F1482AAD856A7380EB749EC5DB50

Function 006E4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 006E447F
EmptyClipboard.USER32 ref: 006E4485
GlobalAlloc.KERNEL32(00000002,?), ref: 006E449A
CloseClipboard.USER32 ref: 006E4539

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 1aa3016b9c4180a7224e16a32f31b3e28a075c1f91aab444c8e803cb8a42fe2c
Instruction ID: 1617d6ff7925176962b8c8956f4b81693ce9cc578446d5e48263ea093eecf02b
Opcode Fuzzy Hash: 1aa3016b9c4180a7224e16a32f31b3e28a075c1f91aab444c8e803cb8a42fe2c
Instruction Fuzzy Hash: 05216D35301211AFEB10AF65EC49B7E77AAEF44721F14802AF946DB2A1CF74AD01CB58

Function 006D3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006748AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006748A1,?,?,006737C0,?), ref: 006748CE

Part of subcall function 006D4CD3: GetFileAttributesW.KERNEL32(?,006D3947), ref: 006D4CD4

FindFirstFileW.KERNEL32(?,?), ref: 006D3ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 006D3B87
MoveFileW.KERNEL32(?,?), ref: 006D3B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 006D3BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 006D3BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 006D3BF5

Strings

\*.*, xrefs: 006D3A8A, 006D3A93, 006D3AA8

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 63e5f5471a9056d4b40c970277ddea6365501e56e70f15af4aa2d5ee13fc0dfb
Instruction ID: d887b3fd5049128e602706559209ed02eeedb4e917870210d302f71f3c87d18e
Opcode Fuzzy Hash: 63e5f5471a9056d4b40c970277ddea6365501e56e70f15af4aa2d5ee13fc0dfb
Instruction Fuzzy Hash: AF519031C0125C9ACF45EBA0CD929EDB77AAF14300F6481AAE44677291EF316F09CBA5

Function 006DF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 006DF6AB
Sleep.KERNEL32(0000000A), ref: 006DF6DB
_wcscmp.LIBCMT ref: 006DF6EF
_wcscmp.LIBCMT ref: 006DF70A
FindNextFileW.KERNEL32(?,?), ref: 006DF7A8
FindClose.KERNEL32(00000000), ref: 006DF7BE

Strings

*.*, xrefs: 006DF690

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: b94b45b2db688cf959f2d603606e53746b1d3eefe95ef734f9d14db1ad063163
Instruction ID: 219c19ccbae539badb62c1de357352c5d83f70037af7e1d1f373e6d244cf6b9b
Opcode Fuzzy Hash: b94b45b2db688cf959f2d603606e53746b1d3eefe95ef734f9d14db1ad063163
Instruction Fuzzy Hash: BF415F71D0021A9FCF51DF64DC85AEEBBB6FF05310F14456AE81AA6391EB309E44CB94

Function 006858C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00685A05
_memmove.LIBCMT ref: 00685A55
_memmove.LIBCMT ref: 00685ABB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 067483502cc949499964306f48a47cdc10315086ec21061284731c29b1cf4a2e
Instruction ID: b8776e55cd1b0e8fe0104bf78273b0250c87472eb5e722f868d1b7f08fc0b283
Opcode Fuzzy Hash: 067483502cc949499964306f48a47cdc10315086ec21061284731c29b1cf4a2e
Instruction Fuzzy Hash: D2126A70A0060ADFDF14DFA4D985AEEB7B6FF48300F10866DE806A7251EB36AD15CB54

Function 00685680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00690FF6: std::exception::exception.LIBCMT ref: 0069102C
Part of subcall function 00690FF6: __CxxThrowException@8.LIBCMT ref: 00691041

_memmove.LIBCMT ref: 006C062F
_memmove.LIBCMT ref: 006C0744
_memmove.LIBCMT ref: 006C07EB

Strings

yZh, xrefs: 006C0881, 006C07FF

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZh
API String ID: 1300846289-2807879289
Opcode ID: 9e67fe9132a64cbdb3b5bfb1c1bfa86576f37668b34fd191713c29b8d46637e7
Instruction ID: ec0e31eef32d693f51e81c6ef7872919a8b3689485f11d306184cf59e8e42811
Opcode Fuzzy Hash: 9e67fe9132a64cbdb3b5bfb1c1bfa86576f37668b34fd191713c29b8d46637e7
Instruction Fuzzy Hash: 44027FB0A00205DFDF54DF64D981ABEBBB6EF44300F1480ADE80ADB255EB35DA51CB95

Function 006D545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 006C8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006C8D0D
Part of subcall function 006C8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006C8D3A
Part of subcall function 006C8CC3: GetLastError.KERNEL32 ref: 006C8D47

ExitWindowsEx.USER32(?,00000000), ref: 006D549B

Strings

SeShutdownPrivilege, xrefs: 006D546B
@, xrefs: 006D548E
, xrefs: 006D5489

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 978212077ad5616a4fa62350794d503ff4e1b60126739ce83bc36957e690a10c
Instruction ID: 191781a2e5b94244e6d0906d58960c4b1c7bdef4b71c798efb74c10b354ce832
Opcode Fuzzy Hash: 978212077ad5616a4fa62350794d503ff4e1b60126739ce83bc36957e690a10c
Instruction Fuzzy Hash: 6B012471E54A112AE7786778EC4AFFA729AEB00352F200037FC07D27C3DA500C8081A6

Function 00683190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oah, xrefs: 00683482

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oah
API String ID: 674341424-3137904739
Opcode ID: ca1cfd11377e0ec3881290da90cda11860045692a40e1f07a8d3551fcad717da
Instruction ID: 7c387df0a7934e3a8942e5b6d4bd0eefb71b6870bbda3b3e5e6c509d0103deda
Opcode Fuzzy Hash: ca1cfd11377e0ec3881290da90cda11860045692a40e1f07a8d3551fcad717da
Instruction Fuzzy Hash: 6E22CEB15083119FC724EF14C891BAFB7E6AF84700F008A1DF99A97391DB71EA45CB96

Function 006E6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 006E65EF
WSAGetLastError.WSOCK32(00000000), ref: 006E65FE
bind.WSOCK32(00000000,?,00000010), ref: 006E661A
listen.WSOCK32(00000000,00000005), ref: 006E6629
WSAGetLastError.WSOCK32(00000000), ref: 006E6643
closesocket.WSOCK32(00000000,00000000), ref: 006E6657

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: c52d3ab49666eed14c4952ba73824010c53fb19555eb4fb48e0a62d3b0aa50aa
Instruction ID: 6e117345bf26e7a08d269bef33e84239bc8a7ceb9010bde613caa5884a52de7e
Opcode Fuzzy Hash: c52d3ab49666eed14c4952ba73824010c53fb19555eb4fb48e0a62d3b0aa50aa
Instruction Fuzzy Hash: F02189302012009FCB10AF65D889A7EB7FAEF48360F148169F95AA73D2CA70AD01CB65

Function 00671287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

DefDlgProcW.USER32(?,?,?,?,?), ref: 006719FA
GetSysColor.USER32(0000000F), ref: 00671A4E
SetBkColor.GDI32(?,00000000), ref: 00671A61

Part of subcall function 00671290: DefDlgProcW.USER32(?,00000020,?), ref: 006712D8

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: f7519bc8cd2ff85e48519ec56963fc58a684dedc00c2369bc0dbb86b2c9d6bfa
Instruction ID: e4af9ba11739f73b446b76141737bae6025e36987885fd7c0b32f224e60f0e65
Opcode Fuzzy Hash: f7519bc8cd2ff85e48519ec56963fc58a684dedc00c2369bc0dbb86b2c9d6bfa
Instruction Fuzzy Hash: 1EA14470115548BAE628AB2C8C54DFF259FDF43352B24C11FF50ADE292EE24CD02D6BA

Function 006E6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 006E80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 006E80CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 006E6AB1
WSAGetLastError.WSOCK32(00000000), ref: 006E6ADA
bind.WSOCK32(00000000,?,00000010), ref: 006E6B13
WSAGetLastError.WSOCK32(00000000), ref: 006E6B20
closesocket.WSOCK32(00000000,00000000), ref: 006E6B34

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 4605256d50188fac15ae7486bfb3a53d282737de5a63188a64c7ac3756ff0fc7
Instruction ID: ac01d0e027ae76874988b33ae25f974c9eea6aba42230b44c1093b4bbba4b6e7
Opcode Fuzzy Hash: 4605256d50188fac15ae7486bfb3a53d282737de5a63188a64c7ac3756ff0fc7
Instruction Fuzzy Hash: 4F418275640210AFEB50AB64DC86F7E77E69B44720F04C05CFA1AAB3D2DA709D018BA5

Function 006F55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 006F564C
IsWindowEnabled.USER32 ref: 006F565A
GetForegroundWindow.USER32(?,?,00000001), ref: 006F5667
IsIconic.USER32 ref: 006F5675
IsZoomed.USER32 ref: 006F5683

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: f5991061dc5bd35c3c25147b5efc3c6ea78e401b79345e21ab64a172d77d3cf5
Instruction ID: 77efa87172e6e928be75318aa09388955b57fc30aa93aeb8579740353eb02590
Opcode Fuzzy Hash: f5991061dc5bd35c3c25147b5efc3c6ea78e401b79345e21ab64a172d77d3cf5
Instruction Fuzzy Hash: D411D031300A146BE7215F26DC44B7ABB9BEF85721B408029EB1AD7261CB309D02CAA8

Function 0067E800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Dts, xrefs: 006B3F1F
Dts, xrefs: 0067EC21
Dts, xrefs: 0067EC1A
Dts, xrefs: 006B3F58
Variable must be of type 'Object'., xrefs: 006B428C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID: Dts$Dts$Dts$Dts$Variable must be of type 'Object'.
API String ID: 0-1148895469
Opcode ID: dcb1fa3d0c5cbfd6630f308f6601761e1790bfa69118ce1bd7b021adc36fdcc0
Instruction ID: 8e0a6df4ec1d543d8bacfcce3e19eba3167465b13f82c4f56747dff60bb3809f
Opcode Fuzzy Hash: dcb1fa3d0c5cbfd6630f308f6601761e1790bfa69118ce1bd7b021adc36fdcc0
Instruction Fuzzy Hash: A1A28F75A04215CFCB24CF58C580AA9B7B3FF58310F24C1A9E91A9B352D736ED86CB91

Function 006DC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006DC69D
CoCreateInstance.OLE32(00702D6C,00000000,00000001,00702BDC,?), ref: 006DC6B5

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

CoUninitialize.OLE32 ref: 006DC922

Strings

.lnk, xrefs: 006DC631, 006DC659, 006DC663

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: d68c5054f709aae1f6141fca14a92f96f5462b24274ff201947029f03c922ac9
Instruction ID: 171e8011584f77e3e94381d40a35b362b6efbd2d108a72d8320f40a324574f73
Opcode Fuzzy Hash: d68c5054f709aae1f6141fca14a92f96f5462b24274ff201947029f03c922ac9
Instruction Fuzzy Hash: 04A13C71104205AFD340EF54C891EABB7F9FF95314F00896DF15A972A2EB70EA09CB66

Function 006EC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,006B1D88,?), ref: 006EC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 006EC324

Strings

GetSystemWow64DirectoryW, xrefs: 006EC31E
kernel32.dll, xrefs: 006EC30D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 652deee4f4516910ab79a708ba9b08551beea41f0e8e10f7a005ff14a4c8f75f
Instruction ID: aead09e9881696e45a66ea465fb49378c3dc18ce9da0f829ff3e057513fb4329
Opcode Fuzzy Hash: 652deee4f4516910ab79a708ba9b08551beea41f0e8e10f7a005ff14a4c8f75f
Instruction Fuzzy Hash: CDE0C270201313CFCB308F2AD818AD676E6EF08325B80D439E895C3310E770D841CBA0

Function 006EF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 006EF151
Process32FirstW.KERNEL32(00000000,?), ref: 006EF15F

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Process32NextW.KERNEL32(00000000,?), ref: 006EF21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 006EF22E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 8337481f61e7e803c0f603d79f1f9285ac2c7299705372f70be731d13ba1aa55
Instruction ID: 1dc81569ee1050a063337b7479a6a9e1f44df82be4203fb9a213c0b591ca4bcd
Opcode Fuzzy Hash: 8337481f61e7e803c0f603d79f1f9285ac2c7299705372f70be731d13ba1aa55
Instruction Fuzzy Hash: 3B519F71504300AFD350EF24DC85EABB7EAFF94710F10882DF59A97291EB70AA04CB96

Function 006CEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 006CEB19

Strings

|, xrefs: 006CEB49
(, xrefs: 006CEB5F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 384a320f833afe8955fe596f2ecaa697f78dcd434604d3c5e373eb0b0675a6e7
Instruction ID: cc9bf7c42ccdfee1ba25d942fe87663844da286c1f77119877d78f915123e95b
Opcode Fuzzy Hash: 384a320f833afe8955fe596f2ecaa697f78dcd434604d3c5e373eb0b0675a6e7
Instruction Fuzzy Hash: 19323675A006059FDB28CF19C481EAAB7F2FF48310B15C46EE89ADB3A1E771E941CB44

Function 006E25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,006E1AFE,00000000), ref: 006E26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 006E270C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 040668bd45cac2ac57e3fc7c33c3485af0f8233883d63944c10cc6aa6b8b4993
Instruction ID: cd7fefb5b2b0073547777df1c00a0237bdc5943a73de57063bd9fc5b44dba1ef
Opcode Fuzzy Hash: 040668bd45cac2ac57e3fc7c33c3485af0f8233883d63944c10cc6aa6b8b4993
Instruction Fuzzy Hash: 4141C47150134ABFEF20DF96DC95EBBB7BFEB40714F10406EFA01A6240EA719E419654

Function 006DB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006DB5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 006DB608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 006DB655

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: abfc0ddcafb822f5161d10806999659ad236c91138a022af3e82149c27043cb1
Instruction ID: 769c41310f7de4df90a630fc4458792c38a4b22bd2fa7f132a0955452d18602d
Opcode Fuzzy Hash: abfc0ddcafb822f5161d10806999659ad236c91138a022af3e82149c27043cb1
Instruction Fuzzy Hash: E9216035A00118EFCB00EFA5D880EADBBF9FF48310F1480AAE905AB351DB31A915CB55

Function 006C8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00690FF6: std::exception::exception.LIBCMT ref: 0069102C
Part of subcall function 00690FF6: __CxxThrowException@8.LIBCMT ref: 00691041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006C8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006C8D3A
GetLastError.KERNEL32 ref: 006C8D47

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 381da5420b944b7ae5b0047b9fd1277237d440d67f4e4ca759acbe8242d4dc87
Instruction ID: 457e7ed05f9c838860d090fb6f58da694044e33dd508e25375d2e5fff7033416
Opcode Fuzzy Hash: 381da5420b944b7ae5b0047b9fd1277237d440d67f4e4ca759acbe8242d4dc87
Instruction Fuzzy Hash: B7115BB1414209AFE7289F54DC86D7BB7BEEF44710B20852EE85697641EB31AC41CA64

Function 006D4021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 006D404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 006D4088
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 006D4091

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 32ef2155d81dd70bb2138c4306a4a88c07c5a067ab16d14a3631cd14e98b3646
Instruction ID: 1e8c5bb3d0de0dea1d033a3d6c18a0a91399a28cd431e0b9c5625aecccf7ce60
Opcode Fuzzy Hash: 32ef2155d81dd70bb2138c4306a4a88c07c5a067ab16d14a3631cd14e98b3646
Instruction Fuzzy Hash: 42115EB2D00228BBE7109BE89C45FBABBBDEB08710F000656BA04E7290C6745D0587A1

Function 006D4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 006D4C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006D4C43
FreeSid.ADVAPI32(?), ref: 006D4C53

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: d738c825330e84cf8830569856f92e1b7d76dc6eb10f497fe8400d6d5d30a0bb
Instruction ID: 3a6fc91d911e29ace0140377b192a6aebaa427d7b4689c40e33450aa0d18b632
Opcode Fuzzy Hash: d738c825330e84cf8830569856f92e1b7d76dc6eb10f497fe8400d6d5d30a0bb
Instruction Fuzzy Hash: C7F04975A1130CBFDF04DFF4DC99ABEBBBDEF08201F0044A9A901E2281EA706A44CB50

Function 006D8B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 006D8B25

Part of subcall function 0069543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,006D91F8,00000000,?,?,?,?,006D93A9,00000000,?), ref: 00695443
Part of subcall function 0069543A: __aulldiv.LIBCMT ref: 00695463

Strings

0us, xrefs: 006D8B1C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0us
API String ID: 2893107130-1080988087
Opcode ID: ea575deb8c66b2daceb71372249ad38339e9bf6f71b6bc8d6315377301d8505b
Instruction ID: b38903deba7285dd956482a77cbc862375a4aca2d5cdb081ecf3d8a85d131a28
Opcode Fuzzy Hash: ea575deb8c66b2daceb71372249ad38339e9bf6f71b6bc8d6315377301d8505b
Instruction Fuzzy Hash: B621D2726256108FD729CF29D841A52B3E2EBA4311B288E6DD0E5CB2D0CA35B905CB94

Function 0067E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdf128ce8a3cd2ffe7ac8472e51a0cc05a136c19e95924e0e176d2b7b350e6b
Instruction ID: 36c251bdcc117f080977208f589aeefc4251ca910e8ff00f94a426ab4dae6c14
Opcode Fuzzy Hash: 9fdf128ce8a3cd2ffe7ac8472e51a0cc05a136c19e95924e0e176d2b7b350e6b
Instruction Fuzzy Hash: 9022AF74A00216CFDB24DF54C481AEEB7F6FF08314F14C1A9E85A9B351E736A989CB91

Function 006DC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 006DC966
FindClose.KERNEL32(00000000), ref: 006DC996

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: bb66b5e9d65855aa7c264488745da3a7ee91aaa9be47e7c988a846a9b42ad07c
Instruction ID: d40316d603d53349c39b5a297b356b922312e68da7c29ac0e8257422baa6f33b
Opcode Fuzzy Hash: bb66b5e9d65855aa7c264488745da3a7ee91aaa9be47e7c988a846a9b42ad07c
Instruction Fuzzy Hash: 8D118E326002049FDB10EF29C845A2AF7EAEF84320F00851EF9A9DB391DB30AC01CB95

Function 006DA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,006E977D,?,006FFB84,?), ref: 006DA302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,006E977D,?,006FFB84,?), ref: 006DA314

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 6d8b78adb5b5e6c79d06fbc32ff3ccb89f2b291d75f806804003c7b1a726ea92
Instruction ID: 7d6157bf2ba5d2707594dfc4a54e427eacdffcae3cfc5cab46676fb5c05f691d
Opcode Fuzzy Hash: 6d8b78adb5b5e6c79d06fbc32ff3ccb89f2b291d75f806804003c7b1a726ea92
Instruction Fuzzy Hash: 30F0823554822DABDB10AFE4CC48FEA776EBF09761F00816AF908D6281D6309940CBE5

Function 006C8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006C8851), ref: 006C8728
CloseHandle.KERNEL32(?,?,006C8851), ref: 006C873A

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: a91e62c935247b9ab205613935edf71e18ed3e4982514a66e1ebe03661232337
Instruction ID: 34322553927eca91fd9ee7de9d4c119f8faebfa46ff24e626e60f9979abc52ce
Opcode Fuzzy Hash: a91e62c935247b9ab205613935edf71e18ed3e4982514a66e1ebe03661232337
Instruction Fuzzy Hash: CEE04632000601EEEB212B20EC09E777BAEEF00390724892DB4A680830DB22ACD0DB10

Function 0069A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00698F97,?,?,?,00000001), ref: 0069A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0069A3A3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 54ef90e953daa28156c29d6f65ff20810f49494028603d167d60bd41a16c6079
Instruction ID: 8cc9c2593c67a16715a7537d901223cf3461acf85ce684c7193e48a34511cf87
Opcode Fuzzy Hash: 54ef90e953daa28156c29d6f65ff20810f49494028603d167d60bd41a16c6079
Instruction Fuzzy Hash: 44B09232054208ABCB102B91EC09BA83F6BEF44AA2F405020F60D84064CF625450CAD5

Function 0069F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe148dcdf3c5bee27d61625799885f2dc018109738cdac6943139587bfc850e
Instruction ID: 4908d35f47d1998c3673ed9b14da5d765866276ff5a4733b986dca82b4b324b2
Opcode Fuzzy Hash: afe148dcdf3c5bee27d61625799885f2dc018109738cdac6943139587bfc850e
Instruction Fuzzy Hash: 13320262D29F018DDB279634D832326A28DAFB73C4F15D737E819B5EA6EF29D4834104

Function 006A267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37537436348c353d248ec3456fc1ce11ff2799a2439a3ee4addf1c5aaf9a1bc
Instruction ID: 75f8e2a4bf85ee647c167c77f9a1ff7262e0704aebd807a4da8232172726dc38
Opcode Fuzzy Hash: f37537436348c353d248ec3456fc1ce11ff2799a2439a3ee4addf1c5aaf9a1bc
Instruction Fuzzy Hash: 81B1FF20D2AF418DD723A6398831336FA5CAFBB2D9F51D71BFC2670D62EB2585834145

Function 006E41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 006E4218

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 6c905180ec137fcfd5e935ca0f15388d47e66ef4de29e75c781d879ba9737026
Instruction ID: 8e37aebef3959d0a2681582ba021bbdc674255fe241693d0cbbb03e932a2de4f
Opcode Fuzzy Hash: 6c905180ec137fcfd5e935ca0f15388d47e66ef4de29e75c781d879ba9737026
Instruction Fuzzy Hash: 29E04F312402149FC710EF6AD844A9AF7EAAF94760F00C02AFD49C7352DE71E945CBA0

Function 006D4EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 006D4F18

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 5ea1d74a6648c17939fb691d4d01a217b0dcb740ea87235d379ab37a071de228
Instruction ID: d36e01396c12c9a80254cb473834fa3d2955a8f91eb784c4218fdb4fdd94723c
Opcode Fuzzy Hash: 5ea1d74a6648c17939fb691d4d01a217b0dcb740ea87235d379ab37a071de228
Instruction Fuzzy Hash: 80D05EF09642053BFC284B20AC0FFB6020BE3C0781F84598B3201897E19CF16C01E038

Function 006C8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,006C88D1), ref: 006C8CB3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: e2a5997e3664e01f8a507f07f16ef3e035c54b51436e7d7848a2d8569feba405
Instruction ID: 68f7dc1e39a8cea8a715e82e486462af8185abb0cf24f91ef8e5787956ba9689
Opcode Fuzzy Hash: e2a5997e3664e01f8a507f07f16ef3e035c54b51436e7d7848a2d8569feba405
Instruction Fuzzy Hash: B7D05E3226050EABEF018FA8DC01EBE3B6AEB04B01F408111FE15C50A1C775D835EB60

Function 006B2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006B2242

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: be45faf218987cdfcb126e3ac658571e4ba16b0ead39308351c0bbe24f0c7898
Instruction ID: 1a1596d63415dce1ffc6ef6afa496027b7163be78657fee93afb73a3eb53c9c1
Opcode Fuzzy Hash: be45faf218987cdfcb126e3ac658571e4ba16b0ead39308351c0bbe24f0c7898
Instruction Fuzzy Hash: E7C04CF1810109EBDB05DB90D998DFE77BDAB05304F104055A101F2100DB749B44CF71

Function 0069A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0069A36A

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e4e622103c1a552195955e5f537f634b57d9409eb8fdcec1e3b70811428a3981
Instruction ID: 2368ce59db3f11b152140def0b982337ce8f7e29373e245c014616476a1faf3a
Opcode Fuzzy Hash: e4e622103c1a552195955e5f537f634b57d9409eb8fdcec1e3b70811428a3981
Instruction Fuzzy Hash: 65A0113200020CAB8B002B82EC088A8BFAEEA002A0B008020F80C800228F32A8208AC0

Function 00688A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54eaa2b327ce64da49d49a06f56053cfe0bc520e683f5205ee3c936026f6c73a
Instruction ID: 16ec8f7f4bca3aefc18a7ea18e3b8544c533ef3321c504d2e73ee163a05b1725
Opcode Fuzzy Hash: 54eaa2b327ce64da49d49a06f56053cfe0bc520e683f5205ee3c936026f6c73a
Instruction Fuzzy Hash: 57220730501655CFDF38AB19C894BBD77A3EB41340FA4866AD4478B396DB38ADC2CB61

Function 00692405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 32c1e3ad7dab94bf39124aa34cacd25c2694deaf87f9a0cad1951523131fb338
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 7AC196322050530ADF1D4639D4741BEBAEA5EA37B132A075DE4B3DFAC5EF20D564D620

Function 0069283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 6e3889ba4d1a65a662c7f4234af5aae71342442bb45aa2e4af1b5bc88d02b15d
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 87C1963320519309DF6D463AD4740BEBBEA5AA37B131A075DE4B2DFAD4EF20D524E620

Function 006FA849 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 006FA89F
GetSysColorBrush.USER32(0000000F), ref: 006FA8D0
GetSysColor.USER32(0000000F), ref: 006FA8DC
SetBkColor.GDI32(?,000000FF), ref: 006FA8F6
SelectObject.GDI32(?,?), ref: 006FA905
InflateRect.USER32(?,000000FF,000000FF), ref: 006FA930
GetSysColor.USER32(00000010), ref: 006FA938
CreateSolidBrush.GDI32(00000000), ref: 006FA93F
FrameRect.USER32(?,?,00000000), ref: 006FA94E
DeleteObject.GDI32(00000000), ref: 006FA955
InflateRect.USER32(?,000000FE,000000FE), ref: 006FA9A0
FillRect.USER32(?,?,?), ref: 006FA9D2
GetWindowLongW.USER32(?,000000F0), ref: 006FA9FD

Part of subcall function 006FAB60: GetSysColor.USER32(00000012), ref: 006FAB99
Part of subcall function 006FAB60: SetTextColor.GDI32(?,?), ref: 006FAB9D
Part of subcall function 006FAB60: GetSysColorBrush.USER32(0000000F), ref: 006FABB3
Part of subcall function 006FAB60: GetSysColor.USER32(0000000F), ref: 006FABBE
Part of subcall function 006FAB60: GetSysColor.USER32(00000011), ref: 006FABDB
Part of subcall function 006FAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 006FABE9
Part of subcall function 006FAB60: SelectObject.GDI32(?,00000000), ref: 006FABFA
Part of subcall function 006FAB60: SetBkColor.GDI32(?,00000000), ref: 006FAC03
Part of subcall function 006FAB60: SelectObject.GDI32(?,?), ref: 006FAC10
Part of subcall function 006FAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 006FAC2F
Part of subcall function 006FAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006FAC46
Part of subcall function 006FAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 006FAC5B

Strings

@U=u, xrefs: 006FAA4E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID: @U=u
API String ID: 4124339563-2594219639
Opcode ID: 173152dc3a4e81e2ffd407860782f33294776c975129b90249cb0623ff736960
Instruction ID: ab9374e524d46e26bd6f8fd4184e3f243f4821a2a07b04192c883baaac3474d2
Opcode Fuzzy Hash: 173152dc3a4e81e2ffd407860782f33294776c975129b90249cb0623ff736960
Instruction Fuzzy Hash: 70A191B2008305BFD7109F64DC08E7B7BAAFF89321F105A29FA66962A0D771D945CB52

Function 006F37F3 Relevance: 52.9, APIs: 6, Strings: 24, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,006FF910), ref: 006F38AF
IsWindowVisible.USER32(?), ref: 006F38D3

Strings

CHECK, xrefs: 006F3AF5
SHOWDROPDOWN, xrefs: 006F3968
CURRENTTAB, xrefs: 006F3945
DELSTRING, xrefs: 006F39D1
UNCHECK, xrefs: 006F3B0B
ISVISIBLE, xrefs: 006F38BF
GETLINE, xrefs: 006F3C23
SELECTSTRING, xrefs: 006F3A8E
EDITPASTE, xrefs: 006F3BE7
TABLEFT, xrefs: 006F390F
GETCURRENTSELECTION, xrefs: 006F3A6B
GETLINECOUNT, xrefs: 006F3B4E
GETCURRENTLINE, xrefs: 006F3B75
TABRIGHT, xrefs: 006F3925
@U=u, xrefs: 006F3B6B, 006F3B92, 006F3C1B
FINDSTRING, xrefs: 006F39FE
ADDSTRING, xrefs: 006F399E
HIDEDROPDOWN, xrefs: 006F3988
ISENABLED, xrefs: 006F38F3
SENDCOMMANDID, xrefs: 006F3C62
GETSELECTED, xrefs: 006F3B2B
ISCHECKED, xrefs: 006F3AC1
GETCURRENTCOL, xrefs: 006F3BB0
SETCURRENTSELECTION, xrefs: 006F3A3E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: @U=u$ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-3469695742
Opcode ID: eb768091788776c517f3771e3d9e77f334d95cfb712395203c3aad22492c6e9b
Instruction ID: c4460383cdddf35428f66dbe841c4fd7d83e12c57642aca8377c0cb9cb9946a5
Opcode Fuzzy Hash: eb768091788776c517f3771e3d9e77f334d95cfb712395203c3aad22492c6e9b
Instruction Fuzzy Hash: EBD19E302043299FCB54EF14C491ABA77A7EF94344F10846CB9865B3A2CB35EE4BCB95

Function 00672C18 Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00672CA2
DeleteObject.GDI32(00000000), ref: 00672CE8
DeleteObject.GDI32(00000000), ref: 00672CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00672CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00672D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 006AC68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 006AC6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 006ACAED

Part of subcall function 00671B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00672036,?,00000000,?,?,?,?,006716CB,00000000,?), ref: 00671B9A

SendMessageW.USER32(?,00001053), ref: 006ACB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 006ACB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 006ACB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 006ACB62

Strings

@U=u, xrefs: 006AC68B, 006AC792, 006ACA6D
0, xrefs: 006AC981

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0$@U=u
API String ID: 464785882-975001249
Opcode ID: 767544565447a09bd92a4f22bb2b2a2bbdbc9c9d1f5d8882655e57ae609f5be9
Instruction ID: 98e14e48d7621d8441d8e999733504a6aaf462420d1d424c254de67680c0c9e4
Opcode Fuzzy Hash: 767544565447a09bd92a4f22bb2b2a2bbdbc9c9d1f5d8882655e57ae609f5be9
Instruction Fuzzy Hash: 7C12AF30604202EFDB51DF24C894BA9BBE6FF56320F548569E599DB262C731EC42CF91

Function 006E77BE Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 006E77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 006E78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 006E78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 006E7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 006E7946
GetClientRect.USER32(00000000,?), ref: 006E7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 006E7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 006E79A5
GetStockObject.GDI32(00000011), ref: 006E79B5
SelectObject.GDI32(00000000,00000000), ref: 006E79B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 006E79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006E79D2
DeleteDC.GDI32(00000000), ref: 006E79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006E7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 006E7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 006E7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 006E7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 006E7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 006E7AAE
GetStockObject.GDI32(00000011), ref: 006E7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 006E7AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 006E7ACE

Strings

msctls_progress32, xrefs: 006E7A4F
static, xrefs: 006E7990, 006E7AA8
@U=u, xrefs: 006E7A0D
DISPLAY, xrefs: 006E799B
AutoIt v3, xrefs: 006E793E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: @U=u$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2771358697
Opcode ID: aaf56851497a1a620299fe14ffbe79217c9dbfef9bd75464be64edd0dd15a712
Instruction ID: 747f41f3520ca2a325479276a1cdcc5b42ca747a56183bb2705b2945463c2fab
Opcode Fuzzy Hash: aaf56851497a1a620299fe14ffbe79217c9dbfef9bd75464be64edd0dd15a712
Instruction Fuzzy Hash: F6A16F71A40215BFEB14DBA4DC4AFAF7BAAEF44711F018118FA15A72E0DB74AD00CB64

Function 006FAB60 Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 006FAB99
SetTextColor.GDI32(?,?), ref: 006FAB9D
GetSysColorBrush.USER32(0000000F), ref: 006FABB3
GetSysColor.USER32(0000000F), ref: 006FABBE
CreateSolidBrush.GDI32(?), ref: 006FABC3
GetSysColor.USER32(00000011), ref: 006FABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 006FABE9
SelectObject.GDI32(?,00000000), ref: 006FABFA
SetBkColor.GDI32(?,00000000), ref: 006FAC03
SelectObject.GDI32(?,?), ref: 006FAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 006FAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006FAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 006FAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 006FACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 006FACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 006FACEC
DrawFocusRect.USER32(?,?), ref: 006FACF7
GetSysColor.USER32(00000011), ref: 006FAD05
SetTextColor.GDI32(?,00000000), ref: 006FAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 006FAD21
SelectObject.GDI32(?,006FA869), ref: 006FAD38
DeleteObject.GDI32(?), ref: 006FAD43
SelectObject.GDI32(?,?), ref: 006FAD49
DeleteObject.GDI32(?), ref: 006FAD4E
SetTextColor.GDI32(?,?), ref: 006FAD54
SetBkColor.GDI32(?,?), ref: 006FAD5E

Strings

@U=u, xrefs: 006FACA7

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID: @U=u
API String ID: 1996641542-2594219639
Opcode ID: b59898aac9c3926d95565aeed92c828f17042768fee44b5118bb86d2a4a80df2
Instruction ID: c217d9827507d4e898cf5b13fffd436ad2e32ed0119392d452512629e93cb584
Opcode Fuzzy Hash: b59898aac9c3926d95565aeed92c828f17042768fee44b5118bb86d2a4a80df2
Instruction Fuzzy Hash: D8612BB1900218EFDF11DFA8DC49EBE7B7AFF09320F109125FA15AB2A1D6759940DB90

Function 006DAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006DAF89
GetDriveTypeW.KERNEL32(?,006FFAC0,?,\\.\,006FF910), ref: 006DB066
SetErrorMode.KERNEL32(00000000,006FFAC0,?,\\.\,006FF910), ref: 006DB1C4

Strings

Network, xrefs: 006DB0A4
Virtual, xrefs: 006DB18C
RAID, xrefs: 006DB162
SSA, xrefs: 006DB14D
SATA, xrefs: 006DB177
iSCSI, xrefs: 006DB169
Fibre, xrefs: 006DB154
USB, xrefs: 006DB15B
ATAPI, xrefs: 006DB138
CDROM, xrefs: 006DB09A
SCSI, xrefs: 006DB131
Unknown, xrefs: 006DB086, 006DB12A
ATA, xrefs: 006DB13F
Removable, xrefs: 006DB0B8
Fixed, xrefs: 006DB0AE
MMC, xrefs: 006DB185
PhysicalDrive, xrefs: 006DB012
\\.\, xrefs: 006DAFDB
1394, xrefs: 006DB146
FileBackedVirtual, xrefs: 006DB193
SSD, xrefs: 006DB0F1
RAMDisk, xrefs: 006DB090
SAS, xrefs: 006DB170

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 34bf58a62465065c26cbd87b08898f457dbf6498d3e449f08742270864b0c173
Instruction ID: 6a1df11559d7646f1fac6e62a6e38f86a70252b708dfa8d08f7afbe2a549a57b
Opcode Fuzzy Hash: 34bf58a62465065c26cbd87b08898f457dbf6498d3e449f08742270864b0c173
Instruction Fuzzy Hash: 9D51BF70E84305EB8F00DB10DD92DBD73B3EB54741B22902BE41AA7395CB799D42DB5A

Function 00676A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00676A91
__wcsnicmp.LIBCMT ref: 00676AA9
__wcsnicmp.LIBCMT ref: 00676AC1
__wcsnicmp.LIBCMT ref: 00676AD9
__wcsnicmp.LIBCMT ref: 00676AF1
__wcsnicmp.LIBCMT ref: 00676B09
__wcsnicmp.LIBCMT ref: 00676B21
__wcsnicmp.LIBCMT ref: 00676B35
__wcsnicmp.LIBCMT ref: 00676B76
__wcsnicmp.LIBCMT ref: 00676B8A
__wcsnicmp.LIBCMT ref: 00676B9E
__wcsnicmp.LIBCMT ref: 00676BB2

Strings

Cannot parse #include, xrefs: 006AE819
#comments-start, xrefs: 00676B1B, 00676B70
#comments-end, xrefs: 00676B98
Unterminated group of comments, xrefs: 006AE82C
Bad directive syntax error, xrefs: 006AE743
#requireadmin, xrefs: 00676ABB
#cs, xrefs: 00676B2F, 00676B84
#ce, xrefs: 00676BAC
#include, xrefs: 00676B03
#include-once, xrefs: 00676AEB
#notrayicon, xrefs: 00676AA3
#pragma compile, xrefs: 00676A8B
#OnAutoItStartRegister, xrefs: 00676AD3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 9f887c96118a54acc803dc595980c0e8a5f3ead6e22e98651c12f779092773ca
Instruction ID: 2f8c2f95e2e07aaa12897e489bd5609f6ed979393c1822ae846482f6b81bad77
Opcode Fuzzy Hash: 9f887c96118a54acc803dc595980c0e8a5f3ead6e22e98651c12f779092773ca
Instruction Fuzzy Hash: 32812C71600615BBCF60BB64CC82FEE779FAF12700F148029F949AA2C2EB61DE55C655

Function 006F8C44 Relevance: 40.7, APIs: 21, Strings: 2, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 006F8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006F8D45
CharNextW.USER32(0000014E), ref: 006F8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 006F8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 006F8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006F8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 006F8DF9
SetWindowTextW.USER32(?,0000014E), ref: 006F8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 006F8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 006F8E8C
_memset.LIBCMT ref: 006F8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 006F8EFA
_memset.LIBCMT ref: 006F8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 006F8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 006F8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 006F9088
InvalidateRect.USER32(?,00000000,00000001), ref: 006F90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 006F90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 006F9121
DrawMenuBar.USER32(?), ref: 006F9130
SetWindowTextW.USER32(?,0000014E), ref: 006F9158

Strings

@U=u, xrefs: 006F8D34, 006F8D45, 006F8D7A, 006F8DF9, 006F8E5B, 006F8E8C, 006F8EFA, 006F8F83, 006F8FDB, 006F9088
0, xrefs: 006F90C2

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0$@U=u
API String ID: 1073566785-975001249
Opcode ID: 504328522755c0c73ab381db78927dc7ea05c4de78fba618088871a62182d3d4
Instruction ID: 5b646adfdf98cfd94c7fe7a34d65de07e8f7c312baf415de9e3075fd4fb9d612
Opcode Fuzzy Hash: 504328522755c0c73ab381db78927dc7ea05c4de78fba618088871a62182d3d4
Instruction Fuzzy Hash: 89E16F7090121DAEDF20DF64CC88AFE7BBAEF05710F108199FA159B291DB748A81DF65

Function 006F4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006F4C51
GetDesktopWindow.USER32 ref: 006F4C66
GetWindowRect.USER32(00000000), ref: 006F4C6D
GetWindowLongW.USER32(?,000000F0), ref: 006F4CCF
DestroyWindow.USER32(?), ref: 006F4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 006F4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006F4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 006F4D68
SendMessageW.USER32(?,00000421,?,?), ref: 006F4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 006F4D90
IsWindowVisible.USER32(?), ref: 006F4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 006F4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 006F4DDF
GetWindowRect.USER32(?,?), ref: 006F4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 006F4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 006F4E37
CopyRect.USER32(?,?), ref: 006F4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 006F4EB9

Strings

(, xrefs: 006F4E2A
tooltips_class32, xrefs: 006F4D1D
0, xrefs: 006F4BFC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 508c950a7c6672be29b0e8afc9f18f21184935796d249e0107816f8d6eab4c71
Instruction ID: 819ad8ab6201c582dbb42b32e6780ad7d83b49a40257ccab9c2892c7645bd211
Opcode Fuzzy Hash: 508c950a7c6672be29b0e8afc9f18f21184935796d249e0107816f8d6eab4c71
Instruction Fuzzy Hash: 90B15771608341AFDB44DF64C845B6BBBE6BF88314F00891CF6999B2A1DB71EC05CBA5

Function 006D46D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 006D46E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 006D470E
_wcscpy.LIBCMT ref: 006D473C
_wcscmp.LIBCMT ref: 006D4747
_wcscat.LIBCMT ref: 006D475D
_wcsstr.LIBCMT ref: 006D4768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 006D4784
_wcscat.LIBCMT ref: 006D47CD
_wcscat.LIBCMT ref: 006D47D4
_wcsncpy.LIBCMT ref: 006D47FF

Strings

04090000, xrefs: 006D47BA
\VarFileInfo\Translation, xrefs: 006D477C
StringFileInfo\, xrefs: 006D4757
DefaultLangCodepage, xrefs: 006D47E7
%u.%u.%u.%u, xrefs: 006D4862

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 38db2cdb9bb70fd54934854b89d93775eea67f8ddd1c04f9d4954d1b126f4412
Instruction ID: c124fc04cb85361dd1ef1eb18c261f00d1d8481ea327745639169256848dff38
Opcode Fuzzy Hash: 38db2cdb9bb70fd54934854b89d93775eea67f8ddd1c04f9d4954d1b126f4412
Instruction Fuzzy Hash: 0941F572A00215BBDF10B7649C43EBF77AEEF42750F10016AF905E6682EF35DA0196A9

Function 006727D9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006728BC
GetSystemMetrics.USER32(00000007), ref: 006728C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006728EF
GetSystemMetrics.USER32(00000008), ref: 006728F7
GetSystemMetrics.USER32(00000004), ref: 0067291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00672939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00672949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0067297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00672990
GetClientRect.USER32(00000000,000000FF), ref: 006729AE
GetStockObject.GDI32(00000011), ref: 006729CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 006729D5

Part of subcall function 00672344: GetCursorPos.USER32(?), ref: 00672357
Part of subcall function 00672344: ScreenToClient.USER32(007367B0,?), ref: 00672374
Part of subcall function 00672344: GetAsyncKeyState.USER32(00000001), ref: 00672399
Part of subcall function 00672344: GetAsyncKeyState.USER32(00000002), ref: 006723A7

SetTimer.USER32(00000000,00000000,00000028,00671256), ref: 006729FC

Strings

@U=u, xrefs: 006729D5
AutoIt v3 GUI, xrefs: 00672974

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: @U=u$AutoIt v3 GUI
API String ID: 1458621304-2077007950
Opcode ID: 7564753e80ca5ba4ef0be1f19860318d101d3febf95fda2bf18ba42647d1e675
Instruction ID: d3118d01cb0730b5964e0d46826aafd961ca142c409706b682ad896c981f795b
Opcode Fuzzy Hash: 7564753e80ca5ba4ef0be1f19860318d101d3febf95fda2bf18ba42647d1e675
Instruction Fuzzy Hash: EEB14B71A0020AAFDB14DFA8DC55BEE7BB6FF08315F108129FA19E6290DB74A841CB55

Function 006CC4C1 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 006CC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 006CC4E6
SetWindowTextW.USER32(?,?), ref: 006CC4FD
GetDlgItem.USER32(?,000003EA), ref: 006CC512
SetWindowTextW.USER32(00000000,?), ref: 006CC518
GetDlgItem.USER32(?,000003E9), ref: 006CC528
SetWindowTextW.USER32(00000000,?), ref: 006CC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 006CC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 006CC569
GetWindowRect.USER32(?,?), ref: 006CC572
SetWindowTextW.USER32(?,?), ref: 006CC5DD
GetDesktopWindow.USER32 ref: 006CC5E3
GetWindowRect.USER32(00000000), ref: 006CC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 006CC636
GetClientRect.USER32(?,?), ref: 006CC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 006CC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 006CC693

Strings

@U=u, xrefs: 006CC4E6

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @U=u
API String ID: 3869813825-2594219639
Opcode ID: 05285a1aa256936b8503f009ca8403d0457344e07be7d4d4dec2d0041696bd0e
Instruction ID: e19b1a11b27ab8363ddf1bf8dbf4ac8376aa826885400e9e395435c222bae53d
Opcode Fuzzy Hash: 05285a1aa256936b8503f009ca8403d0457344e07be7d4d4dec2d0041696bd0e
Instruction Fuzzy Hash: 2B516E70900709AFDB209FA8DD85FBEBBF6FF04715F00452CE686A26A0CB74A915CB50

Function 006F4069 Relevance: 30.0, APIs: 3, Strings: 14, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006F40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 006F41B6

Strings

VIEWCHANGE, xrefs: 006F4375
SELECTINVERT, xrefs: 006F4286
FINDITEM, xrefs: 006F4329
ISSELECTED, xrefs: 006F41C1
DESELECT, xrefs: 006F42A4
SELECTCLEAR, xrefs: 006F4235
SELECTALL, xrefs: 006F421D
@U=u, xrefs: 006F41B6, 006F41E8
GETSUBITEMCOUNT, xrefs: 006F4141
GETSELECTEDCOUNT, xrefs: 006F4199
GETITEMCOUNT, xrefs: 006F4128
SELECT, xrefs: 006F4250
GETSELECTED, xrefs: 006F42E4
GETTEXT, xrefs: 006F415F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: @U=u$DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-1753161424
Opcode ID: 5afce2045bf5a41983bb3fba844dc9087acdd7d6247e43fcb485f20578dee424
Instruction ID: 1ed469220ddf8947eb27cad8f8efa67c37274449ae45456c224f4b3185a4eb32
Opcode Fuzzy Hash: 5afce2045bf5a41983bb3fba844dc9087acdd7d6247e43fcb485f20578dee424
Instruction Fuzzy Hash: D7A19C302142159FCB54EF24C841A7AB3E7BF84314F14886CB99A9BB92DF30ED0ACB55

Function 006FC8EE Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

DragQueryPoint.SHELL32(?,?), ref: 006FC917

Part of subcall function 006FADF1: ClientToScreen.USER32(?,?), ref: 006FAE1A
Part of subcall function 006FADF1: GetWindowRect.USER32(?,?), ref: 006FAE90
Part of subcall function 006FADF1: PtInRect.USER32(?,?,006FC304), ref: 006FAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 006FC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 006FC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 006FC9AE
_wcscat.LIBCMT ref: 006FC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 006FC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 006FCA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 006FCA25
SendMessageW.USER32(?,000000B1,?,?), ref: 006FCA47
DragFinish.SHELL32(?), ref: 006FCA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 006FCB41

Strings

@GUI_DRAGID, xrefs: 006FCAB9
@U=u, xrefs: 006FC980, 006FC9F5, 006FCA0E, 006FCA25, 006FCA47
@GUI_DROPID, xrefs: 006FCA6E
prs, xrefs: 006FCA8B
@GUI_DRAGFILE, xrefs: 006FCAF0

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$@U=u$prs
API String ID: 169749273-2419492147
Opcode ID: fc19be568b5eb3800c3722f7f0bea8bbe3ac7694e29c115c3fe3deb844647bc5
Instruction ID: a819cb79fcf3599f8c7952da769579902b4f31cd6e68be9e1cc00b5155a8d531
Opcode Fuzzy Hash: fc19be568b5eb3800c3722f7f0bea8bbe3ac7694e29c115c3fe3deb844647bc5
Instruction Fuzzy Hash: 05618A71108304AFC700EF64DC85DAFBBEAEF89710F00492EF695931A1DB709A49CB66

Function 006E52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 006E5309
LoadCursorW.USER32(00000000,00007F8A), ref: 006E5314
LoadCursorW.USER32(00000000,00007F00), ref: 006E531F
LoadCursorW.USER32(00000000,00007F03), ref: 006E532A
LoadCursorW.USER32(00000000,00007F8B), ref: 006E5335
LoadCursorW.USER32(00000000,00007F01), ref: 006E5340
LoadCursorW.USER32(00000000,00007F81), ref: 006E534B
LoadCursorW.USER32(00000000,00007F88), ref: 006E5356
LoadCursorW.USER32(00000000,00007F80), ref: 006E5361
LoadCursorW.USER32(00000000,00007F86), ref: 006E536C
LoadCursorW.USER32(00000000,00007F83), ref: 006E5377
LoadCursorW.USER32(00000000,00007F85), ref: 006E5382
LoadCursorW.USER32(00000000,00007F82), ref: 006E538D
LoadCursorW.USER32(00000000,00007F84), ref: 006E5398
LoadCursorW.USER32(00000000,00007F04), ref: 006E53A3
LoadCursorW.USER32(00000000,00007F02), ref: 006E53AE
GetCursorInfo.USER32(?), ref: 006E53BE
GetLastError.KERNEL32(00000001,00000000), ref: 006E53E9

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: f372270ed54bb73702953917eed7dbde17f1da2a8ce6b83099a27e901638a1c8
Instruction ID: 20aa910c430cd9153fecba79c3bd97a41890fde9b3371435759f787d84c46026
Opcode Fuzzy Hash: f372270ed54bb73702953917eed7dbde17f1da2a8ce6b83099a27e901638a1c8
Instruction Fuzzy Hash: B4417170E04319AADB109FBA8C49D6EFFF9EF51B10B10452FB509E7291DAB8A401CE65

Function 006CAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 006CAAA5
__swprintf.LIBCMT ref: 006CAB46
_wcscmp.LIBCMT ref: 006CAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 006CABAE
_wcscmp.LIBCMT ref: 006CABEA
GetClassNameW.USER32(?,?,00000400), ref: 006CAC21
GetDlgCtrlID.USER32(?), ref: 006CAC73
GetWindowRect.USER32(?,?), ref: 006CACA9
GetParent.USER32(?), ref: 006CACC7
ScreenToClient.USER32(00000000), ref: 006CACCE
GetClassNameW.USER32(?,?,00000100), ref: 006CAD48
_wcscmp.LIBCMT ref: 006CAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 006CAD82
_wcscmp.LIBCMT ref: 006CAD96

Part of subcall function 0069386C: _iswctype.LIBCMT ref: 00693874

Strings

%s%u, xrefs: 006CAB40

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 14953e37895103a85b295d356e323b34b3028f2e958688d2674fea3f0b016815
Instruction ID: b246d5c1c9f3c5fe7decfb80b74cb226f822f2dddc95437ace4be296f7f90e58
Opcode Fuzzy Hash: 14953e37895103a85b295d356e323b34b3028f2e958688d2674fea3f0b016815
Instruction Fuzzy Hash: A5A1B07160420AABD714DFA4C884FFAF7AAFF04319F00462DF99AC2650DB30E945CB92

Function 006CB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 006CB3DB
_wcscmp.LIBCMT ref: 006CB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 006CB414
CharUpperBuffW.USER32(?,00000000), ref: 006CB431
_wcscmp.LIBCMT ref: 006CB44F
_wcsstr.LIBCMT ref: 006CB460
GetClassNameW.USER32(00000018,?,00000400), ref: 006CB498
_wcscmp.LIBCMT ref: 006CB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 006CB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 006CB518
_wcscmp.LIBCMT ref: 006CB528
GetClassNameW.USER32(00000010,?,00000400), ref: 006CB550
GetWindowRect.USER32(00000004,?), ref: 006CB5B9

Strings

ThumbnailClass, xrefs: 006CB4A3, 006CB523
@, xrefs: 006CB3BC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 3c2782d0c5c147578ca33a23398f301e3796d34d787f29b59d44f7bd04eb6cdc
Instruction ID: 07a8d506dcea4b26026829ce50d06cb896bab9053e0228c5cb3a7c2ee9ce1fea
Opcode Fuzzy Hash: 3c2782d0c5c147578ca33a23398f301e3796d34d787f29b59d44f7bd04eb6cdc
Instruction Fuzzy Hash: 4081B0710083059BDB04DF10D886FBAB7EAEF44314F08A56EFD898A296DB34DD45CBA1

Function 006FA428 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006FA4C8
DestroyWindow.USER32(?,?), ref: 006FA542

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 006FA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 006FA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006FA5F1
DestroyWindow.USER32(00000000), ref: 006FA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00670000,00000000), ref: 006FA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006FA663
GetDesktopWindow.USER32 ref: 006FA67C
GetWindowRect.USER32(00000000), ref: 006FA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 006FA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 006FA6B3

Part of subcall function 006725DB: GetWindowLongW.USER32(?,000000EB), ref: 006725EC

Strings

@U=u, xrefs: 006FA5DE, 006FA5F1, 006FA663, 006FA68D
0, xrefs: 006FA4DE
tooltips_class32, xrefs: 006FA5B5, 006FA643

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$@U=u$tooltips_class32
API String ID: 1297703922-1130792468
Opcode ID: 507135eb4fe8260fba9ec1319cd1a41a7db0da8581494315e5ba91d0b47b6cb4
Instruction ID: 3a4788bb07af6ff161354b449fd4903203a17ba5a6d423e82a2423a1f055fffd
Opcode Fuzzy Hash: 507135eb4fe8260fba9ec1319cd1a41a7db0da8581494315e5ba91d0b47b6cb4
Instruction Fuzzy Hash: 19716CB1144209AFE720DF68CC45FB677E6EB88304F08852DFA89873A1D775A902CB16

Function 006CB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 006CB23F

Strings

HANDLE=, xrefs: 006CB238
[CLASS:, xrefs: 006CB28F
[REGEXPTITLE:, xrefs: 006CB267
ACTIVE, xrefs: 006CB21A
LAST, xrefs: 006CB204
ALL, xrefs: 006CB2D3
[LAST, xrefs: 006CB2EC
[ALL, xrefs: 006CB2E5
REGEXP=, xrefs: 006CB254
[HANDLE:, xrefs: 006CB24B
CLASSNAME=, xrefs: 006CB27C
[ACTIVE, xrefs: 006CB22C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: a76daae7acea918ff513d0664f75f3de7bec5f102394e544d6b0e8bc342e9278
Instruction ID: 7f86ca2a62b623cfe76fb4a7297003a4845b9a64e738f7c4e4d4431699ef44a7
Opcode Fuzzy Hash: a76daae7acea918ff513d0664f75f3de7bec5f102394e544d6b0e8bc342e9278
Instruction Fuzzy Hash: D331EE70A44325A6DB14FA60DD43FFE77AAEF20750F64402CB909721E2EF696F04C599

Function 006F4619 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006F46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 006F46F6

Strings

CHECK, xrefs: 006F4716
@U=u, xrefs: 006F46F6
COLLAPSE, xrefs: 006F473C
GETITEMCOUNT, xrefs: 006F47D8
UNCHECK, xrefs: 006F48D2
EXPAND, xrefs: 006F47A8
SELECT, xrefs: 006F48A7
GETTOTALCOUNT, xrefs: 006F46DD
EXISTS, xrefs: 006F475F
GETSELECTED, xrefs: 006F4806
ISCHECKED, xrefs: 006F4879
GETTEXT, xrefs: 006F4849

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: @U=u$CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-383632319
Opcode ID: 53bf3145203bdcd736bce53d7e0ead8838a9c8a516a42d19080f342af41b06d0
Instruction ID: 35a94c3a4cea3b03a7b91087dad940f7d0279a14ff4de21aacebe8394f504dce
Opcode Fuzzy Hash: 53bf3145203bdcd736bce53d7e0ead8838a9c8a516a42d19080f342af41b06d0
Instruction Fuzzy Hash: BF9177302043058FCB44EF24C451A7AB7E7AF84354F04886CB99A5BBA2DB34ED4ACB95

Function 006FBAB8 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 006FBB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,006F6D80,?), ref: 006FBBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 006FBC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 006FBC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 006FBC7D
FreeLibrary.KERNEL32(?), ref: 006FBC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 006FBC99
DestroyIcon.USER32(?), ref: 006FBCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 006FBCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 006FBCD1

Part of subcall function 0069313D: __wcsicmp_l.LIBCMT ref: 006931C6

Strings

@U=u, xrefs: 006FBCB1
.icl, xrefs: 006FBAE4
.exe, xrefs: 006FBB04
.dll, xrefs: 006FBB27

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl$@U=u
API String ID: 1212759294-1639919054
Opcode ID: d91925bbef46d34d6f71448a04614bb7b6ae3171c9b6befe109904b38c299b63
Instruction ID: 6a169841bc88f3582aadf0259d6d6ca11e4d108877cce7edf86dd2baf829a65d
Opcode Fuzzy Hash: d91925bbef46d34d6f71448a04614bb7b6ae3171c9b6befe109904b38c299b63
Instruction Fuzzy Hash: 2A619F71500219BAEB14DF64DC85FFA7BAEFF08710F105119FA15D62D1DB74A990CBA0

Function 006DA0B5 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,006FFB78), ref: 006DA0FC

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 006DA11E
__swprintf.LIBCMT ref: 006DA177
__swprintf.LIBCMT ref: 006DA190
_wprintf.LIBCMT ref: 006DA246
_wprintf.LIBCMT ref: 006DA264

Strings

Line %d (File "%s"):, xrefs: 006DA171, 006DA18A
%p, xrefs: 006DA0C9
"%s" (%d) : ==> %s:%s%s, xrefs: 006DA241
^ ERROR, xrefs: 006DA1E8
"%s" (%d) : ==> %s:, xrefs: 006DA25F
Error: , xrefs: 006DA20E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%p
API String ID: 311963372-902205313
Opcode ID: cce2dab04582d7d41401d2d710f752aeda67207d2bf56499c7289ff0e8986bd5
Instruction ID: c510541ec273bbe490cfe10c2e8a4c32e710c5e3aa98bce060dc988e50b4a21e
Opcode Fuzzy Hash: cce2dab04582d7d41401d2d710f752aeda67207d2bf56499c7289ff0e8986bd5
Instruction Fuzzy Hash: BC519071C04219BACF55EBE0CD82EEEB77AEF04300F148169F509621A1EB356F48DB55

Function 006DA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

CharLowerBuffW.USER32(?,?), ref: 006DA636
GetDriveTypeW.KERNEL32 ref: 006DA683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006DA6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006DA702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006DA730

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

Strings

open, xrefs: 006DA65D
open , xrefs: 006DA692
type cdaudio alias cd wait, xrefs: 006DA6AE
closed, xrefs: 006DA64A, 006DA653
close, xrefs: 006DA63C
set cd door , xrefs: 006DA6D1
close cd wait, xrefs: 006DA71B
wait, xrefs: 006DA6ED

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 59afed8e417963b9b3247682a9333f508ebb69d518c5f9af064c9dd88a7177d7
Instruction ID: 10c668d6c0c8444372357078f25bf697c2dc11ade7c7b6f5d4ea7ce841278f5b
Opcode Fuzzy Hash: 59afed8e417963b9b3247682a9333f508ebb69d518c5f9af064c9dd88a7177d7
Instruction Fuzzy Hash: AE5159755083049FC740EF24D88186AB7FAFF88718F14896DF89A57261DB31AE0ACB52

Function 006DA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 006DA47A
__swprintf.LIBCMT ref: 006DA49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 006DA4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 006DA4FE
_memset.LIBCMT ref: 006DA51D
_wcsncpy.LIBCMT ref: 006DA559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 006DA58E
CloseHandle.KERNEL32(00000000), ref: 006DA599
RemoveDirectoryW.KERNEL32(?), ref: 006DA5A2
CloseHandle.KERNEL32(00000000), ref: 006DA5AC

Strings

:, xrefs: 006DA4BD
\??\%s, xrefs: 006DA496
\, xrefs: 006DA4B2

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 8eff99c55a2cf4745de3e3ec4f01e3021561af20260e7fdf4107fc1dc12a69f6
Instruction ID: 02b20381abfa09ea115c71531a96d8124ffd51872250aa8d7090313d77795bf9
Opcode Fuzzy Hash: 8eff99c55a2cf4745de3e3ec4f01e3021561af20260e7fdf4107fc1dc12a69f6
Instruction Fuzzy Hash: 053190B690411AAADB219BA0DC48FEB33BEAF88701F1041B6F508D6250E67097458B25

Function 006FC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 006FC4EC
GetFocus.USER32 ref: 006FC4FC
GetDlgCtrlID.USER32(00000000), ref: 006FC507
_memset.LIBCMT ref: 006FC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 006FC65D
GetMenuItemCount.USER32(?), ref: 006FC67D
GetMenuItemID.USER32(?,00000000), ref: 006FC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 006FC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 006FC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 006FC744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 006FC779

Strings

0, xrefs: 006FC62A

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 8bf75796b46cf0902dc9efe2b5951ad5bb5e34e67c66b43be3ed9445991f16ab
Instruction ID: f741ee2ece887f5e75bbf63c896f1c14c00bc3c4d803770194cde817d399d07c
Opcode Fuzzy Hash: 8bf75796b46cf0902dc9efe2b5951ad5bb5e34e67c66b43be3ed9445991f16ab
Instruction Fuzzy Hash: 40816D70508349AFD710DF14CA84ABBBBEAFF88364F10492DFA9597291D730D905CBA2

Function 006C83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006C8766
Part of subcall function 006C874A: GetLastError.KERNEL32(?,006C822A,?,?,?), ref: 006C8770
Part of subcall function 006C874A: GetProcessHeap.KERNEL32(00000008,?,?,006C822A,?,?,?), ref: 006C877F
Part of subcall function 006C874A: HeapAlloc.KERNEL32(00000000,?,006C822A,?,?,?), ref: 006C8786
Part of subcall function 006C874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006C879D

Part of subcall function 006C87E7: GetProcessHeap.KERNEL32(00000008,006C8240,00000000,00000000,?,006C8240,?), ref: 006C87F3
Part of subcall function 006C87E7: HeapAlloc.KERNEL32(00000000,?,006C8240,?), ref: 006C87FA
Part of subcall function 006C87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,006C8240,?), ref: 006C880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006C8458
_memset.LIBCMT ref: 006C846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 006C848C
GetLengthSid.ADVAPI32(?), ref: 006C849D
GetAce.ADVAPI32(?,00000000,?), ref: 006C84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006C84F6
GetLengthSid.ADVAPI32(?), ref: 006C8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 006C8522
HeapAlloc.KERNEL32(00000000), ref: 006C8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 006C854A
CopySid.ADVAPI32(00000000), ref: 006C8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 006C8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006C85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 006C85BC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: db05fe9ef4e8150c6b4dedac327541df1ccb63c45e34dd9b73e88a466974708d
Instruction ID: 53de58a41834b1a18ba25023235089fc8cbddfeffefff4e8ad77fa53f1dd928f
Opcode Fuzzy Hash: db05fe9ef4e8150c6b4dedac327541df1ccb63c45e34dd9b73e88a466974708d
Instruction Fuzzy Hash: 0061157190021AAFDF209FA5DC45EFEBBBAFF08300B54816DE815A7291DB719A15CB60

Function 006E762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006E76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 006E76AE
CreateCompatibleDC.GDI32(?), ref: 006E76BA
SelectObject.GDI32(00000000,?), ref: 006E76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 006E771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 006E7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 006E777B
SelectObject.GDI32(00000006,?), ref: 006E7783
DeleteObject.GDI32(?), ref: 006E778C
DeleteDC.GDI32(00000006), ref: 006E7793
ReleaseDC.USER32(00000000,?), ref: 006E779E

Strings

(, xrefs: 006E7723

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 1c505e2667ee8655539e68ac1d310cfe046f7256cc52ebc767c7473b812e1c58
Instruction ID: 7a44cbce1416877812045671960ee243d4edebc4e6982d34e3f02b9022ce60c6
Opcode Fuzzy Hash: 1c505e2667ee8655539e68ac1d310cfe046f7256cc52ebc767c7473b812e1c58
Instruction Fuzzy Hash: 91514775904349EFCB15CFA9CC84EAEBBBAEF48710F14852DF95A97210D731A940CB64

Function 006D5217 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 006D521C

Part of subcall function 00690719: timeGetTime.WINMM(?,753DB400,00680FF9), ref: 0069071D

Sleep.KERNEL32(0000000A), ref: 006D5248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 006D526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 006D528E
SetActiveWindow.USER32 ref: 006D52AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 006D52BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 006D52DA
Sleep.KERNEL32(000000FA), ref: 006D52E5
IsWindow.USER32 ref: 006D52F1
EndDialog.USER32(00000000), ref: 006D5302

Strings

@U=u, xrefs: 006D52BB, 006D52DA
BUTTON, xrefs: 006D5280

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: @U=u$BUTTON
API String ID: 1194449130-2582809321
Opcode ID: aeb3df8d8a7bfe0b50b4e2977aa4ce023823208a5fb642bb54fe08b32b8a2d09
Instruction ID: f7c0e8db09e7dee8af63362df7cc30a6b0d054c759dbc597ff401334aebc4872
Opcode Fuzzy Hash: aeb3df8d8a7bfe0b50b4e2977aa4ce023823208a5fb642bb54fe08b32b8a2d09
Instruction Fuzzy Hash: DC21A1B0604704AFFB145F60EC88A363B6BFF59347F01642AF402827B1DB659D14DA2A

Function 00676BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00690B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00676C6C,?,00008000), ref: 00690BB7

Part of subcall function 006748AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006748A1,?,?,006737C0,?), ref: 006748CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00676D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00676E5A

Part of subcall function 006759CD: _wcscpy.LIBCMT ref: 00675A05

Part of subcall function 0069387D: _iswctype.LIBCMT ref: 00693885

Strings

AU3!, xrefs: 00676CC1
Unterminated string, xrefs: 006AEC0D
Error opening the file, xrefs: 006AE866, 006AE8E1
#include depth exceeded. Make sure there are no recursive includes, xrefs: 006AE84A
>>>AUTOIT SCRIPT<<<, xrefs: 006AE8BF
Bad directive syntax error, xrefs: 006AEBC6
EA06, xrefs: 006AE87B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: f15352a4aba8696d2ce1107d41b1eda02234ccc97c18d99d0262a49396226e1d
Instruction ID: abee76331208fceba6da951e3abdaf9b083e242ff15358ac6cf0e01d264f61da
Opcode Fuzzy Hash: f15352a4aba8696d2ce1107d41b1eda02234ccc97c18d99d0262a49396226e1d
Instruction Fuzzy Hash: 0E02BC701083419FC764EF24C881AAFBBE6FF89314F04892DF48A972A1DB71D949CB56

Function 006745DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006745F9
GetMenuItemCount.USER32(00736890), ref: 006AD7CD
GetMenuItemCount.USER32(00736890), ref: 006AD87D
GetCursorPos.USER32(?), ref: 006AD8C1
SetForegroundWindow.USER32(00000000), ref: 006AD8CA
TrackPopupMenuEx.USER32(00736890,00000000,?,00000000,00000000,00000000), ref: 006AD8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006AD8E9

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 3e7e097729259e1ad159b1434d800bc36367d03cf969385b1a74767e09f45afc
Instruction ID: 5a8e23506206894b1cc2d6f7b1048a0277e5fa1d3caba7493d1e7ebdbad80992
Opcode Fuzzy Hash: 3e7e097729259e1ad159b1434d800bc36367d03cf969385b1a74767e09f45afc
Instruction Fuzzy Hash: 2F71E670604215BFEB24AF24DC49FEABF66FF06364F204216F519A62E1CBB19C50DB94

Function 006E8BC0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006E8BEC
CoInitialize.OLE32(00000000), ref: 006E8C19
CoUninitialize.OLE32 ref: 006E8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 006E8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 006E8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00702C0C), ref: 006E8E84
CoGetObject.OLE32(?,00000000,00702C0C,?), ref: 006E8EA7
SetErrorMode.KERNEL32(00000000), ref: 006E8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 006E8F3A
VariantClear.OLEAUT32(?), ref: 006E8F4A

Strings

,,p, xrefs: 006E8BD6

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,p
API String ID: 2395222682-2804055044
Opcode ID: d943c96df2de7ebc4c3cbc6877dcc03172b22b6d2839210dc3a7fea555e7a784
Instruction ID: 29ecb8eec9d35690c5a974d1b6999cc99d7e290f139a3407ae931ff3779b0344
Opcode Fuzzy Hash: d943c96df2de7ebc4c3cbc6877dcc03172b22b6d2839210dc3a7fea555e7a784
Instruction Fuzzy Hash: 83C154B1208345AFD700DF65C88496BB7EAFF89748F00492DF58A9B251DB31ED06CB62

Function 006FC27C Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

Part of subcall function 00672344: GetCursorPos.USER32(?), ref: 00672357
Part of subcall function 00672344: ScreenToClient.USER32(007367B0,?), ref: 00672374
Part of subcall function 00672344: GetAsyncKeyState.USER32(00000001), ref: 00672399
Part of subcall function 00672344: GetAsyncKeyState.USER32(00000002), ref: 006723A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 006FC2E4
ImageList_EndDrag.COMCTL32 ref: 006FC2EA
ReleaseCapture.USER32 ref: 006FC2F0
SetWindowTextW.USER32(?,00000000), ref: 006FC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 006FC3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 006FC48F

Strings

@U=u, xrefs: 006FC3AD
@GUI_DROPID, xrefs: 006FC3E1
prs, xrefs: 006FC3FD
@GUI_DRAGFILE, xrefs: 006FC424
prs, xrefs: 006FC438

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$@U=u$prs$prs
API String ID: 1924731296-3922780090
Opcode ID: 1c9c4b6844c549065a5149adf0bd711e2e9fea3a6e8c26b1e22b65124d3641e3
Instruction ID: d7804a7a355324203010d620fccadbf976e98b5cec075f12f28b917fb29ac751
Opcode Fuzzy Hash: 1c9c4b6844c549065a5149adf0bd711e2e9fea3a6e8c26b1e22b65124d3641e3
Instruction Fuzzy Hash: EE518C70208309AFD704DF24C895FBA7BE6FF88310F10852DF6958B2A2DB75A944CB56

Function 006F10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,006F0038,?,?), ref: 006F10BC

Strings

HKEY_CLASSES_ROOT, xrefs: 006F114F
HKEY_USERS, xrefs: 006F11BD
HKCR, xrefs: 006F1164
HKEY_CURRENT_USER, xrefs: 006F119B
HKLM, xrefs: 006F113A
HKU, xrefs: 006F11CE
HKCC, xrefs: 006F118A
HKCU, xrefs: 006F11AC
HKEY_LOCAL_MACHINE, xrefs: 006F1125
HKEY_CURRENT_CONFIG, xrefs: 006F1179

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 3574f8326f817cc80bb2506bab32eb5b90e756aa9bbeae7f3aba5a05ce88a306
Instruction ID: 44bc24c16943ac0e0ec8cecc180c6c32e0d9f29aeac0cfb60e6c9abc04a50422
Opcode Fuzzy Hash: 3574f8326f817cc80bb2506bab32eb5b90e756aa9bbeae7f3aba5a05ce88a306
Instruction Fuzzy Hash: AB416C3011025ECFDF10EF94E891AFA3726AF12380F104468FE915B691DB35AE9ACB60

Function 006F772A Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 006F77CD
CreateCompatibleDC.GDI32(00000000), ref: 006F77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 006F77E7
SelectObject.GDI32(00000000,00000000), ref: 006F77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 006F77FA
DeleteDC.GDI32(00000000), ref: 006F7803
GetWindowLongW.USER32(?,000000EC), ref: 006F780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 006F7821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 006F782D

Strings

static, xrefs: 006F7765
@U=u, xrefs: 006F77E7

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: @U=u$static
API String ID: 2559357485-3553413495
Opcode ID: eee88d8dc9141a4e3a16a325343ff0dbc55ac336d3dc96e29a7523f0d7cf5a96
Instruction ID: 39ae83c1b7900e5592ea67afb98c36ae0ddb36b69202bb745737a3a2eb829160
Opcode Fuzzy Hash: eee88d8dc9141a4e3a16a325343ff0dbc55ac336d3dc96e29a7523f0d7cf5a96
Instruction Fuzzy Hash: 0F317C32105219BBDF119FB4DC09FEB3B6AFF09361F115225FA25A61A0CB71D821DBA4

Function 006D5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

Part of subcall function 00677A84: _memmove.LIBCMT ref: 00677B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 006D55D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 006D55E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006D55F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 006D560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 006D561C

Strings

status PlayMe mode, xrefs: 006D55CD
open , xrefs: 006D5581
close PlayMe, xrefs: 006D55E3, 006D5610
play PlayMe, xrefs: 006D5617
alias PlayMe, xrefs: 006D55AB
play PlayMe wait, xrefs: 006D5606

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: e617c45a2c0eb95a6c33ba07542603a5b1657f1f20a800a58cd26055009ca44b
Instruction ID: ce27f5947a53cc25830039a5ceecb3a013aa7db425331939a08ad982bec2fac4
Opcode Fuzzy Hash: e617c45a2c0eb95a6c33ba07542603a5b1657f1f20a800a58cd26055009ca44b
Instruction Fuzzy Hash: 161104609601A97AD720F761DC4ADFFBB7EEF92B00F40042EB805A21D2EEA44D05C5A1

Function 006D48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006D490E
gethostname.WSOCK32(?,00000100), ref: 006D4928
gethostbyname.WSOCK32(?), ref: 006D4935
_wcscpy.LIBCMT ref: 006D495D
_memmove.LIBCMT ref: 006D4970
inet_ntoa.WSOCK32(?), ref: 006D497B
_strcat.LIBCMT ref: 006D4989
_wcscpy.LIBCMT ref: 006D49A0
WSACleanup.WSOCK32 ref: 006D49AE
_wcscpy.LIBCMT ref: 006D49BC

Strings

0.0.0.0, xrefs: 006D4957

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: f4914bc76ddbb5b82ba5250987a2fd41401cc80deae55f5925b93bb983da81ad
Instruction ID: fb37b1aac9cd237dc5b86efc8847cb825a5bc66606ca7a2a14e5b389e0daa91a
Opcode Fuzzy Hash: f4914bc76ddbb5b82ba5250987a2fd41401cc80deae55f5925b93bb983da81ad
Instruction Fuzzy Hash: 64113A31D04115ABCF20EB20EC46EEB77BEDF01710F1401BAF4149A251EF719E81D655

Function 006DD7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

CoInitialize.OLE32(00000000), ref: 006DD855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 006DD8E8
SHGetDesktopFolder.SHELL32(?), ref: 006DD8FC
CoCreateInstance.OLE32(00702D7C,00000000,00000001,0072A89C,?), ref: 006DD948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 006DD9B7
CoTaskMemFree.OLE32(?,?), ref: 006DDA0F
_memset.LIBCMT ref: 006DDA4C
SHBrowseForFolderW.SHELL32(?), ref: 006DDA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 006DDAAB
CoTaskMemFree.OLE32(00000000), ref: 006DDAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 006DDAE9
CoUninitialize.OLE32(00000001,00000000), ref: 006DDAEB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 8875a52a5d60b61f2e6c69fb645b207f9289f22a8ddd14e369bd3451da7cab25
Instruction ID: baa7d20056c5ad7558f72633cff3781c24559112a660b608ef5af00d820f6664
Opcode Fuzzy Hash: 8875a52a5d60b61f2e6c69fb645b207f9289f22a8ddd14e369bd3451da7cab25
Instruction Fuzzy Hash: DDB1EA75A00109AFDB54DFA4C888DAEBBFAEF48314B1484A9F509EB351DB30ED45CB54

Function 006D052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 006D05A7
SetKeyboardState.USER32(?), ref: 006D0612
GetAsyncKeyState.USER32(000000A0), ref: 006D0632
GetKeyState.USER32(000000A0), ref: 006D0649
GetAsyncKeyState.USER32(000000A1), ref: 006D0678
GetKeyState.USER32(000000A1), ref: 006D0689
GetAsyncKeyState.USER32(00000011), ref: 006D06B5
GetKeyState.USER32(00000011), ref: 006D06C3
GetAsyncKeyState.USER32(00000012), ref: 006D06EC
GetKeyState.USER32(00000012), ref: 006D06FA
GetAsyncKeyState.USER32(0000005B), ref: 006D0723
GetKeyState.USER32(0000005B), ref: 006D0731

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e3c5d1416c7dc80dc56b75f31e6ae281ce5cbe8b54347383ffe2c8886c191b00
Instruction ID: 67f5e0f6cf9f0e24418ef99ace01890df1f8e8e647fd1966ad2614ed77a9a06f
Opcode Fuzzy Hash: e3c5d1416c7dc80dc56b75f31e6ae281ce5cbe8b54347383ffe2c8886c191b00
Instruction Fuzzy Hash: 8351F960E047C429FB34DBB099557EAAFB69F02380F08459F99C25A3C2DAA4DA4CCB55

Function 006CC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 006CC746
GetWindowRect.USER32(00000000,?), ref: 006CC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 006CC7B6
GetDlgItem.USER32(?,00000002), ref: 006CC7C1
GetWindowRect.USER32(00000000,?), ref: 006CC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 006CC827
GetDlgItem.USER32(?,000003E9), ref: 006CC835
GetWindowRect.USER32(00000000,?), ref: 006CC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 006CC889
GetDlgItem.USER32(?,000003EA), ref: 006CC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 006CC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 006CC8C1

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 03f874e9ca3f2da6a76a6898614a182baf446c9bb206e98ea5841bdc34609294
Instruction ID: a0e75ce1bb5b4fa116eccfc054349a9c0d1162da02fdc2e872830934a8f9d513
Opcode Fuzzy Hash: 03f874e9ca3f2da6a76a6898614a182baf446c9bb206e98ea5841bdc34609294
Instruction Fuzzy Hash: 44510E71B00205ABDB18CF69DD99EBEBBB6EF88711F14812DF519D6290DB70A940CB50

Function 0067201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00671B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00672036,?,00000000,?,?,?,?,006716CB,00000000,?), ref: 00671B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 006720D3
KillTimer.USER32(-00000001,?,?,?,?,006716CB,00000000,?,?,00671AE2,?,?), ref: 0067216E
DestroyAcceleratorTable.USER32(00000000), ref: 006ABEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006716CB,00000000,?,?,00671AE2,?,?), ref: 006ABF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006716CB,00000000,?,?,00671AE2,?,?), ref: 006ABF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006716CB,00000000,?,?,00671AE2,?,?), ref: 006ABF5A
DeleteObject.GDI32(00000000), ref: 006ABF6C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: db925f8eef354e92eaa34643c2a0bad0ae8e57b05a1feaad5cda12428073d868
Instruction ID: 846771417c67b40db60889b034825f383ea7735a62b58b3c2bbaa0cb59e5cfcf
Opcode Fuzzy Hash: db925f8eef354e92eaa34643c2a0bad0ae8e57b05a1feaad5cda12428073d868
Instruction Fuzzy Hash: 5B61C930100602EFEB25AF14DD68BAAB7F3FF45302F54D428E14686A61C739AC91DFA4

Function 006721A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 006725DB: GetWindowLongW.USER32(?,000000EB), ref: 006725EC

GetSysColor.USER32(0000000F), ref: 006721D3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 7f71379a95c97283c150a48096d7081b5e122f0503f2d31f738a0739229ad3fe
Instruction ID: 69748a07ec40bc6e5df761f52fbe8e5af0cffe86ea2c289c32a3b21294157aeb
Opcode Fuzzy Hash: 7f71379a95c97283c150a48096d7081b5e122f0503f2d31f738a0739229ad3fe
Instruction Fuzzy Hash: E1416231100141AADB259F28DC98BF93767EF16335F248265FD798A2E6C7318E42DB61

Function 006DAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,006FF910), ref: 006DAB76
GetDriveTypeW.KERNEL32(00000061,0072A620,00000061), ref: 006DAC40
_wcscpy.LIBCMT ref: 006DAC6A

Strings

cdrom, xrefs: 006DAB92
ramdisk, xrefs: 006DABEA
all, xrefs: 006DAB7C
network, xrefs: 006DABD4
removable, xrefs: 006DABA8
unknown, xrefs: 006DAC01
fixed, xrefs: 006DABBE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 75943f68092d9f3bde2ef6fe4f8b9db640442302dfa8d3969b62aafb4c7377d4
Instruction ID: c6722e8917629214ee00a088b1452cf5c44ab14a63816be3044fa0cd8f21a391
Opcode Fuzzy Hash: 75943f68092d9f3bde2ef6fe4f8b9db640442302dfa8d3969b62aafb4c7377d4
Instruction Fuzzy Hash: 1051AE305183019FC750EF58C881AAAB7EBEF85310F14882EF496973A2DB31DD4ACA57

Function 006F88B4 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 006F896E

Strings

@U=u, xrefs: 006F89A4

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u
API String ID: 634782764-2594219639
Opcode ID: 35769ef68257eb9c0e027ec18a067234404929ba3835013fb27e590fb75804c6
Instruction ID: 80b3c1ed1b31e6f2f3400e3952d42d6c8dd262de1ebaffab2f79a7b4d3604762
Opcode Fuzzy Hash: 35769ef68257eb9c0e027ec18a067234404929ba3835013fb27e590fb75804c6
Instruction Fuzzy Hash: 0E515E31A0020DBEEF209F288C85BB97B67FF05350F604196F625E72A1DF71A990DB55

Function 00672B72 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 006AC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 006AC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 006AC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 006AC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 006AC5C0
DestroyIcon.USER32(00000000), ref: 006AC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 006AC5EC
DestroyIcon.USER32(?), ref: 006AC5FB

Part of subcall function 006FA71E: DeleteObject.GDI32(00000000), ref: 006FA757

Strings

@U=u, xrefs: 006AC5C0, 006AC5EC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID: @U=u
API String ID: 2819616528-2594219639
Opcode ID: c5d384c441ed3bb7c22a71579cc71416c04a1de36601d57a368733d1d9307e85
Instruction ID: ee471e414430c60b4a5ce5f858dc0a1b2a8b6d415e121ed0e1a74ae81318dd9f
Opcode Fuzzy Hash: c5d384c441ed3bb7c22a71579cc71416c04a1de36601d57a368733d1d9307e85
Instruction Fuzzy Hash: 87515B74A00209EFDB24EF24CC55FAA77A6EF59720F108529F90697290DB70ED91DB50

Function 00679997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 006799C2
__swprintf.LIBCMT ref: 00679A0C
__i64tow.LIBCMT ref: 006AFA0F

Strings

False, xrefs: 006AF9D7
0x%p, xrefs: 006AF9F1
True, xrefs: 006AF9D0
%.15g, xrefs: 00679A06

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 4294e169edb54183b224423b4b539c6ea6abf80b28405c7ab349d0456c15d73c
Instruction ID: 17b7993a0e08e5b86e2f319d728774e8569fa82a6692caa28e680a2088a2c439
Opcode Fuzzy Hash: 4294e169edb54183b224423b4b539c6ea6abf80b28405c7ab349d0456c15d73c
Instruction Fuzzy Hash: 6541E571504605AFEF24EB78DC42EB773EAEB05300F24886EE64DD7291EA719D42DB11

Function 006F73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006F73D9
CreateMenu.USER32 ref: 006F73F4
SetMenu.USER32(?,00000000), ref: 006F7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006F7490
IsMenu.USER32(?), ref: 006F74A6
CreatePopupMenu.USER32 ref: 006F74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006F74DD
DrawMenuBar.USER32 ref: 006F74E5

Strings

0, xrefs: 006F73CF
F, xrefs: 006F74D1

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: b45feb0ce03b58f960471fde0772196a7a01234b1ae06feea23f91875a7c1508
Instruction ID: 8dceda2bfd38ed5f878df61942b66bb436638fa2eef0a4778ec35289c12f58d0
Opcode Fuzzy Hash: b45feb0ce03b58f960471fde0772196a7a01234b1ae06feea23f91875a7c1508
Instruction Fuzzy Hash: 78411675A01209EFDB20DF64D884AEABBFAFF59310F144429FA5597360D735A910CB60

Function 006C9471 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 006CB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 006CB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 006C94F6
GetDlgCtrlID.USER32 ref: 006C9501
GetParent.USER32 ref: 006C951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 006C9520
GetDlgCtrlID.USER32(?), ref: 006C9529
GetParent.USER32(?), ref: 006C9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 006C9548

Strings

@U=u, xrefs: 006C9548
ComboBox, xrefs: 006C947E
ListBox, xrefs: 006C94B3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1536045017-2258501812
Opcode ID: 10fb0547145a23aadfc35393318fb2dfe3c974e652618c75265807062d2333b7
Instruction ID: b327d87acb4d1720d8588b3f49d1e4ea1f9916de54625be02ddeed827a08e974
Opcode Fuzzy Hash: 10fb0547145a23aadfc35393318fb2dfe3c974e652618c75265807062d2333b7
Instruction Fuzzy Hash: 2E21C470A04204BBCF05AB64CC85EFEBB76EF45300F10416DF562972E1DB795919DB20

Function 006C955C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 006CB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 006CB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 006C95DF
GetDlgCtrlID.USER32 ref: 006C95EA
GetParent.USER32 ref: 006C9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 006C9609
GetDlgCtrlID.USER32(?), ref: 006C9612
GetParent.USER32(?), ref: 006C962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 006C9631

Strings

@U=u, xrefs: 006C9631
ComboBox, xrefs: 006C9569
ListBox, xrefs: 006C959E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1536045017-2258501812
Opcode ID: cdeaa030abaac33386045b9bf3a75c951057d51bb7317959759798301c776048
Instruction ID: eaefebb25f4b2683ba529e80d9d74e69ff9b00ae86c319363e1419626a225b67
Opcode Fuzzy Hash: cdeaa030abaac33386045b9bf3a75c951057d51bb7317959759798301c776048
Instruction Fuzzy Hash: 1521B374A00204BBDF01AB75CCC5EFEBB7AEF49300F104059F911972E1DB799919DA24

Function 006C9645 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 006C9651
GetClassNameW.USER32(00000000,?,00000100), ref: 006C9666
_wcscmp.LIBCMT ref: 006C9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 006C96F3

Strings

largeicons, xrefs: 006C9687
@U=u, xrefs: 006C96F3
SHELLDLL_DefView, xrefs: 006C9672
smallicons, xrefs: 006C96BB
details, xrefs: 006C96A1
list, xrefs: 006C96D5

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-1428604138
Opcode ID: e9fe4a7a8f2154acb038f20385ba58eeb3fab513ebebe7ffc926f30d84f6205c
Instruction ID: 287aa8a5c807965df419418d9ffebd033f371f8f1305c1812327a4b52626f665
Opcode Fuzzy Hash: e9fe4a7a8f2154acb038f20385ba58eeb3fab513ebebe7ffc926f30d84f6205c
Instruction Fuzzy Hash: 2711CA76248327BAFB012622EC0EEF6779EDF05760F20002EFA00A55E1FE55595195AC

Function 00697040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0069707B

Part of subcall function 00698D68: __getptd_noexit.LIBCMT ref: 00698D68

__gmtime64_s.LIBCMT ref: 00697114
__gmtime64_s.LIBCMT ref: 0069714A
__gmtime64_s.LIBCMT ref: 00697167
__allrem.LIBCMT ref: 006971BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006971D9
__allrem.LIBCMT ref: 006971F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0069720E
__allrem.LIBCMT ref: 00697225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00697243
__invoke_watson.LIBCMT ref: 006972B4

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 815fbd3cbb3229d09030d856ac69b5a48803b8fbabefc5a72e48aeb589f98e4d
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: AD71D9B1A14716ABDB14AF79CC41B9AB3AEAF51324F14422EF414D7B81E770DF408B94

Function 006D2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006D2A31
GetMenuItemInfoW.USER32(00736890,000000FF,00000000,00000030), ref: 006D2A92
SetMenuItemInfoW.USER32(00736890,00000004,00000000,00000030), ref: 006D2AC8
Sleep.KERNEL32(000001F4), ref: 006D2ADA
GetMenuItemCount.USER32(?), ref: 006D2B1E
GetMenuItemID.USER32(?,00000000), ref: 006D2B3A
GetMenuItemID.USER32(?,-00000001), ref: 006D2B64
GetMenuItemID.USER32(?,?), ref: 006D2BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 006D2BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006D2C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006D2C24

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: e3de487f69dc60309cf110b66afc547fcca47bef2132a82463c1644be1bfa586
Instruction ID: b299af16daf3644aea666c1a9b493c09098a912c1173667aa76b7048df18ce04
Opcode Fuzzy Hash: e3de487f69dc60309cf110b66afc547fcca47bef2132a82463c1644be1bfa586
Instruction Fuzzy Hash: 30619EB0D0024AAFDB21CF64C8A8DFE7BBAFB65308F14445AE84197351D771AD46DB20

Function 006F7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 006F7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 006F7217
GetWindowLongW.USER32(?,000000F0), ref: 006F723B
_memset.LIBCMT ref: 006F724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006F725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 006F72D6

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 56884ca30298a96c6146dc4e6d5259b8ea06dce37bed5b95e8bb5be4eaf847a0
Instruction ID: 2e00b6b846bde406efbc0ec37856f991facd5985c3387949103097d03a205a89
Opcode Fuzzy Hash: 56884ca30298a96c6146dc4e6d5259b8ea06dce37bed5b95e8bb5be4eaf847a0
Instruction Fuzzy Hash: 71617A71900208AFDB20DFA8CC81EFE77FAAB09710F144159FA14A73A1C774AE46DB64

Function 006C710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 006C7135
SafeArrayAllocData.OLEAUT32(?), ref: 006C718E
VariantInit.OLEAUT32(?), ref: 006C71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 006C71C0
VariantCopy.OLEAUT32(?,?), ref: 006C7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 006C7227
VariantClear.OLEAUT32(?), ref: 006C723C
SafeArrayDestroyData.OLEAUT32(?), ref: 006C7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006C7252
VariantClear.OLEAUT32(?), ref: 006C7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006C726F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: f5dabbdb7d53349ed55bd1db80445a1e2ca4e275382f7877f159aee9446b5b4f
Instruction ID: b91325507c43a1c88e971415f81468e57e42ed0d5da2e8a18ba5627880d1ce81
Opcode Fuzzy Hash: f5dabbdb7d53349ed55bd1db80445a1e2ca4e275382f7877f159aee9446b5b4f
Instruction Fuzzy Hash: 05414F35A00119AFCB00DF68D844EBEBBFAEF48354F048069F955A7261CB34AA45CF94

Function 006FD74C Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

GetSystemMetrics.USER32(0000000F), ref: 006FD78A
GetSystemMetrics.USER32(0000000F), ref: 006FD7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 006FD9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 006FDA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 006FDA24
ShowWindow.USER32(00000003,00000000), ref: 006FDA43
InvalidateRect.USER32(?,00000000,00000001), ref: 006FDA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 006FDA8B

Strings

@U=u, xrefs: 006FDA03, 006FDA24

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID: @U=u
API String ID: 1211466189-2594219639
Opcode ID: 96cd6ca93210999cc8cef9daf6d3f54454b8eebe30e1c8e2c1854c122e2e9d84
Instruction ID: 16346737f69d0e9ea3cecbc6e25be663c018baed73c1efc4f71e3c4cd545e99c
Opcode Fuzzy Hash: 96cd6ca93210999cc8cef9daf6d3f54454b8eebe30e1c8e2c1854c122e2e9d84
Instruction Fuzzy Hash: 9BB17971600229EBDF14CF68C9857FD7BB3BF08701F088169EE489B299DB74A950CB54

Function 006E86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

CoInitialize.OLE32 ref: 006E8718
CoUninitialize.OLE32 ref: 006E8723
CoCreateInstance.OLE32(?,00000000,00000017,00702BEC,?), ref: 006E8783
IIDFromString.OLE32(?,?), ref: 006E87F6
VariantInit.OLEAUT32(?), ref: 006E8890
VariantClear.OLEAUT32(?), ref: 006E88F1

Strings

Invalid parameter, xrefs: 006E880F
Failed to create object, xrefs: 006E878E, 006E8844
NULL Pointer assignment, xrefs: 006E87C8

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: e2cb8a57d00016974aedb2e88b62477a9ad1793b30c6705288b8011f25dfe6e3
Instruction ID: b1f11a6a731a998adb448642079f5c29fa38094f8169c52ba533715fe5571614
Opcode Fuzzy Hash: e2cb8a57d00016974aedb2e88b62477a9ad1793b30c6705288b8011f25dfe6e3
Instruction Fuzzy Hash: 9F61AC70609341AFD710DF25C848B6FBBEAAF88714F10481DF9899B291CB30ED45CBA6

Function 00672E26 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00672EAE

Part of subcall function 00671DB3: GetClientRect.USER32(?,?), ref: 00671DDC
Part of subcall function 00671DB3: GetWindowRect.USER32(?,?), ref: 00671E1D
Part of subcall function 00671DB3: ScreenToClient.USER32(?,?), ref: 00671E45

GetDC.USER32 ref: 006ACF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 006ACF95
SelectObject.GDI32(00000000,00000000), ref: 006ACFA3
SelectObject.GDI32(00000000,00000000), ref: 006ACFB8
ReleaseDC.USER32(?,00000000), ref: 006ACFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 006AD04B

Strings

@U=u, xrefs: 006ACF95
U, xrefs: 006ACF20

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: @U=u$U
API String ID: 4009187628-4110099822
Opcode ID: 29409e12443bf551a1df705656654915903b9b7d3e2acf672c2445cec4ac3d91
Instruction ID: f0cbab3fb99c9b0da7c056192eac9e80b1cacc798d602b9cae7b5c1f712bb2b6
Opcode Fuzzy Hash: 29409e12443bf551a1df705656654915903b9b7d3e2acf672c2445cec4ac3d91
Instruction Fuzzy Hash: 08719330500205EFCF21AF64C894AFA7BB7FF4A364F14826AED565A266C7318C52DF60

Function 006E5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006E5AA6
inet_addr.WSOCK32(?,?,?), ref: 006E5AEB
gethostbyname.WSOCK32(?), ref: 006E5AF7
IcmpCreateFile.IPHLPAPI ref: 006E5B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 006E5B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 006E5B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 006E5C00
WSACleanup.WSOCK32 ref: 006E5C06

Strings

Ping, xrefs: 006E5B29

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c7db5b9f85cff718ca3a002cd29961c03ba1d1c462dc57d0e9517911ca4a64d5
Instruction ID: ac319af9cfb7af4702bd1cf4e0b09996af2a8d325d7e80278ddb4042e451e86d
Opcode Fuzzy Hash: c7db5b9f85cff718ca3a002cd29961c03ba1d1c462dc57d0e9517911ca4a64d5
Instruction Fuzzy Hash: 2351B1316047009FDB20EF25CC95B6AB7E6EF44714F14896DF55ADB2A1DB70E800CB5A

Function 006DB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006DB73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 006DB7B1
GetLastError.KERNEL32 ref: 006DB7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 006DB828

Strings

NOTREADY, xrefs: 006DB7E7
READY, xrefs: 006DB801
READONLY, xrefs: 006DB7F3
UNKNOWN, xrefs: 006DB7E0
INVALID, xrefs: 006DB7FA

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: a0e55251f76f6f0e361e419e065c93a4ffd97f2d0b5b57b4fc90f02dab3b0944
Instruction ID: 16938b9aa23fe7a11784abbcd30331d59e89cca146b4e7885e77e91a51a86fc3
Opcode Fuzzy Hash: a0e55251f76f6f0e361e419e065c93a4ffd97f2d0b5b57b4fc90f02dab3b0944
Instruction Fuzzy Hash: 02319035E00209EFDB00EF64D885AFE7BBAEF84700F15902AE506D7395DB719942CB91

Function 006F6442 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 006F645A
GetDC.USER32(00000000), ref: 006F6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006F646D
ReleaseDC.USER32(00000000,00000000), ref: 006F6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 006F64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 006F64C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,006F9299,?,?,000000FF,00000000,?,000000FF,?), ref: 006F6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 006F6520

Strings

@U=u, xrefs: 006F64C6, 006F6520

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID: @U=u
API String ID: 3864802216-2594219639
Opcode ID: e5678e3466a9445f1804ad5a027566ab749ca378843f3ff78d6706922bbeaf46
Instruction ID: 907fee1a71cc48215f549471de05a7703e89b2a410df04e1092af323277bdd66
Opcode Fuzzy Hash: e5678e3466a9445f1804ad5a027566ab749ca378843f3ff78d6706922bbeaf46
Instruction Fuzzy Hash: CA314D72201214BFEB118F50DC8AFFA3FAAEF09765F045065FE08EA295DA759841CB64

Function 006D4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 006D419D
__swprintf.LIBCMT ref: 006D41AA

Part of subcall function 006938D8: __woutput_l.LIBCMT ref: 00693931

FindResourceW.KERNEL32(?,?,0000000E), ref: 006D41D4
LoadResource.KERNEL32(?,00000000), ref: 006D41E0
LockResource.KERNEL32(00000000), ref: 006D41ED
FindResourceW.KERNEL32(?,?,00000003), ref: 006D420D
LoadResource.KERNEL32(?,00000000), ref: 006D421F
SizeofResource.KERNEL32(?,00000000), ref: 006D422E
LockResource.KERNEL32(?), ref: 006D423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 006D429B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 2e6d99b018f0ccfcbd966a6c4f92a2f13d0f073ca8373e76d91363a202b53cb0
Instruction ID: ea0e01d5c10d04c43105573fe5c23da0fe4157b45bdfb11a1fb6ad597eaddb30
Opcode Fuzzy Hash: 2e6d99b018f0ccfcbd966a6c4f92a2f13d0f073ca8373e76d91363a202b53cb0
Instruction Fuzzy Hash: 943170B1A0521AAFDB159FA0DD85EBF7BAEEF04301F004526F915D2250EB34DE61CBA4

Function 006D16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006D1700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,006D0778,?,00000001), ref: 006D1714
GetWindowThreadProcessId.USER32(00000000), ref: 006D171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006D0778,?,00000001), ref: 006D172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 006D173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006D0778,?,00000001), ref: 006D1755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006D0778,?,00000001), ref: 006D1767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,006D0778,?,00000001), ref: 006D17AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,006D0778,?,00000001), ref: 006D17C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,006D0778,?,00000001), ref: 006D17CC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d9f650161ba522c913acadbe10cf094bc23a609ad8367e3fb72084d353394045
Instruction ID: 3e86f91bd28b359852d73256cae35bd059c10f0721a33e6eeda421add10dfe6f
Opcode Fuzzy Hash: d9f650161ba522c913acadbe10cf094bc23a609ad8367e3fb72084d353394045
Instruction Fuzzy Hash: 673180B5A04205BBEB259F14DC84BB977ABBB56712F108016F804CA3B0DBB49D81CB55

Function 006E9428 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006E947C
VariantInit.OLEAUT32(?), ref: 006E954D
VariantInit.OLEAUT32(?), ref: 006E964E
VariantClear.OLEAUT32(?), ref: 006E9658
VariantClear.OLEAUT32(?), ref: 006E96B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 006E94DD, 006E960B, 006E96C3
,,p, xrefs: 006E94FA
Incorrect Object type in FOR..IN loop, xrefs: 006E9631

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,p$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-3042336286
Opcode ID: 513591291d60de04102f07243670aa99965e3ee5f827672efe0bb1339f3820ab
Instruction ID: f0a9e283606b79cd4fb0767c5f535c7e51bb5efea8e744eaa576db279ced85d4
Opcode Fuzzy Hash: 513591291d60de04102f07243670aa99965e3ee5f827672efe0bb1339f3820ab
Instruction Fuzzy Hash: 7B919C71A01355ABEF24DFA6C848FEEB7BAEF45310F10815AF515AB280D7709945CFA0

Function 006CA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,006CAA64), ref: 006CA9A2

Strings

CLASSNN, xrefs: 006CA744
TEXT, xrefs: 006CA8D9
CLASS, xrefs: 006CA721
NAME, xrefs: 006CA7D4
REGEXPCLASS, xrefs: 006CA767
INSTANCE, xrefs: 006CA8B0

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 5ec5e9c329a6b787e52fcf35ab806c7717741ff42e4785439d906e528a2da7ee
Instruction ID: 670d4414691a4716d689cfc164a53fa6ad9e06e943a68a374426b7280e9cf455
Opcode Fuzzy Hash: 5ec5e9c329a6b787e52fcf35ab806c7717741ff42e4785439d906e528a2da7ee
Instruction Fuzzy Hash: 2691843090010AABDF58DFA0C482FF9FB7AFF04308F54812DD55AA7651DB30699ACB95

Function 006FB60B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(015CE010), ref: 006FB6A5
IsWindowEnabled.USER32(015CE010), ref: 006FB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 006FB795
SendMessageW.USER32(015CE010,000000B0,?,?), ref: 006FB7CC
IsDlgButtonChecked.USER32(?,?), ref: 006FB809
GetWindowLongW.USER32(015CE010,000000EC), ref: 006FB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 006FB843

Strings

@U=u, xrefs: 006FB795, 006FB7CC, 006FB843

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: @U=u
API String ID: 4072528602-2594219639
Opcode ID: d6627af45c4a323e17d448c8d2845da60930316fb7586617874fd51f5ca610ad
Instruction ID: 4e7eb30db9473a837654375deee5ed03b8f02c1f2a972054233746dfaf748ea2
Opcode Fuzzy Hash: d6627af45c4a323e17d448c8d2845da60930316fb7586617874fd51f5ca610ad
Instruction Fuzzy Hash: 8A718E34604208AFEB20AF64C8A4FFA7BBBFF5A300F145069FA55973A1C771A941CB54

Function 006F6FEF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 006F7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 006F70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 006F70C1
_wcscat.LIBCMT ref: 006F711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 006F7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 006F7161

Strings

@U=u, xrefs: 006F7093, 006F70A7
SysListView32, xrefs: 006F7065

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: @U=u$SysListView32
API String ID: 307300125-1908207174
Opcode ID: a3620a88f56ed61e95731af5261d65266444c5e62f73c760101742adb562c40b
Instruction ID: d23e349a72b8734615bc9e5c3658593ad08c29f1ce7b4a98e593b795be51b0dc
Opcode Fuzzy Hash: a3620a88f56ed61e95731af5261d65266444c5e62f73c760101742adb562c40b
Instruction Fuzzy Hash: B141817190430CABEB21DFA4CC85BFE77AAEF08350F10456AF644E7292D6719D85CB64

Function 006F653C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 006F655B
GetWindowLongW.USER32(015CE010,000000F0), ref: 006F658E
GetWindowLongW.USER32(015CE010,000000F0), ref: 006F65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 006F65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 006F661F
GetWindowLongW.USER32(00000000,000000F0), ref: 006F6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 006F664A

Strings

@U=u, xrefs: 006F655B, 006F65F5, 006F661F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: @U=u
API String ID: 2178440468-2594219639
Opcode ID: 8bf2d1be48ccf922d26347a692b4d70268499e85657a186d0de509b19a8887ac
Instruction ID: 8f64abe4580c485eeb150b651ac21b39f3830f816eec9ec8f1530b8d99e35a36
Opcode Fuzzy Hash: 8bf2d1be48ccf922d26347a692b4d70268499e85657a186d0de509b19a8887ac
Instruction Fuzzy Hash: 79310531604158AFEB20CF18DC85FA537E2FB4A710F194168F611DB2B6CB71AC40DB65

Function 006E8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,006FF910), ref: 006E903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,006FF910), ref: 006E9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 006E91EB
SysFreeString.OLEAUT32(?), ref: 006E9215

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 3ea27b5393d3b106926f281e6504c206666dc04626eadca4b73691f3460026d0
Instruction ID: 2f61364f676df13981cfc00ce1054e3bbc18f6f3ccaa344dc77b0ad436bcde02
Opcode Fuzzy Hash: 3ea27b5393d3b106926f281e6504c206666dc04626eadca4b73691f3460026d0
Instruction Fuzzy Hash: 85F10771A01209EFDB04DF95C888EEEB7BAFF49314F108059F515AB291DB31AE46CB60

Function 006EF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006EF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006EFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006EFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006EFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006EFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006EFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 006EFD90
CloseHandle.KERNEL32(?), ref: 006EFDBF
CloseHandle.KERNEL32(?), ref: 006EFE36

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 2228992a0c121972adb1cca79dfd2561bae48f4b1008bb68f692bd5add27fcc2
Instruction ID: 538a070260a3222d6975ff1f51e7e2b28e23f504aca4536128c6f94334e3808f
Opcode Fuzzy Hash: 2228992a0c121972adb1cca79dfd2561bae48f4b1008bb68f692bd5add27fcc2
Instruction Fuzzy Hash: 7DE1D331205381DFCB54EF25C891A6ABBE6BF84314F14856DF8998B3A2DB31EC41CB56

Function 006D4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006D48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006D38D3,?), ref: 006D48C7

Part of subcall function 006D48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006D38D3,?), ref: 006D48E0

Part of subcall function 006D4CD3: GetFileAttributesW.KERNEL32(?,006D3947), ref: 006D4CD4

lstrcmpiW.KERNEL32(?,?), ref: 006D4FE2
_wcscmp.LIBCMT ref: 006D4FFC
MoveFileW.KERNEL32(?,?), ref: 006D5017

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 3937329d46a3c60315aeddd3d440639905aeae5314d19d9a118e1202b3a4aa33
Instruction ID: 58f4d69ab49c861403d0ce27006b4c13ab3e7c6f1d2c67e629103d458a48c122
Opcode Fuzzy Hash: 3937329d46a3c60315aeddd3d440639905aeae5314d19d9a118e1202b3a4aa33
Instruction Fuzzy Hash: 7F5166B24087859BC764DB50CC819DFB3DDAF85340F10492FF189D7651EF74A588876A

Function 006C8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,006C8A84,00000B00,?,?), ref: 006C8E0C
HeapAlloc.KERNEL32(00000000,?,006C8A84,00000B00,?,?), ref: 006C8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,006C8A84,00000B00,?,?), ref: 006C8E28
GetCurrentProcess.KERNEL32(?,00000000,?,006C8A84,00000B00,?,?), ref: 006C8E30
DuplicateHandle.KERNEL32(00000000,?,006C8A84,00000B00,?,?), ref: 006C8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,006C8A84,00000B00,?,?), ref: 006C8E43
GetCurrentProcess.KERNEL32(006C8A84,00000000,?,006C8A84,00000B00,?,?), ref: 006C8E4B
DuplicateHandle.KERNEL32(00000000,?,006C8A84,00000B00,?,?), ref: 006C8E4E
CreateThread.KERNEL32(00000000,00000000,006C8E74,00000000,00000000,00000000), ref: 006C8E68

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: ac9df4b6e6af089e492f343a292302e904f3cc2e165e3acfd0b18746dae9762c
Instruction ID: 409500b46042fb295ab031afaee95aa952ff39edf851ecca846c6926b4f7487c
Opcode Fuzzy Hash: ac9df4b6e6af089e492f343a292302e904f3cc2e165e3acfd0b18746dae9762c
Instruction Fuzzy Hash: 7701A4B6240308FFE710EBA5DC89F6B3BADEF89711F015421FA05DB2A1CA709810CA20

Function 006E9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 006C7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?,?,?,006C799D), ref: 006C766F
Part of subcall function 006C7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?,?), ref: 006C768A
Part of subcall function 006C7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?,?), ref: 006C7698
Part of subcall function 006C7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?), ref: 006C76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 006E9B1B
_memset.LIBCMT ref: 006E9B28
_memset.LIBCMT ref: 006E9C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 006E9C97
CoTaskMemFree.OLE32(?), ref: 006E9CA2

Strings

NULL Pointer assignment, xrefs: 006E9CF0

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: bf5c1d3bcbfe1464fb4ea1be45da154d4b72ecd60de20bc19dd569c535f13ef2
Instruction ID: 5350fc12054320e1a86cb882c1bdfcf690ae70980807e7c3b69e9d38d29007b7
Opcode Fuzzy Hash: bf5c1d3bcbfe1464fb4ea1be45da154d4b72ecd60de20bc19dd569c535f13ef2
Instruction Fuzzy Hash: DC914971D01229ABDB10DFA5DC84ADEBBBAEF08710F20816AF519A7241DB705A45CFA0

Function 006EEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 006D3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 006D3EB6
Part of subcall function 006D3E91: Process32FirstW.KERNEL32(00000000,?), ref: 006D3EC4
Part of subcall function 006D3E91: CloseHandle.KERNEL32(00000000), ref: 006D3F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 006EECB8
GetLastError.KERNEL32 ref: 006EECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 006EECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 006EED77
GetLastError.KERNEL32(00000000), ref: 006EED82
CloseHandle.KERNEL32(00000000), ref: 006EEDB7

Strings

SeDebugPrivilege, xrefs: 006EECD6

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: a298dd105373dbdc79d9f5728f372f1abd70a402df01a8c8095163ec65b44b0d
Instruction ID: 09d7e820f26acfda78618a7d07ea641aefd3b854e1bf6bb2f8a8bbc0bdda7e61
Opcode Fuzzy Hash: a298dd105373dbdc79d9f5728f372f1abd70a402df01a8c8095163ec65b44b0d
Instruction Fuzzy Hash: B7418B712012019FDB15EF25CC95FBDB7A2AF80714F08806DF9469B3C2DB76A804CB9A

Function 006FB958 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(007367B0,00000000,015CE010,?,?,007367B0,?,006FB862,?,?), ref: 006FB9CC
EnableWindow.USER32(00000000,00000000), ref: 006FB9F0
ShowWindow.USER32(007367B0,00000000,015CE010,?,?,007367B0,?,006FB862,?,?), ref: 006FBA50
ShowWindow.USER32(00000000,00000004,?,006FB862,?,?), ref: 006FBA62
EnableWindow.USER32(00000000,00000001), ref: 006FBA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 006FBAA9

Strings

@U=u, xrefs: 006FBAA9

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID: @U=u
API String ID: 642888154-2594219639
Opcode ID: 5738dce09df7d426f68a79889cef64924e6b902cf9c1e52d7e1ab1d82b540e9a
Instruction ID: 7c3e0238458a7b9aea5ef3ed236f2af0f14e0f055a0b770cb1c35c6b55e1ea53
Opcode Fuzzy Hash: 5738dce09df7d426f68a79889cef64924e6b902cf9c1e52d7e1ab1d82b540e9a
Instruction Fuzzy Hash: 35414E34604249AFDB21CF18C899BE57BE2FF06310F1852A9FB588F6A2C771E845CB51

Function 006D3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 006D32C5

Strings

warning, xrefs: 006D32AE
question, xrefs: 006D327E
blank, xrefs: 006D3247
info, xrefs: 006D3266
stop, xrefs: 006D3296

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: a0691f9e9cb78909b8f1a88a0ab19f4d3629251393761b3fba4f16bfdb906a8a
Instruction ID: d036e47af424e915db0b990ab942a863c4d98a76a0f1c9d766cf99aa5b5b24b5
Opcode Fuzzy Hash: a0691f9e9cb78909b8f1a88a0ab19f4d3629251393761b3fba4f16bfdb906a8a
Instruction Fuzzy Hash: 8411DA71E48376BBEB016B54EC43DABB7DEEF19770F20002BF500A6381E6759B4145AA

Function 006D4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 006D454E
LoadStringW.USER32(00000000), ref: 006D4555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 006D456B
LoadStringW.USER32(00000000), ref: 006D4572
_wprintf.LIBCMT ref: 006D4598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 006D45B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 006D4593

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: fd52e8d2c925fe8817d82f390425b9ab3cb10ce972f76d30c6d5a8476aa578d4
Instruction ID: 4926833b4ebb5092cd94d7ea5393aaa228cbfdc2d2c62ad07dff78fde1c2db95
Opcode Fuzzy Hash: fd52e8d2c925fe8817d82f390425b9ab3cb10ce972f76d30c6d5a8476aa578d4
Instruction Fuzzy Hash: DA0162F2900208BFE750EBA0DD89EF7776DDB08301F0015A6BB45D2151EA749E858B75

Function 00672A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,006AC417,00000004,00000000,00000000,00000000), ref: 00672ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,006AC417,00000004,00000000,00000000,00000000,000000FF), ref: 00672B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,006AC417,00000004,00000000,00000000,00000000), ref: 006AC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,006AC417,00000004,00000000,00000000,00000000), ref: 006AC4D6

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 40d9e3a74659ad712dff0373c79de908b177ae07fafff373f82590642587d03f
Instruction ID: 070c4158cedc15aab430b27edb96574e8f6fc0c75e1a0f83bef5309ef3796298
Opcode Fuzzy Hash: 40d9e3a74659ad712dff0373c79de908b177ae07fafff373f82590642587d03f
Instruction Fuzzy Hash: 5F41F930608782AAD7359B289CB97BA7BD3EF4A310F18C51DE04F86661C6759C86DB14

Function 006D7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 006D737F

Part of subcall function 00690FF6: std::exception::exception.LIBCMT ref: 0069102C
Part of subcall function 00690FF6: __CxxThrowException@8.LIBCMT ref: 00691041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 006D73B6
EnterCriticalSection.KERNEL32(?), ref: 006D73D2
_memmove.LIBCMT ref: 006D7420
_memmove.LIBCMT ref: 006D743D
LeaveCriticalSection.KERNEL32(?), ref: 006D744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 006D7461
InterlockedExchange.KERNEL32(?,000001F6), ref: 006D7480

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 9cbeb8f8c000df37265acac51424c18838badeaa68e7037c8911a3b938a2c755
Instruction ID: cdf81fd9c2084a453a6c9cf5f41ed377411dd858e8ffca239696642241ea4da7
Opcode Fuzzy Hash: 9cbeb8f8c000df37265acac51424c18838badeaa68e7037c8911a3b938a2c755
Instruction Fuzzy Hash: 7A31AF31904205EBDF10DFA4DC85AAEBBB9EF45710B1441BAF904AB246DB319A10DBA5

Function 006CC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 006CC087
_memcmp.LIBCMT ref: 006CC0A9
_memcmp.LIBCMT ref: 006CC0C1
_memcmp.LIBCMT ref: 006CC0D4
_memcmp.LIBCMT ref: 006CC0EE
_memcmp.LIBCMT ref: 006CC101
_memcmp.LIBCMT ref: 006CC119
_memcmp.LIBCMT ref: 006CC134

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 127488d7fb86f866bac2a9a8ebe37a45e44aa3c2a55d4eeab52f6f634543558b
Instruction ID: 1bbc478963356b865265e4dbeb90986ba1e3584debeb7a830f4543bb80f454de
Opcode Fuzzy Hash: 127488d7fb86f866bac2a9a8ebe37a45e44aa3c2a55d4eeab52f6f634543558b
Instruction Fuzzy Hash: 242198B2B00206B7EE55A6218D46FBB339FDF113B4B18401DFE0D96783E756DD1281A5

Function 006DED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

Part of subcall function 0068FEC6: _wcscpy.LIBCMT ref: 0068FEE9

_wcstok.LIBCMT ref: 006DEEFF
_wcscpy.LIBCMT ref: 006DEF8E
_memset.LIBCMT ref: 006DEFC1

Strings

X, xrefs: 006DEFFE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 600196352122886e96eb12015ad9ce3bbe1b16743e878eb8463c7df0e7b6a687
Instruction ID: ee6dc6508db69677ca34522782ad81b61ce10fbd2d636150fdc1e21b9d8a6e00
Opcode Fuzzy Hash: 600196352122886e96eb12015ad9ce3bbe1b16743e878eb8463c7df0e7b6a687
Instruction Fuzzy Hash: 68C193719083009FC754EF24C881A5AB7E6FF84310F14896DF99A9B3A2DB30ED45CB96

Function 006E6E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 006E6F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 006E6F35
WSAGetLastError.WSOCK32(00000000), ref: 006E6F48
htons.WSOCK32(?,?,?,00000000,?), ref: 006E6FFE
inet_ntoa.WSOCK32(?), ref: 006E6FBB

Part of subcall function 006CAE14: _strlen.LIBCMT ref: 006CAE1E
Part of subcall function 006CAE14: _memmove.LIBCMT ref: 006CAE40

_strlen.LIBCMT ref: 006E7058
_memmove.LIBCMT ref: 006E70C1

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 76fa58f30ef51ead1ce29973a2c980ab45a22b0d8dabacde65526e26456e6e5b
Instruction ID: 91f9f40042f09262e9544608ebd6e2db9d041874cdb68734b93da48048cdc741
Opcode Fuzzy Hash: 76fa58f30ef51ead1ce29973a2c980ab45a22b0d8dabacde65526e26456e6e5b
Instruction Fuzzy Hash: 3A81C071508340AFD750EB25CC85E6BB3EBEF84714F10891DF55A9B2A2DB70AD01CBA6

Function 00671424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03778301b308c502fc52c37931e985ca47566ee2d025234ad739e486e7abee10
Instruction ID: 9ec01f16c1807a53bf29019f3663a26f3d6d670391d76ea7c3e5240161ffb05d
Opcode Fuzzy Hash: 03778301b308c502fc52c37931e985ca47566ee2d025234ad739e486e7abee10
Instruction Fuzzy Hash: 5B714D70900109EFDB14DF58CC49ABEBBBAFF86314F14C15AF919AA251C734AA51CF64

Function 006EF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006EF75C
_memset.LIBCMT ref: 006EF825
ShellExecuteExW.SHELL32(?), ref: 006EF86A

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

Part of subcall function 0068FEC6: _wcscpy.LIBCMT ref: 0068FEE9

GetProcessId.KERNEL32(00000000), ref: 006EF8E1
CloseHandle.KERNEL32(00000000), ref: 006EF910

Strings

@, xrefs: 006EF839

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: a6af6f867926da3fa3b19596168ecc56b9171f860606bc71546a53785ab8b2bf
Instruction ID: 79bb24f76e6066c06e54bbdb59700b4869d37d14bc247005908c5856b1c1fb6e
Opcode Fuzzy Hash: a6af6f867926da3fa3b19596168ecc56b9171f860606bc71546a53785ab8b2bf
Instruction Fuzzy Hash: 19619B75A007599FCF14EF65C5809AEBBF6FF48310B14846DE85AAB351CB30AE41CB94

Function 006D145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 006D149C
GetKeyboardState.USER32(?), ref: 006D14B1
SetKeyboardState.USER32(?), ref: 006D1512
PostMessageW.USER32(?,00000101,00000010,?), ref: 006D1540
PostMessageW.USER32(?,00000101,00000011,?), ref: 006D155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 006D15A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 006D15C8

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 603b3a1572dde036ed6a54ca473121781ea46ee19a71e5ea484298493dd40ba5
Instruction ID: b440c324d827ccf6fa2f2737c95451b26169998f793271f7782f80c9201f7eff
Opcode Fuzzy Hash: 603b3a1572dde036ed6a54ca473121781ea46ee19a71e5ea484298493dd40ba5
Instruction Fuzzy Hash: E351C1A0E086D53EFB3647648C45BFA7EAB5B47304F08848AE1D54DAD2C2D8EC84D760

Function 006D1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 006D12B5
GetKeyboardState.USER32(?), ref: 006D12CA
SetKeyboardState.USER32(?), ref: 006D132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 006D1357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 006D1374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 006D13B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 006D13D9

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 99b908197d8f1dd52313ecfefb7bc3e5e7494a16ce1acca453fb1bebc12576a4
Instruction ID: 1a0572427bf6739c49d4ae45e92d364a9bee014370a3f377b9ed75878272646c
Opcode Fuzzy Hash: 99b908197d8f1dd52313ecfefb7bc3e5e7494a16ce1acca453fb1bebc12576a4
Instruction Fuzzy Hash: 2051D1A0D046D57DFB3287248C55BBABEAB6F07300F08858AE1D48EBC2D7D5AC94D760

Function 006D589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 006D58AC
_wcsncpy.LIBCMT ref: 006D58E1
_wcsncpy.LIBCMT ref: 006D5913
_wcsncpy.LIBCMT ref: 006D5946
_wcsncpy.LIBCMT ref: 006D5988
_wcsncpy.LIBCMT ref: 006D59C2
_wcsncpy.LIBCMT ref: 006D59F1

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6276e47a7f1e820493abd6af71eb4d8ce398ef500b0851cd4b9ee3d8721014b2
Instruction ID: 1cf1729045f96dba655526cce389be15b47e5bfaadece926a6915fa0ff289d8c
Opcode Fuzzy Hash: 6276e47a7f1e820493abd6af71eb4d8ce398ef500b0851cd4b9ee3d8721014b2
Instruction Fuzzy Hash: A741A365C2052876CF50EBF488869CFB3AEAF04310F50855AF519E7B21EA34E715C7AE

Function 006FA2C5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

@U=u, xrefs: 006FA3BE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID: @U=u
API String ID: 0-2594219639
Opcode ID: 84d10ecef727cc1582fe46d39b8f4a7f2cc43a3eb1f5e966405ec5cc702b703b
Instruction ID: 83d858d1121f91dd34a9f8d26f96278f3900b06675025c51013318fb355dccb1
Opcode Fuzzy Hash: 84d10ecef727cc1582fe46d39b8f4a7f2cc43a3eb1f5e966405ec5cc702b703b
Instruction Fuzzy Hash: 9E41E0B690420CAFD720DFA8CC48FF9BBA6EB09310F144165EA19E73E1C770AD41CA61

Function 006CDA5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 006CDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 006CDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 006CDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 006CDB8E

Strings

DllGetClassObject, xrefs: 006CDB01
,,p, xrefs: 006CDA69

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,p$DllGetClassObject
API String ID: 753597075-2413456817
Opcode ID: 71f2f389b3d607fa0aa45303304e092a25205696a0280fb31a33ba52b77e9d15
Instruction ID: 0b94cebd6ec7bade078fe025da3a95be14feb5ab2a6c09f20c14384e397e1492
Opcode Fuzzy Hash: 71f2f389b3d607fa0aa45303304e092a25205696a0280fb31a33ba52b77e9d15
Instruction Fuzzy Hash: 75413BB1600209EFDB15CF54C884FAABBBAEF44350F1581BEA9059F245D7B1DD45CBA0

Function 006D38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006D48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006D38D3,?), ref: 006D48C7

Part of subcall function 006D48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006D38D3,?), ref: 006D48E0

lstrcmpiW.KERNEL32(?,?), ref: 006D38F3
_wcscmp.LIBCMT ref: 006D390F
MoveFileW.KERNEL32(?,?), ref: 006D3927
_wcscat.LIBCMT ref: 006D396F
SHFileOperationW.SHELL32(?), ref: 006D39DB

Strings

\*.*, xrefs: 006D3969

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 1f80980b13d06132191f9ca8846f8763a1442452aacd63f7cdbbcf8ef51bb7a5
Instruction ID: 426f2a81860378d236722ae01e8a5c5953540200061268947de373ba3f42fbe2
Opcode Fuzzy Hash: 1f80980b13d06132191f9ca8846f8763a1442452aacd63f7cdbbcf8ef51bb7a5
Instruction Fuzzy Hash: 62416FB29093449AC791EF64C4919EFB7EDAF89340F40092FB48AC7361EB74D648C756

Function 006F7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006F7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006F75C0
IsMenu.USER32(?), ref: 006F75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006F7620
DrawMenuBar.USER32 ref: 006F7633

Strings

0, xrefs: 006F750D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 6991635672a385421f428db174b937e878cf19c97ab0db4f3eef20548be617a1
Instruction ID: 4d33c9242a8458cab7d134ef6e0e7bf82dad2ecc04b44c8f87c318e7355c2d16
Opcode Fuzzy Hash: 6991635672a385421f428db174b937e878cf19c97ab0db4f3eef20548be617a1
Instruction Fuzzy Hash: 0C410575A04609AFDB20DF94D885EEABBFAFF08314F048129EA5597350D730AD55CFA0

Function 006F122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 006F125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006F1286
FreeLibrary.KERNEL32(00000000), ref: 006F133D

Part of subcall function 006F122D: RegCloseKey.ADVAPI32(?), ref: 006F12A3
Part of subcall function 006F122D: FreeLibrary.KERNEL32(?), ref: 006F12F5
Part of subcall function 006F122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 006F1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 006F12E0

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: c6e96b8981fce155c36aa8e45ef752edb5a1a161c479be974af2a21d03816391
Instruction ID: 2d13156d2c9e6505100992bbb091e1cc937f1cba3ec36fa58d35762bef48a585
Opcode Fuzzy Hash: c6e96b8981fce155c36aa8e45ef752edb5a1a161c479be974af2a21d03816391
Instruction Fuzzy Hash: B6311AB190110DFFDB14DB90DC99AFEB7BDEF09340F00016AE601E6251EA749F859AA4

Function 006E6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 006E80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 006E80CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 006E64D9
WSAGetLastError.WSOCK32(00000000), ref: 006E64E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 006E6521
connect.WSOCK32(00000000,?,00000010), ref: 006E652A
WSAGetLastError.WSOCK32 ref: 006E6534
closesocket.WSOCK32(00000000), ref: 006E655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 006E6576

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 40a89a49017dae861a83f1a2c9fd79eb4c9a79b75811fd18313b409ee9ceacb7
Instruction ID: a941a6dee1d0a2f3048c6a7fcef65d1d4038a714bbf1601e22fcf1dac910f673
Opcode Fuzzy Hash: 40a89a49017dae861a83f1a2c9fd79eb4c9a79b75811fd18313b409ee9ceacb7
Instruction Fuzzy Hash: 6731AF71601218AFDB10AF25DC85BBE7BFAEF547A4F048069F90997391CB70AD04CBA1

Function 006C9372 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 006CB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 006CB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 006C93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 006C9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 006C9439

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

Strings

@U=u, xrefs: 006C93F6, 006C9409, 006C9439
ComboBox, xrefs: 006C9380
ListBox, xrefs: 006C93B5

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: @U=u$ComboBox$ListBox
API String ID: 365058703-2258501812
Opcode ID: 05a17c81d47ec78b8e9d738681d904d3be62ca5b5dc984ffd0378f03cfed563d
Instruction ID: 8971d47ba5966b4dbe379de8f7c87a23c716f28df8bfe0ab693c344534c9a2a8
Opcode Fuzzy Hash: 05a17c81d47ec78b8e9d738681d904d3be62ca5b5dc984ffd0378f03cfed563d
Instruction Fuzzy Hash: F821B671904104AADB18AB74DC89DFFB7BEDF05350B14812DF925972E1DB354A0AD624

Function 006CE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006CE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006CE120
SysAllocString.OLEAUT32(00000000), ref: 006CE123
SysAllocString.OLEAUT32 ref: 006CE144
SysFreeString.OLEAUT32 ref: 006CE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 006CE167
SysAllocString.OLEAUT32(?), ref: 006CE175

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: de38d3bf8a16bf050e543c0460fb7b024774ccf014f1ae32edc8c074bd5783bc
Instruction ID: 3e3aff7bb35dd5e4e3929d7f69313d6875f06efdc9b320c6300f1d85b54abf76
Opcode Fuzzy Hash: de38d3bf8a16bf050e543c0460fb7b024774ccf014f1ae32edc8c074bd5783bc
Instruction Fuzzy Hash: 96214136604108AF9B109FA8DC88DBB77FEEF09760B148129F915CB661DA71DC51CB64

Function 006CB6AF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 006CB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 006CB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 006CB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 006CB742
_wcsstr.LIBCMT ref: 006CB74C

Strings

@U=u, xrefs: 006CB6E4, 006CB71C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID: @U=u
API String ID: 3902887630-2594219639
Opcode ID: 7a24a70c6fc8e144bec953ac8e5227b7882fec3475653fd2483334e55983863b
Instruction ID: 9035aacb424f864b814c51110e1d5d6f99a9395cb5fe60af8a82396ea1fa88f1
Opcode Fuzzy Hash: 7a24a70c6fc8e144bec953ac8e5227b7882fec3475653fd2483334e55983863b
Instruction Fuzzy Hash: 6E21B032204204BAEB255B799C4AF7B7BAEDF89760F10502DFC05DA2A1EF61DC41D7A0

Function 006C97E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006C9802

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 006C9834
__itow.LIBCMT ref: 006C984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 006C9874
__itow.LIBCMT ref: 006C9885

Strings

@U=u, xrefs: 006C9802, 006C9834, 006C9874

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID: @U=u
API String ID: 2983881199-2594219639
Opcode ID: 484088d53a1a8769df0b83b11cf915e331aeaf5721a47ba17d80800c38ce8364
Instruction ID: 1d2fc7873c0315365d6c00343eaeb0190a774d841b5d0e01c99bff73dd897cd5
Opcode Fuzzy Hash: 484088d53a1a8769df0b83b11cf915e331aeaf5721a47ba17d80800c38ce8364
Instruction Fuzzy Hash: 1F218371B01208ABDB109B658C8AFFE7BAEEF4A710F04402DF905DB291DA718D45D7A5

Function 006F783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00671D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00671D73
Part of subcall function 00671D35: GetStockObject.GDI32(00000011), ref: 00671D87
Part of subcall function 00671D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00671D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 006F78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 006F78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 006F78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 006F78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 006F78D4

Strings

Msctls_Progress32, xrefs: 006F7872

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9abfa7e7c15c272bdee1917eff1b3fe545d36c45a2548f593369cffa40e90af5
Instruction ID: 58e5a3d4eb865a8200ae59f5fba747425d1e42b9891212d8fa2251d11ff756ad
Opcode Fuzzy Hash: 9abfa7e7c15c272bdee1917eff1b3fe545d36c45a2548f593369cffa40e90af5
Instruction Fuzzy Hash: DA1181B111411DBEEF159F60CC85EE77F6EEF08798F014125B714A6190C7719C21DBA4

Function 006941C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00694292,?), ref: 006941E3
GetProcAddress.KERNEL32(00000000), ref: 006941EA
EncodePointer.KERNEL32(00000000), ref: 006941F6
DecodePointer.KERNEL32(00000001,00694292,?), ref: 00694213

Strings

combase.dll, xrefs: 006941DE
RoInitialize, xrefs: 006941D2

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 8c0bc987e1e715f63d2fc08fa3155be958308d5e9ab3a5f36427991771316bc6
Instruction ID: 8832cdb1cab7ea1807f5aa8495131187b207e2076beae469ab8c4edbe2eb3fc7
Opcode Fuzzy Hash: 8c0bc987e1e715f63d2fc08fa3155be958308d5e9ab3a5f36427991771316bc6
Instruction Fuzzy Hash: 6CE0E5B2690744AAEF246BB0EC4DB643AAABB22707F109424B411D51E0DBB95496DA04

Function 0069429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,006941B8), ref: 006942B8
GetProcAddress.KERNEL32(00000000), ref: 006942BF
EncodePointer.KERNEL32(00000000), ref: 006942CA
DecodePointer.KERNEL32(006941B8), ref: 006942E5

Strings

combase.dll, xrefs: 006942B3
RoUninitialize, xrefs: 006942A7

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 2fb942125039e72b0ac76b2e833611e438f0111ae059cdac90c6d8723415d290
Instruction ID: f5e5065f21c0fca8e1985f135f7ee3c3b339ace0364c2cb3c343ab8d6972f767
Opcode Fuzzy Hash: 2fb942125039e72b0ac76b2e833611e438f0111ae059cdac90c6d8723415d290
Instruction Fuzzy Hash: 74E0B6B9691705EBEB149B60EC0DF653AAABB24747F109125F001E11A0CBB85A85DA1C

Function 006D675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006D68AD
_memmove.LIBCMT ref: 006D67E8

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

_memmove.LIBCMT ref: 006D685B
_memmove.LIBCMT ref: 006D6942
_memmove.LIBCMT ref: 006D695B
_memmove.LIBCMT ref: 006D6977

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: b6af34302f73e7cc86d124cdaa6c703dbf7dfb6507262c8ff84fb63fda3a9fb8
Instruction ID: f2d67170c3973d0cc746544e225ad7ff3dfc1cce7a1f78ad656483cb5b829126
Opcode Fuzzy Hash: b6af34302f73e7cc86d124cdaa6c703dbf7dfb6507262c8ff84fb63fda3a9fb8
Instruction Fuzzy Hash: 1A61C03090065A9FDF11EF20CC91EFE37AAAF45708F04855EF95A5B292DB319D41CB64

Function 006F046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 006F10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006F0038,?,?), ref: 006F10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006F0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006F0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 006F05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 006F05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 006F0617
RegCloseKey.ADVAPI32(00000000), ref: 006F0624

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 2a7197b60fb2929e3282fbe08d0d8ca9f7eb290ba87eed4826294807f85fc893
Instruction ID: 8d52dc323acb23e4b7d15c3a887090e68d72662f7f57d44b113f662856b160e5
Opcode Fuzzy Hash: 2a7197b60fb2929e3282fbe08d0d8ca9f7eb290ba87eed4826294807f85fc893
Instruction Fuzzy Hash: BB516A31108204AFDB14EF54C885E7BBBEAFF85314F04892DF6558B2A2DB71E905CB56

Function 006F5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 006F5A82
GetMenuItemCount.USER32(00000000), ref: 006F5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 006F5AE1
GetMenuItemID.USER32(?,?), ref: 006F5B50
GetSubMenu.USER32(?,?), ref: 006F5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 006F5BAF

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 005793fd9742ead5b67275819de58ef0eabedd05bb4710a049379ea2ebd44ac4
Instruction ID: cb5918c28c89087376b89c06565c97aa1a177651ef985e1896c2184c281d8907
Opcode Fuzzy Hash: 005793fd9742ead5b67275819de58ef0eabedd05bb4710a049379ea2ebd44ac4
Instruction Fuzzy Hash: 47518031E00619AFCF11DF64C855ABEB7B6EF48320F104469EA16BB351CB31AE41CB95

Function 006CF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006CF3F7
VariantClear.OLEAUT32(00000013), ref: 006CF469
VariantClear.OLEAUT32(00000000), ref: 006CF4C4
_memmove.LIBCMT ref: 006CF4EE
VariantClear.OLEAUT32(?), ref: 006CF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 006CF569

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 4e4e8048d8e1cbb0287301309fb36f26eadc6cd3ea3723d80147a2adeaa5190d
Instruction ID: 9dbbcadfa03d7f4e8207c614cdecf41ffbd3a0d30420b5071fb0787427415978
Opcode Fuzzy Hash: 4e4e8048d8e1cbb0287301309fb36f26eadc6cd3ea3723d80147a2adeaa5190d
Instruction Fuzzy Hash: 94514BB5A00209AFCB14CF58D884EAAB7FAFF4C354B158569EA59DB311D730E911CBA0

Function 006D26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006D2747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006D2792
IsMenu.USER32(00000000), ref: 006D27B2
CreatePopupMenu.USER32 ref: 006D27E6
GetMenuItemCount.USER32(000000FF), ref: 006D2844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 006D2875

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 4857a8445d621b06cb51d2949b4307ee668ddfce56227045764ccbdd724149b0
Instruction ID: daa4e76c49e5304c10427d8df74d31e982152b7f4f3d90eebb7637d94477d822
Opcode Fuzzy Hash: 4857a8445d621b06cb51d2949b4307ee668ddfce56227045764ccbdd724149b0
Instruction Fuzzy Hash: 8651A070E00207DBDF24CF68D8A8AEEBBF6AF64314F10426AE4119B390D7709949DB51

Function 00671765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0067179A
GetWindowRect.USER32(?,?), ref: 006717FE
ScreenToClient.USER32(?,?), ref: 0067181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0067182C
EndPaint.USER32(?,?), ref: 00671876

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 1d6f8a8052cf032522725479497d3ed91218e4bd6ac592b90e7bd9d40532034e
Instruction ID: 11dc003a975fe5a948be9aea36c14b0d712523ee3dd5619298cc68432fae88eb
Opcode Fuzzy Hash: 1d6f8a8052cf032522725479497d3ed91218e4bd6ac592b90e7bd9d40532034e
Instruction Fuzzy Hash: 22419271104301AFD710DF28CC84FB67BEAEB4A724F148629F6988B2A2C7319C45DB62

Function 006E73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,006E5134,?,?,00000000,00000001), ref: 006E73BF

Part of subcall function 006E3C94: GetWindowRect.USER32(?,?), ref: 006E3CA7

GetDesktopWindow.USER32 ref: 006E73E9
GetWindowRect.USER32(00000000), ref: 006E73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 006E7422

Part of subcall function 006D54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006D555E

GetCursorPos.USER32(?), ref: 006E744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006E74AC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: aac683cce770f008c3db3ab96ea4131e0f212ed5ca80a4b6d38a5fde9d907178
Instruction ID: 4f5c1f5cc5193862ca1bfb6fe19319bf1c1861d264eddeb54b08cfc0c679f655
Opcode Fuzzy Hash: aac683cce770f008c3db3ab96ea4131e0f212ed5ca80a4b6d38a5fde9d907178
Instruction Fuzzy Hash: 8B31E672509345ABD720DF15D849F9BBBEAFF88314F00091AF589D7291DB30E909CB92

Function 006C8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006C8608
Part of subcall function 006C85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006C8612
Part of subcall function 006C85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006C8621
Part of subcall function 006C85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006C8628
Part of subcall function 006C85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006C863E

GetLengthSid.ADVAPI32(?,00000000,006C8977), ref: 006C8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 006C8DB8
HeapAlloc.KERNEL32(00000000), ref: 006C8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 006C8DD8
GetProcessHeap.KERNEL32(00000000,00000000,006C8977), ref: 006C8DEC
HeapFree.KERNEL32(00000000), ref: 006C8DF3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 5ba1c09c678fe1cae2bc1373dc11f6ed798c583e4fb0176f0b28b909801cdc6e
Instruction ID: 6b28c584f76d54ba5ba1b0c93b8380d81b3191fed22208852d2c9492f0cdc709
Opcode Fuzzy Hash: 5ba1c09c678fe1cae2bc1373dc11f6ed798c583e4fb0176f0b28b909801cdc6e
Instruction Fuzzy Hash: A4119732600605FFDB20DBA4CC49FFEBBAAEF55316F10402DE84697250CB32A940CBA0

Function 006C8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006C8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 006C8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 006C8B40
CloseHandle.KERNEL32(00000004), ref: 006C8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006C8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 006C8B8E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: d45672435542eaff5462db92c46b9066ff40f6faf4397d9a7c5c14dd459af041
Instruction ID: bb070dd3dcd987558e67fe5d8dbdf01a90d0532e1f2d156c2ae5660ffcdda73a
Opcode Fuzzy Hash: d45672435542eaff5462db92c46b9066ff40f6faf4397d9a7c5c14dd459af041
Instruction Fuzzy Hash: 4A112CB2501209AFDF118FA8ED49FEA7BAAEF08304F045069FE04A2160C7769D61DB60

Function 006FC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 006712F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0067134D
Part of subcall function 006712F3: SelectObject.GDI32(?,00000000), ref: 0067135C
Part of subcall function 006712F3: BeginPath.GDI32(?), ref: 00671373
Part of subcall function 006712F3: SelectObject.GDI32(?,00000000), ref: 0067139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 006FC1C4
LineTo.GDI32(00000000,00000003,?), ref: 006FC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 006FC1E6
LineTo.GDI32(00000000,00000000,?), ref: 006FC1F6
EndPath.GDI32(00000000), ref: 006FC206
StrokePath.GDI32(00000000), ref: 006FC216

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 9f89fbe29bfe11780c5487ac9d207272d0a78b49e9a1526fcc13ac7300018c27
Instruction ID: 713a745302013ae46919ddcd5c68a6ab176d0cc830e334327d93d043ee83f375
Opcode Fuzzy Hash: 9f89fbe29bfe11780c5487ac9d207272d0a78b49e9a1526fcc13ac7300018c27
Instruction Fuzzy Hash: BB111B7640010CBFEF119F94DC88EEA7FAEEF08364F048021BA184A1A1C7729E55DBA0

Function 006903A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 006903D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 006903DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 006903E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 006903F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 006903F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00690401

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d0caf14dcfb557f3d4d31c4d674859a561d8d8b7f1ec63060db31fa3477d6db8
Instruction ID: f08eee0cf556030a6fd35478ace6857db3b60a0446c8f776830cf1241b950b57
Opcode Fuzzy Hash: d0caf14dcfb557f3d4d31c4d674859a561d8d8b7f1ec63060db31fa3477d6db8
Instruction Fuzzy Hash: 3A016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C87941C7F5A864CBE5

Function 006D568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 006D569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 006D56B1
GetWindowThreadProcessId.USER32(?,?), ref: 006D56C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006D56CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006D56D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006D56E0

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: f7f56419db66ddbcb139c117a0a2e98450d9f8390852214c104b24074588dcb9
Instruction ID: 9acd6bdb5167337299f1025f64745291485e417b38344ef25c8dafcf210bfa64
Opcode Fuzzy Hash: f7f56419db66ddbcb139c117a0a2e98450d9f8390852214c104b24074588dcb9
Instruction Fuzzy Hash: 69F03A32641159BBE7215BA2EC0EEFF7B7DEFCAB11F000169FA05D11A0DBA15A01C6B5

Function 006D74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 006D74E5
EnterCriticalSection.KERNEL32(?,?,00681044,?,?), ref: 006D74F6
TerminateThread.KERNEL32(00000000,000001F6,?,00681044,?,?), ref: 006D7503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00681044,?,?), ref: 006D7510

Part of subcall function 006D6ED7: CloseHandle.KERNEL32(00000000,?,006D751D,?,00681044,?,?), ref: 006D6EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 006D7523
LeaveCriticalSection.KERNEL32(?,?,00681044,?,?), ref: 006D752A

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 13582601f900e1022c9b597007707419c31ae507ed3b288ea9455c90b7cd7d79
Instruction ID: f0d686c2ac6aae84dcd02f7465bd147f27c776b146992ce9a4e4ab43a1d422b5
Opcode Fuzzy Hash: 13582601f900e1022c9b597007707419c31ae507ed3b288ea9455c90b7cd7d79
Instruction Fuzzy Hash: 2DF05E3A544612EBDB111BA4FC8C9FB7B2BEF46302B001532F202911B0DB755A01CB51

Function 006C8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 006C8E7F
UnloadUserProfile.USERENV(?,?), ref: 006C8E8B
CloseHandle.KERNEL32(?), ref: 006C8E94
CloseHandle.KERNEL32(?), ref: 006C8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 006C8EA5
HeapFree.KERNEL32(00000000), ref: 006C8EAC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 131f25c00a8d28243a7589b05f4a7e05da543d89c7187700fd8a366a14f18899
Instruction ID: 2eac25e91e508eb344702044d20b9bed95313e31f98e58b0f6ed0abc64cf9325
Opcode Fuzzy Hash: 131f25c00a8d28243a7589b05f4a7e05da543d89c7187700fd8a366a14f18899
Instruction Fuzzy Hash: 03E05277104506FBDB016FE6EC0C96ABF6AFF89762B549631F21981470CB329461DB90

Function 006C7A78 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00702C7C,?), ref: 006C7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00702C7C,?), ref: 006C7C4A
CLSIDFromProgID.OLE32(?,?,00000000,006FFB80,000000FF,?,00000000,00000800,00000000,?,00702C7C,?), ref: 006C7C6F
_memcmp.LIBCMT ref: 006C7C90

Strings

,,p, xrefs: 006C7A85

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,p
API String ID: 314563124-2804055044
Opcode ID: 7b8d50b22dfeccc17df6d18251c36cc2796435905d816335029239e59b29feff
Instruction ID: 57f6b13d9153872ae0c7300ce661dd98e58d5308ead4e50d5aa4c3806a5230b7
Opcode Fuzzy Hash: 7b8d50b22dfeccc17df6d18251c36cc2796435905d816335029239e59b29feff
Instruction Fuzzy Hash: 8281FB75A0010AEFCB04DF94C984EEEB7BAFF89315F204599E515AB250DB71AE06CF60

Function 006E8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006E8928
CharUpperBuffW.USER32(?,?), ref: 006E8A37
VariantClear.OLEAUT32(?), ref: 006E8BAF

Part of subcall function 006D7804: VariantInit.OLEAUT32(00000000), ref: 006D7844
Part of subcall function 006D7804: VariantCopy.OLEAUT32(00000000,?), ref: 006D784D
Part of subcall function 006D7804: VariantClear.OLEAUT32(00000000), ref: 006D7859

Strings

AUTOIT.ERROR, xrefs: 006E8A3D
Incorrect Parameter format, xrefs: 006E8960, 006E8B22

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 47e07d12a51ce1661b29e70695cdad2425b20e3b5ad8703f192841213d3c944c
Instruction ID: 53acbecdfd38ca08217f40e36e8d79e91d14a7f4dda35e163aa7579b868888ae
Opcode Fuzzy Hash: 47e07d12a51ce1661b29e70695cdad2425b20e3b5ad8703f192841213d3c944c
Instruction Fuzzy Hash: 479190716083419FC740DF29C48496BBBF6EF89714F14896EF89A8B362DB31E905CB52

Function 006D2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0068FEC6: _wcscpy.LIBCMT ref: 0068FEE9

_memset.LIBCMT ref: 006D3077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006D30A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006D3159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 006D3187

Strings

0, xrefs: 006D3063

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: e85f1693794f0cf7582a73e9b5d0a6a1caa5792dfc1d4994fedce8ef051aa5dc
Instruction ID: 536027d35aeb470a9a0a966a0aa94e66b603578b8ec09b851992af9c8b24ac15
Opcode Fuzzy Hash: e85f1693794f0cf7582a73e9b5d0a6a1caa5792dfc1d4994fedce8ef051aa5dc
Instruction Fuzzy Hash: A1512431A083229AD7249F28CC446ABB7EAEF59310F044A2EF895D7391DB70CE44C767

Function 006F9A63 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(015CDD20,?), ref: 006F9AD2
ScreenToClient.USER32(00000002,00000002), ref: 006F9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 006F9B72

Strings

@U=u, xrefs: 006F9BCD

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: @U=u
API String ID: 3880355969-2594219639
Opcode ID: 80fc0d8c05810af030904b58000b981cdf7beea1484ed0507039345379864f92
Instruction ID: 10045cb2b1557abe0c3aedd9b9a5790f9f555fabc9b8efc71461842ec84479ff
Opcode Fuzzy Hash: 80fc0d8c05810af030904b58000b981cdf7beea1484ed0507039345379864f92
Instruction Fuzzy Hash: 01510A34A00209AFDB24DF68D881AFE7BB6EF55324F148169FA159B390D730AD41CBA0

Function 006D2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006D2CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 006D2CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 006D2D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00736890,00000000), ref: 006D2D5A

Strings

0, xrefs: 006D2CA4

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: cb2e29deba9773d0435e797aaddd07340e001198cc49876a43796c03d2111f50
Instruction ID: addb49293d7e73f62831a2bdcce2943397fd89fb721b46ec351ae521d1413056
Opcode Fuzzy Hash: cb2e29deba9773d0435e797aaddd07340e001198cc49876a43796c03d2111f50
Instruction Fuzzy Hash: 0641C0306043029FD720DF24C854B6ABBEBEF95320F14461EF96597391D770E905CB96

Function 006F8AC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006F8B4D

Strings

@U=u, xrefs: 006F8B9C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u
API String ID: 634782764-2594219639
Opcode ID: d6eb2b832e2ee02841e12001fe5b96789864e63a2fc849d275278756fb035fea
Instruction ID: 20613695f64563fe1df637fefce573846dc8d86b359134452091409c5a454a5c
Opcode Fuzzy Hash: d6eb2b832e2ee02841e12001fe5b96789864e63a2fc849d275278756fb035fea
Instruction Fuzzy Hash: E731ADB460420CBEEB209F18CC89FF937A7EB09310F248696FB51D73A1CE30A9409B55

Function 006EDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 006EDAD9

Part of subcall function 006779AB: _memmove.LIBCMT ref: 006779F9

Strings

cdecl, xrefs: 006EDB30
stdcall, xrefs: 006EDB5B
none, xrefs: 006EDBB4
winapi, xrefs: 006EDB4A

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: dca07d34dc34d79d363047ee92bae03fc279c8b8e82ea4a25b0cdb797f64f3f3
Instruction ID: 3e0167c05ef29745de1ce40fc7eee42b7bda8a8fa1c7acda10c6f46450fcfd2d
Opcode Fuzzy Hash: dca07d34dc34d79d363047ee92bae03fc279c8b8e82ea4a25b0cdb797f64f3f3
Instruction Fuzzy Hash: D8318370501719AFCF10EF55C8819EEB3B6FF05310B10866DE865A77D1EB71A906CB84

Function 006F6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00671D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00671D73
Part of subcall function 00671D35: GetStockObject.GDI32(00000011), ref: 00671D87
Part of subcall function 00671D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00671D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 006F66D0
LoadLibraryW.KERNEL32(?), ref: 006F66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 006F66EC
DestroyWindow.USER32(?), ref: 006F66F4

Strings

SysAnimate32, xrefs: 006F66AB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 870fe6baed37c6349d21a4176ffecbb121f426578c71a58e15e7a7b4aa7d9374
Instruction ID: e0b20befdfed28648cef97113c429ec34230979655807d3f7855bf1492be5552
Opcode Fuzzy Hash: 870fe6baed37c6349d21a4176ffecbb121f426578c71a58e15e7a7b4aa7d9374
Instruction Fuzzy Hash: 9E219D7120020ABBEF105F64EC80EBB77AEEF59368F105629FA10D62A0D772CC519765

Function 006D703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 006D705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006D7091
GetStdHandle.KERNEL32(0000000C), ref: 006D70A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 006D70DD

Strings

nul, xrefs: 006D70D8

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 7a593be6e17a000e1884f3b306e8570d8e5d31f7b5d9a24112ab8289f1838ac4
Instruction ID: 3c8c75878d19ccec3157513ecf7d52fa81567d7db51dcef0bffdc1257d5f26d8
Opcode Fuzzy Hash: 7a593be6e17a000e1884f3b306e8570d8e5d31f7b5d9a24112ab8289f1838ac4
Instruction Fuzzy Hash: B72192B4D04209ABDB209F79DC05AAA77BABF44720F204A1AFDA0D73D0E7709950CB61

Function 006D710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 006D712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006D715D
GetStdHandle.KERNEL32(000000F6), ref: 006D716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 006D71A8

Strings

nul, xrefs: 006D71A3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: e4718d413a151ffc3a82c559e71b044a2d25d363019b2cafdaf4d9ffc488a61f
Instruction ID: e19133f59780661fa113d60a114de3ee9864e08e9b85bea0533ff26bf0199314
Opcode Fuzzy Hash: e4718d413a151ffc3a82c559e71b044a2d25d363019b2cafdaf4d9ffc488a61f
Instruction Fuzzy Hash: 5521C575904306ABDB209F68DC04AAAB7EAAF55730F240B1AFCB0D33D0E7709941CB52

Function 006DAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006DAEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 006DAF13
__swprintf.LIBCMT ref: 006DAF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,006FF910), ref: 006DAF6A

Strings

%lu, xrefs: 006DAF26

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: eb339dedd2466a7188d200b5403e7dacbe432db104971d09822d3e8b0075f033
Instruction ID: 5777ef6805c155d49fa12d1ae4064fd730e2c94ecf01415b84bde538d593323b
Opcode Fuzzy Hash: eb339dedd2466a7188d200b5403e7dacbe432db104971d09822d3e8b0075f033
Instruction Fuzzy Hash: 3F216234A00109AFCB50DB94C985DAE77F9EF49704B0040A9F509AB351DB71EE45CB65

Function 006CA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

Part of subcall function 006CA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 006CA399
Part of subcall function 006CA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 006CA3AC
Part of subcall function 006CA37C: GetCurrentThreadId.KERNEL32 ref: 006CA3B3
Part of subcall function 006CA37C: AttachThreadInput.USER32(00000000), ref: 006CA3BA

GetFocus.USER32 ref: 006CA554

Part of subcall function 006CA3C5: GetParent.USER32(?), ref: 006CA3D3

GetClassNameW.USER32(?,?,00000100), ref: 006CA59D
EnumChildWindows.USER32(?,006CA615), ref: 006CA5C5
__swprintf.LIBCMT ref: 006CA5DF

Strings

%s%d, xrefs: 006CA5D9

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 1486776924ad858c94965bc4b2d243c1054fc9282159b3f96d2a6fa279cb170c
Instruction ID: d554956d26da67051d3a61f93c717d5ae7d2824be6f5dbd85ed5f73a84cf0b47
Opcode Fuzzy Hash: 1486776924ad858c94965bc4b2d243c1054fc9282159b3f96d2a6fa279cb170c
Instruction Fuzzy Hash: CC117F71600209ABDF51BFA5DC85FFA777EEF48704F04407DBA0CAA152CA7059458B79

Function 006D2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006D2048

Strings

KEYS, xrefs: 006D205F
EXISTS, xrefs: 006D2070
APPEND, xrefs: 006D2081
REMOVE, xrefs: 006D204E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: c0ea63942cc5097db453a52543b18d62ac7f931b5e284889f6a2d8dc3007c6d2
Instruction ID: 3a4a98261a5c931dcf0d1c2fcd6b5d4ab51eed1bdfb2b0af9385ffba06e42c26
Opcode Fuzzy Hash: c0ea63942cc5097db453a52543b18d62ac7f931b5e284889f6a2d8dc3007c6d2
Instruction Fuzzy Hash: 2E115B3090011A9FCF40EFA8D9514EEB7B6FF25304B1488A9D855A7352EB32691BCB51

Function 006EEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 006EEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 006EEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 006EF07E
CloseHandle.KERNEL32(?), ref: 006EF0FF

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 7c6fba1d1280da977b4f14c96ed499895b61464393f7712ab217eb01bb06e0b5
Instruction ID: 9ba352d9b1469d7be359e18053ae79e23765934e27884bad11f95081491f96d6
Opcode Fuzzy Hash: 7c6fba1d1280da977b4f14c96ed499895b61464393f7712ab217eb01bb06e0b5
Instruction Fuzzy Hash: FB8181716043009FD760DF29C886F6AB7E6AF88720F14882DF599DB392DB71AC00CB95

Function 0069564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 006956AB
_memcpy_s.LIBCMT ref: 0069571D
__read_nolock.LIBCMT ref: 0069577B
__filbuf.LIBCMT ref: 0069579E
_memset.LIBCMT ref: 006957E2

Part of subcall function 00698D68: __getptd_noexit.LIBCMT ref: 00698D68

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: fd1a262b7e6f1cb596d0076786feeeb097306c284ce0f321d4276a437e8c5e71
Instruction ID: a4df80403cc57d952403b68ff71ea2daa56a72b64a50d09c88e2ebc9ef546588
Opcode Fuzzy Hash: fd1a262b7e6f1cb596d0076786feeeb097306c284ce0f321d4276a437e8c5e71
Instruction Fuzzy Hash: 52519630A00B05DBDF259FA9C8845AE77ABAF41320F64862DF8279ABD0D7709E519B41

Function 006F02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 006F10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006F0038,?,?), ref: 006F10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006F0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006F03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 006F040E
RegCloseKey.ADVAPI32(?,?), ref: 006F043A
RegCloseKey.ADVAPI32(00000000), ref: 006F0447

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 957a8f7c1c82ce2592b85fea2da35f2c4c9ff784fe2b68498aa97a493b2d1fc8
Instruction ID: b1acf3905287c8c56c218e6b35d6aa130fdfd982fa50c383a3c33a7686443798
Opcode Fuzzy Hash: 957a8f7c1c82ce2592b85fea2da35f2c4c9ff784fe2b68498aa97a493b2d1fc8
Instruction Fuzzy Hash: 50514B31208205AFD744EF54C881E7EB7EAFF84704F04892DF69997292DB30E905CB56

Function 006DE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 006DE88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 006DE8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 006DE8F2

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 006DE917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 006DE91F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: bf6338fc98affa43c37559f8158f26522940ab88a399247125c6d5709dcbd367
Instruction ID: 13845454b92c85986db1127e51e9c265425fea149aa08393d1e0357c3886d578
Opcode Fuzzy Hash: bf6338fc98affa43c37559f8158f26522940ab88a399247125c6d5709dcbd367
Instruction Fuzzy Hash: D0513C35A00205DFDF41EF64C9819AEBBF6EF48310B14C0A9E909AB361CB31ED11DB64

Function 00672344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00672357
ScreenToClient.USER32(007367B0,?), ref: 00672374
GetAsyncKeyState.USER32(00000001), ref: 00672399
GetAsyncKeyState.USER32(00000002), ref: 006723A7

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 42963a79974695a8d872e0c82b2fdf545b28ad1dc14bf241748a700e56c069c1
Instruction ID: b9fe92ee560ce2059218aaca4585ceaa0aa175dcccfb5543b29784f68156e709
Opcode Fuzzy Hash: 42963a79974695a8d872e0c82b2fdf545b28ad1dc14bf241748a700e56c069c1
Instruction Fuzzy Hash: 2E417F3590411AFBDF159F68C844AE9BB76FF06330F20835AF82896290CB345E94DF91

Function 006C6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006C695D
TranslateAcceleratorW.USER32(?,?,?), ref: 006C69A9
TranslateMessage.USER32(?), ref: 006C69D2
DispatchMessageW.USER32(?), ref: 006C69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006C69EB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: e3617df1a879b20a86c97a9b4e370d3297f403815fc9ae856fb92baf25c8d367
Instruction ID: 67dcc166b5b1f0520b39314b4d904ad402cd325e24400edb522c1e5b053cd13f
Opcode Fuzzy Hash: e3617df1a879b20a86c97a9b4e370d3297f403815fc9ae856fb92baf25c8d367
Instruction Fuzzy Hash: 9531C471504247AAEB608FB4CC44FF67BAAEB01305F10816DF421D32A1D774D886D798

Function 006C8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006C8F12
PostMessageW.USER32(?,00000201,00000001), ref: 006C8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 006C8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 006C8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 006C8FDA

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 3faa23ed7fbd192ba0d98421add34dee74d2ad713043165abfe3263af71c281f
Instruction ID: 2e1f1f9d21b10061c0e306cb10e6238bba8f2a8fcc28ea9ded4c7e4bb2106048
Opcode Fuzzy Hash: 3faa23ed7fbd192ba0d98421add34dee74d2ad713043165abfe3263af71c281f
Instruction Fuzzy Hash: 72319871500219EFDB24CFA8D948BEE7BA6EB44325F10422DF925EB2D0CBB09914DB90

Function 006FB405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

GetWindowLongW.USER32(?,000000F0), ref: 006FB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 006FB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 006FB489
GetSystemMetrics.USER32(00000004), ref: 006FB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,006E1184,00000000), ref: 006FB4D0

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 973da664c28c8417f4d38dc214d5ca7f77e083da656ffd568c58f6da1f786db7
Instruction ID: 102ccee2505f6d6be9ee3333449fbf9c1e4ddc59d96a7da4d56e1450149a6fbe
Opcode Fuzzy Hash: 973da664c28c8417f4d38dc214d5ca7f77e083da656ffd568c58f6da1f786db7
Instruction Fuzzy Hash: 05219171910219AFCB108F38DD04ABA37E6EF05725F149738FA26C72E6E7309811DB80

Function 006712F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0067134D
SelectObject.GDI32(?,00000000), ref: 0067135C
BeginPath.GDI32(?), ref: 00671373
SelectObject.GDI32(?,00000000), ref: 0067139C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: f1c342bdee201c90cee578dd70316ce8a9592abdf614bdb6917e8f559a6514e7
Instruction ID: 772a2e55cd0bb737bf14cd3ebafaf65d3d039dfef35d9312a05f173c7033eb2c
Opcode Fuzzy Hash: f1c342bdee201c90cee578dd70316ce8a9592abdf614bdb6917e8f559a6514e7
Instruction Fuzzy Hash: 47212170800204FFEB119F29DC04BE97BFAFB05362F14C226F9149A6A1D7759991DFA4

Function 006CC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 006CC176
_memcmp.LIBCMT ref: 006CC194
_memcmp.LIBCMT ref: 006CC1A7
_memcmp.LIBCMT ref: 006CC1BF
_memcmp.LIBCMT ref: 006CC1D7

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 457e21d5773033625735625221c57bcc490b014ba65f3482b2208fc359539171
Instruction ID: 447e0cf74f93ae4dbd62000efa31f746445144e6dd679431cb04ba36863448c6
Opcode Fuzzy Hash: 457e21d5773033625735625221c57bcc490b014ba65f3482b2208fc359539171
Instruction Fuzzy Hash: 990196B3A041067BEE05A6225C46FBB779EDB113A4F18411EFE0896B83E6549E1282E4

Function 006D4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006D4D5C
__beginthreadex.LIBCMT ref: 006D4D7A
MessageBoxW.USER32(?,?,?,?), ref: 006D4D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 006D4DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 006D4DAC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: a8f2063012bb4991045c98bd3ab31978e00e81d439ce6838b707155d131ea2eb
Instruction ID: 961e8bf191ee338bf7ef72e24d234163c3fbb52949cb08a6756ed740804ef49c
Opcode Fuzzy Hash: a8f2063012bb4991045c98bd3ab31978e00e81d439ce6838b707155d131ea2eb
Instruction Fuzzy Hash: F0110872D04204BBDB019BA89C08AEB7FAEEF49321F148266F914D3350DA758D04C7A0

Function 006C874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006C8766
GetLastError.KERNEL32(?,006C822A,?,?,?), ref: 006C8770
GetProcessHeap.KERNEL32(00000008,?,?,006C822A,?,?,?), ref: 006C877F
HeapAlloc.KERNEL32(00000000,?,006C822A,?,?,?), ref: 006C8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006C879D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: e1be97f485fbe0e000bddcb6b1479d57f49a39c9e4bc991da39f6f1afa3b218a
Instruction ID: b19b1e67230be7f9c45ae55e8524941313b332e1664b29f8846c4c26dfb734c5
Opcode Fuzzy Hash: e1be97f485fbe0e000bddcb6b1479d57f49a39c9e4bc991da39f6f1afa3b218a
Instruction Fuzzy Hash: F301E871601204AF9B204FA6DC88DBB7BAEEF8A7557201579F949C3260EA319D10CA70

Function 006D54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006D5502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 006D5510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 006D5518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 006D5522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006D555E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 03076bfe5d5852d88279cb891fa07c352a49026b27f13e764807b7caea4ab2cc
Instruction ID: 5c6cb7df22874a44d20c825bd61460931718c5ca3c8e967ad56291a58735ef31
Opcode Fuzzy Hash: 03076bfe5d5852d88279cb891fa07c352a49026b27f13e764807b7caea4ab2cc
Instruction Fuzzy Hash: 54012D76D04A19DBCF00EFE8E849AEDBB7AFF09711F004456E902B2740DB305654C7A5

Function 006C7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?,?,?,006C799D), ref: 006C766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?,?), ref: 006C768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?,?), ref: 006C7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?), ref: 006C76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006C758C,80070057,?,?), ref: 006C76B4

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 9907cb90e88490fccbfe61d91ab6329fdddfda05c8961b9ed0bc9eae353dc704
Instruction ID: de522c483220acef53f91533fb516bc4c641a3ac2f77e3add55158a5d2956d33
Opcode Fuzzy Hash: 9907cb90e88490fccbfe61d91ab6329fdddfda05c8961b9ed0bc9eae353dc704
Instruction Fuzzy Hash: 27017172601614ABDB105F59DC45FBA7BBEEF44791F140028FD04D2211E731DE41DBA0

Function 006C85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006C8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006C8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006C8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006C8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006C863E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2c32564d46746ca60bfda03742f25a6b5fb15b3379995a404d17731b0a072309
Instruction ID: 6f8ca618ca034f0bf4d0b3a4281dbdbe94af953c0f59c0af7a9a41a6c50d4028
Opcode Fuzzy Hash: 2c32564d46746ca60bfda03742f25a6b5fb15b3379995a404d17731b0a072309
Instruction Fuzzy Hash: A8F04931201204BFEB204FA6DC99FBB3BAEEFCA754B000429F949C7250CB619C41DA60

Function 006C8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006C8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006C8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006C8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006C8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006C869F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 0448da2534e332d558a13c869f7f610fc8665e922aedd81b8834c3e9863381d8
Instruction ID: 99b59626739b6e3a46512bcc09f3aa80450d684f32f8b66451c61ca986fb1f30
Opcode Fuzzy Hash: 0448da2534e332d558a13c869f7f610fc8665e922aedd81b8834c3e9863381d8
Instruction Fuzzy Hash: 6DF04F71200214AFEB211FA5EC88FB73BAEEF8AB58B100029F945C7250CF619941DA60

Function 006CC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 006CC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 006CC6D1
MessageBeep.USER32(00000000), ref: 006CC6E9
KillTimer.USER32(?,0000040A), ref: 006CC705
EndDialog.USER32(?,00000001), ref: 006CC71F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: b701d2deb0deef1782753830bf6691208ac20bc192056e0c45933dd172cd0233
Instruction ID: 35140427fba58ebcfb9cb14988ef6802db29852021e90d1de100a43b6b31042e
Opcode Fuzzy Hash: b701d2deb0deef1782753830bf6691208ac20bc192056e0c45933dd172cd0233
Instruction Fuzzy Hash: 07014F30500704ABEB215B20DD4EFB677BAFF00B15F00166DF546E15E1DBE1A955CA90

Function 006713B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 006713BF
StrokeAndFillPath.GDI32(?,?,006ABAD8,00000000,?), ref: 006713DB
SelectObject.GDI32(?,00000000), ref: 006713EE
DeleteObject.GDI32 ref: 00671401
StrokePath.GDI32(?), ref: 0067141C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: dcb74def6387ce0c86275293b7d601eeb0e35c8682192004b1f5a026ffe0afdd
Instruction ID: 80ddc8b24725a4338b61eb9478649365d7d71a076e35e1f2678c3905dc2c36cd
Opcode Fuzzy Hash: dcb74def6387ce0c86275293b7d601eeb0e35c8682192004b1f5a026ffe0afdd
Instruction Fuzzy Hash: 31F0EC30004308FBEB115F2AEC4C7A83FA6AB06327F04D225E569491F1CB3949A5DF68

Function 00682E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00690FF6: std::exception::exception.LIBCMT ref: 0069102C
Part of subcall function 00690FF6: __CxxThrowException@8.LIBCMT ref: 00691041

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 00677BB1: _memmove.LIBCMT ref: 00677C0B

__swprintf.LIBCMT ref: 0068302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00682EC6

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 22a7040d0cab50b45aa6fc583ae1faa0745b76f203043ee1f21177fb4f88acbd
Instruction ID: b3d63adfbf0f05eb284b203575a3ef8c7f9f40fdbcca9f9753e34b6709e84699
Opcode Fuzzy Hash: 22a7040d0cab50b45aa6fc583ae1faa0745b76f203043ee1f21177fb4f88acbd
Instruction Fuzzy Hash: D2918E711083119FCB18FF24D885CAEB7EAEF95B50F004A1DF4869B3A1DA20EE45CB56

Function 006CB7B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 006CB981

Strings

%p, xrefs: 006CBA24
Container, xrefs: 006CB8FE
AutoIt3GUI, xrefs: 006CB8F9

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%p
API String ID: 3565006973-2724510058
Opcode ID: 8c40cf8227bb368fef252e9828e2f05b1995727365c133b3292d57d418b88e0d
Instruction ID: 8a6fab1a52c4ba65a4a83e22177826ba768de0b61063dc13b954c2f6d4b92a8c
Opcode Fuzzy Hash: 8c40cf8227bb368fef252e9828e2f05b1995727365c133b3292d57d418b88e0d
Instruction Fuzzy Hash: D69159706006019FDB64DF64C885F6AB7EAFF48710F24856EE94ACB791DB70E841CB50

Function 0069524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 006952DD

Part of subcall function 006A0340: __87except.LIBCMT ref: 006A037B

Strings

pow, xrefs: 006952B5, 006952D2

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 565d995dc8817770469f06b88766a419efb879538f250b875654ec9c45bd7844
Instruction ID: f4d02b428800dfe0c56d2ea2b202fb5dc224b1eb0a94b64ff94aac5a2290f809
Opcode Fuzzy Hash: 565d995dc8817770469f06b88766a419efb879538f250b875654ec9c45bd7844
Instruction Fuzzy Hash: 61518B21E0D602C7EF167724C9513BE27DAEB02750F208958E086827E5EF388DC5DF4A

Function 0069023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00690280
+, xrefs: 00690277

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 652dfdfb6498435074dba2eb1a0da5c533bd2adfa832ba25258dc87fd9cef513
Instruction ID: 3eaa0bb07bc11adb30a814c8a4702b5cdde576bd6d349759d8acad07b9adca80
Opcode Fuzzy Hash: 652dfdfb6498435074dba2eb1a0da5c533bd2adfa832ba25258dc87fd9cef513
Instruction Fuzzy Hash: D4512F741043469FDF159F28C888BFA7BAAEF19310F544059E8939B3A0D734BC82CB64

Function 00683297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006833D7
_memmove.LIBCMT ref: 00683470
_free.LIBCMT ref: 00683496
_memmove.LIBCMT ref: 00683549

Strings

Oah, xrefs: 00683482

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove$_free
String ID: Oah
API String ID: 2620147621-3137904739
Opcode ID: bd4cfc5b69c6ce21faf412f83b9254e0f98b1796416c62705960a941a752947b
Instruction ID: ded22057f0425fc3d5b63256e3c62b41eabb78bd48afa447f0d26dcc046cc6f7
Opcode Fuzzy Hash: bd4cfc5b69c6ce21faf412f83b9254e0f98b1796416c62705960a941a752947b
Instruction Fuzzy Hash: 81518AB16083519FDB24DF28C451B6FBBE6BF85704F044A2DE98987351EB31EA41CB82

Function 006862F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006863A8
_memmove.LIBCMT ref: 00686446
_memset.LIBCMT ref: 0068646A

Strings

ERCP, xrefs: 00686313

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 4405aa621628fa513f608d0a6a7d2cc2d560b60b6eed3eb0f8e2d1cadfa9a444
Instruction ID: f70d5b9bb2222d39bf5ad18d0e0f5e478cdbf11c644bcc3b228215af33a34311
Opcode Fuzzy Hash: 4405aa621628fa513f608d0a6a7d2cc2d560b60b6eed3eb0f8e2d1cadfa9a444
Instruction Fuzzy Hash: D251E171900319DFDB24DF64C881BEABBFAEF04310F20866EE54ACB641E775A681CB40

Function 006F7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 006F76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 006F76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 006F7708

Strings

SysMonthCal32, xrefs: 006F769B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 32d16f77324165d29170e4dc5e27e61c7f2f28e5830f9b26c0adedb0b2999730
Instruction ID: b22641e67a0e11ad638eddde1793ee4cf39dc729e332c85d81708d88c3c54280
Opcode Fuzzy Hash: 32d16f77324165d29170e4dc5e27e61c7f2f28e5830f9b26c0adedb0b2999730
Instruction Fuzzy Hash: 5E219F32514219BBDF119F64CC46FEA3B6AEF48714F110214FE15AB2D0DAB5A851DBA0

Function 006F6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 006F6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 006F6FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 006F6FDF

Strings

Listbox, xrefs: 006F6F77

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: dfab698ad210182319fc0ac21373376b07e12c890b53f78424639a89de90467c
Instruction ID: 49ce02ff0db5affd4d5936b0e44a5aeb6a568b05837598eeff1d8d4d2f7b74af
Opcode Fuzzy Hash: dfab698ad210182319fc0ac21373376b07e12c890b53f78424639a89de90467c
Instruction Fuzzy Hash: 47215032611118BFDF119F54EC85EFB3BABEF89754F118124FA159B290CA71AC51CBA0

Function 006C912D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 006C914F
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 006C9166
SendMessageW.USER32(?,0000000D,?,00000000), ref: 006C919E

Strings

@U=u, xrefs: 006C919E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: f52caefd16f1b9c6667f66663c66b776cf59bca8486f187021850f38f8f964b5
Instruction ID: bc65d00aec9b482bbd725028b9f93097b7f02f156b783d900f6dfab877782ed7
Opcode Fuzzy Hash: f52caefd16f1b9c6667f66663c66b776cf59bca8486f187021850f38f8f964b5
Instruction Fuzzy Hash: 2021C232600109BBDF21DBA9D84AEBEB7BEEF44340F15009AE905E3690DA31AD408B64

Function 006E60EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000402,00000000,00000000), ref: 006E613B
SendMessageW.USER32(0000000C,00000000,?), ref: 006E617C
SendMessageW.USER32(0000000C,00000000,?), ref: 006E61A4

Strings

@U=u, xrefs: 006E613B, 006E617C, 006E61A4

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: f955387afb80aac166c521f717268f63101bc599c9ba103d17f8c01e3fd9cc79
Instruction ID: 65379a5925221ba13fb3cced277f16c781645f2a27d14b7dfe5460552a9c44dd
Opcode Fuzzy Hash: f955387afb80aac166c521f717268f63101bc599c9ba103d17f8c01e3fd9cc79
Instruction Fuzzy Hash: 4F211735201601AFEB11AB29DD85D6AB7E6FF49324701C058F909DB672CB21FC51CBA8

Function 006F797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 006F79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 006F79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 006F7A03

Strings

msctls_trackbar32, xrefs: 006F79B8

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: ffc8301e59f945074bdbaad7eaa75d0f0523f00f529aa96959555941baa3948b
Instruction ID: 27a1e16a5162e1071d314a1ae8b990acab70641cebfec211e21c6da977be3802
Opcode Fuzzy Hash: ffc8301e59f945074bdbaad7eaa75d0f0523f00f529aa96959555941baa3948b
Instruction Fuzzy Hash: 1811E372244208BAEF209F74CC05FEB7BAAEF89764F02452DFB41A6190D671A811CB64

Function 006F6B8F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 006F6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006F6C20

Strings

@U=u, xrefs: 006F6C20
edit, xrefs: 006F6BF5

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: @U=u$edit
API String ID: 2978978980-590756393
Opcode ID: 7c90e8135d7ecfa2f58ba7c1473e08f1d40f2b6978bf49e875420ac12457ff81
Instruction ID: 4b1d3e41037d8649cda5e4b4e90e7cfabd23161ac95799e9cdf6ce230187e4d8
Opcode Fuzzy Hash: 7c90e8135d7ecfa2f58ba7c1473e08f1d40f2b6978bf49e875420ac12457ff81
Instruction Fuzzy Hash: 68116A7150020CABEB108F64DC42AFA3B6BEF15368F604724FAA5D72E0C675DCA19B60

Function 006C92E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 006CB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 006CB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 006C9355

Strings

@U=u, xrefs: 006C9355
ComboBox, xrefs: 006C92F4
ListBox, xrefs: 006C931F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: bfada849017a7366e86ff006dfb8a2c0d8128ae416f8423cfbd8509e269e5ea8
Instruction ID: 20fb15eb9ec800983812ec8858daf102f3dda5390a178f787ff2e6d2e1610092
Opcode Fuzzy Hash: bfada849017a7366e86ff006dfb8a2c0d8128ae416f8423cfbd8509e269e5ea8
Instruction Fuzzy Hash: 0E01F171A05214ABCB04FBA4CC96DFE776AFF06320B140A5DF936972D1EB355908C660

Function 006C91DF Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 006CB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 006CB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 006C924D

Strings

@U=u, xrefs: 006C924D
ComboBox, xrefs: 006C91EC
ListBox, xrefs: 006C9217

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: a0c9cec0d75e3b1fc18c2c18383c701481accb1ff878d4acc9f2ca1075e77a5a
Instruction ID: ff7c2be5c2518ae50f36ff3e95568f832427d7c4a8318394c570e9c3cefb676c
Opcode Fuzzy Hash: a0c9cec0d75e3b1fc18c2c18383c701481accb1ff878d4acc9f2ca1075e77a5a
Instruction Fuzzy Hash: 52018471B412047BCB04EBA0C996EFF73AADF05300F24006DB956672C1EA195F189675

Function 006C9264 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00677F41: _memmove.LIBCMT ref: 00677F82

Part of subcall function 006CB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 006CB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 006C92D0

Strings

@U=u, xrefs: 006C92D0
ComboBox, xrefs: 006C9271
ListBox, xrefs: 006C929C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: f530f133bc344b826d266190b3106833e5a87713354d94b7809ae8c4965f5de4
Instruction ID: 9535fb1131db5af6ff4793b29e6644dc5e701cebf47b76db816798e8dda2c2e4
Opcode Fuzzy Hash: f530f133bc344b826d266190b3106833e5a87713354d94b7809ae8c4965f5de4
Instruction Fuzzy Hash: C301A771A4120477CB04F7A4C986EFF77AEDF11300F24415DB956632C1DA195F189275

Function 006FAF89 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,007367B0,006FDB17,000000FC,?,00000000,00000000,?,?,?,006ABBB9,?,?,?,?,?), ref: 006FAF8B
GetFocus.USER32 ref: 006FAF93

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

Part of subcall function 006725DB: GetWindowLongW.USER32(?,000000EB), ref: 006725EC

SendMessageW.USER32(015CDD20,000000B0,000001BC,000001C0), ref: 006FB005

Strings

@U=u, xrefs: 006FB005

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: @U=u
API String ID: 3601265619-2594219639
Opcode ID: 264a19860702fc9389d266355877b4edf7ea5f040799aa88b011b2cbd87e3693
Instruction ID: f9fd91b8b84cc7b4a0c0737d06e90e3a6d166e8dd6aa9ac2a4885af5a24b050d
Opcode Fuzzy Hash: 264a19860702fc9389d266355877b4edf7ea5f040799aa88b011b2cbd87e3693
Instruction Fuzzy Hash: 15014C35200604AFD7249F28D894AB777E7AF8A324B189269E526873A1CF31AC46CB50

Function 006861C3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0068619A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 006861B1

SendMessageW.USER32(?,0000000C,00000000,?), ref: 006861DF
GetParent.USER32(?), ref: 006C111F
InvalidateRect.USER32(00000000,?,00683BAF,?,00000000,00000001), ref: 006C1126

Strings

@U=u, xrefs: 006861DF

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$InvalidateParentRectTimeout
String ID: @U=u
API String ID: 3648793173-2594219639
Opcode ID: 6a3a6912976baf7e63aca01a1af7f2fe71c15a2f9fcd789dacd70d7a6881f017
Instruction ID: 2648cf5639a8664c4206cdec24c9cc8b44fdcb0256070431b0f81a16e0344e15
Opcode Fuzzy Hash: 6a3a6912976baf7e63aca01a1af7f2fe71c15a2f9fcd789dacd70d7a6881f017
Instruction Fuzzy Hash: FBF0A930100204FBEF202F68DC0EFA17BAAAF16344F245139F6819A1A3CEE69851EB50

Function 00674C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00674C2E), ref: 00674CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00674CB5

Strings

GetNativeSystemInfo, xrefs: 00674CAF
kernel32.dll, xrefs: 00674C9E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: afb74004cd91ba0bcef37df4a9498bb0ca455592b74a237ca982d6e885f06665
Instruction ID: 200a635e7c8b687dd7b2eeb3100de710c2df52bfcba632bc9f4c23d8c10b8c7a
Opcode Fuzzy Hash: afb74004cd91ba0bcef37df4a9498bb0ca455592b74a237ca982d6e885f06665
Instruction Fuzzy Hash: E6D05E30510727CFD7209F31DE5C66676E7AF05791B12D83ED88AD6350EBB0D880CA50

Function 00674D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00674D2E,?,00674F4F,?,007362F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00674D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00674D81

Strings

kernel32.dll, xrefs: 00674D6A
Wow64DisableWow64FsRedirection, xrefs: 00674D7B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: dadd8e847277a3bfaaad80d1feeda628e31ce96f05f9c0790d8fdb651ba5e621
Instruction ID: 72461ea7df2298085c363cccdd08dfb125c539d2b9c1c9bbd1f99248bfdcb0fc
Opcode Fuzzy Hash: dadd8e847277a3bfaaad80d1feeda628e31ce96f05f9c0790d8fdb651ba5e621
Instruction Fuzzy Hash: A8D01770510723CFD7309F31D84866676EAAF15352B11D83A94CAD6350EB74D880CA50

Function 00674D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00674CE1,?), ref: 00674DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00674DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00674DAE
kernel32.dll, xrefs: 00674D9D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 7df925f37a50e180e6ce58d276bf2f5a706cd8ea1b9061b9842225688b4b4663
Instruction ID: c0ec5a92ef56215db8e0f17f5715cbf870264f6dd0882a15ffc7ff744755ae6d
Opcode Fuzzy Hash: 7df925f37a50e180e6ce58d276bf2f5a706cd8ea1b9061b9842225688b4b4663
Instruction Fuzzy Hash: DDD05E71550723CFD7309F31D85CA9676E6AF05355B11C83ED8DAD6250EB74D880CA50

Function 006F1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,006F12C1), ref: 006F1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 006F1092

Strings

advapi32.dll, xrefs: 006F107B
RegDeleteKeyExW, xrefs: 006F108C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 6de638cdc6f05c4dfd0003f1c4305a81f26862df3f4dc50b4b8bfaf721bc6fe2
Instruction ID: 3c29606babc9abefc1e72ba9258be29051f2544186681619519b463b40c02167
Opcode Fuzzy Hash: 6de638cdc6f05c4dfd0003f1c4305a81f26862df3f4dc50b4b8bfaf721bc6fe2
Instruction Fuzzy Hash: 7CD01770510727CFD7309F35E828A6A76E6AF063A1B118C3AA48ADA354EF74D8C0CA50

Function 006E93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,006E9009,?,006FF910), ref: 006E9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 006E9415

Strings

GetModuleHandleExW, xrefs: 006E940F
kernel32.dll, xrefs: 006E93FE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 334297067d9afffbf8e42fc576d5d08ad98e3c966e18921a9ac441edd384496d
Instruction ID: dc4be2456f6dbdeb552c72c41b5339a717677b52a12690580e1a67b1765cdfbc
Opcode Fuzzy Hash: 334297067d9afffbf8e42fc576d5d08ad98e3c966e18921a9ac441edd384496d
Instruction Fuzzy Hash: 34D01774514727DFDB209F32D94866676E6AF06351B11C83AA486D6690EA74C884CA60

Function 006C76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856b354f7747c67e47414233793aa10adc36e098847ba8a9934f1ab151962a16
Instruction ID: 6e4ea7be23c04afa29a222f9df68878261cd600e550ee96b6130956d3ef729d8
Opcode Fuzzy Hash: 856b354f7747c67e47414233793aa10adc36e098847ba8a9934f1ab151962a16
Instruction Fuzzy Hash: 7FC11975A0421AEFCB14CF94C884EAEBBB6FF48714B15859DE906EB251D730ED81CB90

Function 006EE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 006EE3D2
CharLowerBuffW.USER32(?,?), ref: 006EE415

Part of subcall function 006EDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 006EDAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 006EE615
_memmove.LIBCMT ref: 006EE628

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: aa49b84805088ac0bcca9df1d76c0b15b63c50a1f27e92f641921af32fce2fb4
Instruction ID: 15eb699112319d90417bdbcc3556863cce0a7e30a4c0a941fe86c229996a85d7
Opcode Fuzzy Hash: aa49b84805088ac0bcca9df1d76c0b15b63c50a1f27e92f641921af32fce2fb4
Instruction Fuzzy Hash: 6BC18C71A08341CFC754DF29C48096ABBE6FF88714F14896EF8999B351D732E946CB82

Function 006E83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006E83D8
CoUninitialize.OLE32 ref: 006E83E3

Part of subcall function 006CDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 006CDAC5

VariantInit.OLEAUT32(?), ref: 006E83EE
VariantClear.OLEAUT32(?), ref: 006E86BF

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 9c2d150e4e1eb17330b15182dfb24a840ddd5f6610470459767d5ba0ff80f32b
Instruction ID: 8604e11bd105bc29bf3325acdf9d66a63e76d09873b2b9a7587d8625d6056866
Opcode Fuzzy Hash: 9c2d150e4e1eb17330b15182dfb24a840ddd5f6610470459767d5ba0ff80f32b
Instruction Fuzzy Hash: F7A158752047419FDB50DF15C485B6AB7E6BF88324F08845DFA9A9B3A2CB30ED00CB56

Function 006C6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006C6E04
SysAllocString.OLEAUT32(00000000), ref: 006C6EAD
VariantCopy.OLEAUT32 ref: 006C6EDC
VariantClear.OLEAUT32(?), ref: 006C6F03

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: fdd730b9acdb3879977dc5248e5908c91aa207c1afbf5223b2cbfb4be14fbe7b
Instruction ID: 0bd662b922d98060b34a8ee29d8306f241679b0ab04888279e61e2826f331534
Opcode Fuzzy Hash: fdd730b9acdb3879977dc5248e5908c91aa207c1afbf5223b2cbfb4be14fbe7b
Instruction Fuzzy Hash: 085191617087019BDB60AF69D895F7AB3E7EF48310F20881FF55ACB291DA709841DF19

Function 006E6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 006E6CE4
WSAGetLastError.WSOCK32(00000000), ref: 006E6CF4

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 006E6D58
WSAGetLastError.WSOCK32(00000000), ref: 006E6D64

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: cd4f6d49a409fd1f6277e3f2794b2f244288a08fc46edd82f12d8e7ae4589f89
Instruction ID: 0ce44d35cc368ba14aae2e882317911199e9a6418958b53e8d22332ef2d1d0ab
Opcode Fuzzy Hash: cd4f6d49a409fd1f6277e3f2794b2f244288a08fc46edd82f12d8e7ae4589f89
Instruction Fuzzy Hash: EA417E74740200AFEB60AF24DC86F7A77E69F44B20F44C41CFA599B2D2DA719D008B99

Function 006E672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,006FF910), ref: 006E67BA
_strlen.LIBCMT ref: 006E67EC

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 3f25783f8a8e12a5a8720ebbe604c63590dea0ede2dd05bf1832f1621a66d95e
Instruction ID: 2c2e36111840a64b8f8f50ba8e7acf70a42a531c476d66bdcb33b5016365ea38
Opcode Fuzzy Hash: 3f25783f8a8e12a5a8720ebbe604c63590dea0ede2dd05bf1832f1621a66d95e
Instruction Fuzzy Hash: 9F41B631901204ABCB54EB65DCC5EBEB3ABEF14354F14816DF51A97292DB709D00CB64

Function 006DBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 006DBB09
GetLastError.KERNEL32(?,00000000), ref: 006DBB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 006DBB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 006DBB80

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: bd09b7e8fcf1e1be41dadb8cb3dc9b7373d31240d629d6b533c34dfbc9b0ded1
Instruction ID: 73320d9f4a8855ce02f5ae0acf32d54f14efbdc92a67b3bb2884e5933c579332
Opcode Fuzzy Hash: bd09b7e8fcf1e1be41dadb8cb3dc9b7373d31240d629d6b533c34dfbc9b0ded1
Instruction Fuzzy Hash: 5B412539600610DFCF11EF15C584A5DBBE2EF89320B09C499E94A9B366CB34FD01CBA5

Function 006FADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 006FAE1A
GetWindowRect.USER32(?,?), ref: 006FAE90
PtInRect.USER32(?,?,006FC304), ref: 006FAEA0
MessageBeep.USER32(00000000), ref: 006FAF11

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 8a9ffc971372f78386e6b332588a4e88ef49c8f1f43eb22e29f0d010178e3dc4
Instruction ID: 834d8c6773fa98e1c4f69173bf5d406f1b97969ef5695064db89cbe50485b03d
Opcode Fuzzy Hash: 8a9ffc971372f78386e6b332588a4e88ef49c8f1f43eb22e29f0d010178e3dc4
Instruction Fuzzy Hash: 87417EB4600219EFDB11CF98C884AB9BBF7FF88351F1481A9E618CB351D730A802DB52

Function 006D0FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 006D1037
SetKeyboardState.USER32(00000080,?,00000001), ref: 006D1053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 006D10B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 006D110B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 3df29db8c17964c41ccc3a299700bf5654f30d1ddeec0374b8e2e82679bdb395
Instruction ID: 3b53ac1b3547679ad7614ef3604c6994910a16ff312fc0a7c5df75c40add2f19
Opcode Fuzzy Hash: 3df29db8c17964c41ccc3a299700bf5654f30d1ddeec0374b8e2e82679bdb395
Instruction Fuzzy Hash: 76314D70E40688BEFB30AB658C05BF9BBABAF46310F04421BE5805A3D1CBB449C1D765

Function 006D1121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,753DC0D0,?,00008000), ref: 006D1176
SetKeyboardState.USER32(00000080,?,00008000), ref: 006D1192
PostMessageW.USER32(00000000,00000101,00000000), ref: 006D11F1
SendInput.USER32(00000001,?,0000001C,753DC0D0,?,00008000), ref: 006D1243

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5e84a161f7af7a3ae3016e3ee9c9fa0834257714ad841ce0dd7800993e0d04bb
Instruction ID: cad64c5220852954355cb3ca873d1872e58b73bdff9778b4de23bf213fae6e11
Opcode Fuzzy Hash: 5e84a161f7af7a3ae3016e3ee9c9fa0834257714ad841ce0dd7800993e0d04bb
Instruction Fuzzy Hash: 86312830E40618BAFF308B658C04BFABBABAB5A310F04431FE590DA7D1C3B58A95D755

Function 006A6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 006A644B
__isleadbyte_l.LIBCMT ref: 006A6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 006A64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 006A64DD

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f5655fc8453a6720c996b41ec7022badc619758c431688d66df54fa420ab87b4
Instruction ID: 769b4d903548d9b14553e9a6a41d0cd4121765084a9c901758f51791ae659bec
Opcode Fuzzy Hash: f5655fc8453a6720c996b41ec7022badc619758c431688d66df54fa420ab87b4
Instruction Fuzzy Hash: 3A31CF31604246AFDB21AF64C844AAA7BEAFF4A310F198029F85487291E731DC51DF90

Function 006F5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 006F5189

Part of subcall function 006D387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 006D3897
Part of subcall function 006D387D: GetCurrentThreadId.KERNEL32 ref: 006D389E
Part of subcall function 006D387D: AttachThreadInput.USER32(00000000,?,006D52A7), ref: 006D38A5

GetCaretPos.USER32(?), ref: 006F519A
ClientToScreen.USER32(00000000,?), ref: 006F51D5
GetForegroundWindow.USER32 ref: 006F51DB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 725754a5395642f25ea2ed2bf0740d6be17f250c967b1e0e2998d2cd0a6d7e45
Instruction ID: c772d7d2cb9326001b82371b6a01127414b94deef3733dcfa612a3ff68f30844
Opcode Fuzzy Hash: 725754a5395642f25ea2ed2bf0740d6be17f250c967b1e0e2998d2cd0a6d7e45
Instruction Fuzzy Hash: 5C313E71D00108AFDB40EFA5C885DEFB7FAEF98300F10806AE515E7251EA759E05CBA4

Function 006FC788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

GetCursorPos.USER32(?), ref: 006FC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,006ABBFB,?,?,?,?,?), ref: 006FC7D7
GetCursorPos.USER32(?), ref: 006FC824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,006ABBFB,?,?,?), ref: 006FC85E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: fdb337ec1a62c3ce1301831d3f7d8d83fa60e2103aaa1e67165fecee08779be4
Instruction ID: 12040065263ae03e8897ed798a9fcd08d3d9abbfb0f46b61ee1813afd33d1ee9
Opcode Fuzzy Hash: fdb337ec1a62c3ce1301831d3f7d8d83fa60e2103aaa1e67165fecee08779be4
Instruction Fuzzy Hash: CD31593560001CAFDB158F58C898EFA7BABFB49360F048069FA158B261C7369951DBA4

Function 00690BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00690BF2

Part of subcall function 00675B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,006D7B20,?,?,00000000), ref: 00675B8C
Part of subcall function 00675B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,006D7B20,?,?,00000000,?,?), ref: 00675BB0

_fprintf.LIBCMT ref: 00690C29
OutputDebugStringW.KERNEL32(?), ref: 006C6331

Part of subcall function 00694CDA: _flsall.LIBCMT ref: 00694CF3

__setmode.LIBCMT ref: 00690C5E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 8e00236fd76e2d334882b829b24f17e859bfa858de03e0167c56c7d4b0354c90
Instruction ID: 4555dd0b15e456404f4928c43e4ccc2b3e24eadf55e4f6f4a2cfce69033dc625
Opcode Fuzzy Hash: 8e00236fd76e2d334882b829b24f17e859bfa858de03e0167c56c7d4b0354c90
Instruction Fuzzy Hash: 90110232904208BEEF44B3B49C46DBE7BAFDF45320F14415EF20897682DE61594283AD

Function 006C8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006C8669
Part of subcall function 006C8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006C8673
Part of subcall function 006C8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006C8682
Part of subcall function 006C8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006C8689
Part of subcall function 006C8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006C869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 006C8BEB
_memcmp.LIBCMT ref: 006C8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006C8C44
HeapFree.KERNEL32(00000000), ref: 006C8C4B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 2b7357774fa918e6dd2893890a7c1cc8a5e7288e214190642b1047231c897564
Instruction ID: f98e8bd48cdda9c1972d60468cbf9fa4c4eca7f5be92e61657b679ba017d54a4
Opcode Fuzzy Hash: 2b7357774fa918e6dd2893890a7c1cc8a5e7288e214190642b1047231c897564
Instruction Fuzzy Hash: 3C215772E01209AFDB20DFA4C945FFEB7BAEF44355F154099E554AB240DB31AE06CB60

Function 006E1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006E1A97

Part of subcall function 006E1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006E1B40
Part of subcall function 006E1B21: InternetCloseHandle.WININET(00000000), ref: 006E1BDD

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 6c4161a1fd20a7536b06438d13912b3137cbc8a2196acac87795d656ec038bcb
Instruction ID: e62ac0087767ed6fd798ae7627e5a814c916c707b56d74aa7eaedb2f910880af
Opcode Fuzzy Hash: 6c4161a1fd20a7536b06438d13912b3137cbc8a2196acac87795d656ec038bcb
Instruction Fuzzy Hash: 9D21A435202745BFDB119F629C01FBAB7AFFF45701F10001AFA119A650E771E815EB94

Function 006CE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006CF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,006CE1C4,?,?,?,006CEFB7,00000000,000000EF,00000119,?,?), ref: 006CF5BC
Part of subcall function 006CF5AD: lstrcpyW.KERNEL32(00000000,?,?,006CE1C4,?,?,?,006CEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 006CF5E2
Part of subcall function 006CF5AD: lstrcmpiW.KERNEL32(00000000,?,006CE1C4,?,?,?,006CEFB7,00000000,000000EF,00000119,?,?), ref: 006CF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,006CEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 006CE1DD
lstrcpyW.KERNEL32(00000000,?,?,006CEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 006CE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,006CEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 006CE237

Strings

cdecl, xrefs: 006CE22E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 7bef18efd01e5ad992efbe9229e64802608a7feb98b34d9cf0d5bc6cfff97724
Instruction ID: b1580f8231cc2edb557660d62021ff556e0e447e5e0a44377ebac42dc1367677
Opcode Fuzzy Hash: 7bef18efd01e5ad992efbe9229e64802608a7feb98b34d9cf0d5bc6cfff97724
Instruction Fuzzy Hash: 2511BE36200305EFCB25AF64D845FBA77BAFF85350B40802EE906CB260EB769951D7A4

Function 006A5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006A5351

Part of subcall function 0069594C: __FF_MSGBANNER.LIBCMT ref: 00695963
Part of subcall function 0069594C: __NMSG_WRITE.LIBCMT ref: 0069596A
Part of subcall function 0069594C: RtlAllocateHeap.NTDLL(015B0000,00000000,00000001,00000000,?,?,?,00691013,?), ref: 0069598F

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: d00e3c44e68c7c39c65ba48cefebcedfcaa7d32efb1fd019c96adbde1b37ebf8
Instruction ID: 9eaf9d54774d1f8baa9cb92ecb8deb216d1e579d81c215135b91f6e9f1eef8c0
Opcode Fuzzy Hash: d00e3c44e68c7c39c65ba48cefebcedfcaa7d32efb1fd019c96adbde1b37ebf8
Instruction Fuzzy Hash: E011E332504A15AFCF317F70AC446AE379FAF563A0B10442EF9069B690EEB68D418B94

Function 00674531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00674560

Part of subcall function 0067410D: _memset.LIBCMT ref: 0067418D
Part of subcall function 0067410D: _wcscpy.LIBCMT ref: 006741E1
Part of subcall function 0067410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006741F1

KillTimer.USER32(?,00000001,?,?), ref: 006745B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006745C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006AD6CE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 4f90d04f8cdb2bb7e9fd43e15592368f267bc4680fb7e757057c4c71fcd9eaec
Instruction ID: 78a8f9a13af9e89f9e2fb3b680efcf21e28e8726f3fb3053ea12b46e4e946325
Opcode Fuzzy Hash: 4f90d04f8cdb2bb7e9fd43e15592368f267bc4680fb7e757057c4c71fcd9eaec
Instruction Fuzzy Hash: DF210770904794AFFB329B24D849BE7BBEE9F02304F00509DE69E56281C7745E85CF51

Function 006D40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 006D40D1
_memset.LIBCMT ref: 006D40F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 006D4144
CloseHandle.KERNEL32(00000000), ref: 006D414D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 01282dec5954ee47b6b9271fcdda5b8626b33fa9d9c3d84398bbf670d30b44a3
Instruction ID: 1ede0f46c101a338f4cf015721aa83061d9faa868be1966e28a5c4e333ce25eb
Opcode Fuzzy Hash: 01282dec5954ee47b6b9271fcdda5b8626b33fa9d9c3d84398bbf670d30b44a3
Instruction Fuzzy Hash: 18119476D012287AD7309BA5AC4DFABBB7DEF44760F1041AAF908D7280D6744E80CBA4

Function 006E667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00675B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,006D7B20,?,?,00000000), ref: 00675B8C
Part of subcall function 00675B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,006D7B20,?,?,00000000,?,?), ref: 00675BB0

gethostbyname.WSOCK32(?,?,?), ref: 006E66AC
WSAGetLastError.WSOCK32(00000000), ref: 006E66B7
_memmove.LIBCMT ref: 006E66E4
inet_ntoa.WSOCK32(?), ref: 006E66EF

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: bb6b464765a09fccc80e662857197c25ceb7399c553f106b2fe3da7ef7174b0a
Instruction ID: 30bb0e3786e65467c952fd89ce388039794e4cbd7b8e15f49bb028b1857d9dae
Opcode Fuzzy Hash: bb6b464765a09fccc80e662857197c25ceb7399c553f106b2fe3da7ef7174b0a
Instruction Fuzzy Hash: 0C116335500609AFCB40FBA4DD96DEE77BAEF14310B148069F506A7261DF709E04CB65

Function 006C9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 006C9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006C9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006C906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006C9086

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 688295905960265ad16dc64ffb679b255b3b6c0ac7cbd64c99f5a275403170d5
Instruction ID: ec4bf5a83c5c6e89aa7388ef421e1ecf9cbae641b0bc36cf9397bf18212b1124
Opcode Fuzzy Hash: 688295905960265ad16dc64ffb679b255b3b6c0ac7cbd64c99f5a275403170d5
Instruction Fuzzy Hash: D9114C79A00218FFDB10DFA5C884FADBB75FB48310F204099E904B7250D6716E10DBA4

Function 00671290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

DefDlgProcW.USER32(?,00000020,?), ref: 006712D8
GetClientRect.USER32(?,?), ref: 006AB84B
GetCursorPos.USER32(?), ref: 006AB855
ScreenToClient.USER32(?,?), ref: 006AB860

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 026682f3415174e212e705e0ddf4bedf87979da344bc4af482e4127462fd3c4e
Instruction ID: 8965e1a2b03bc4d58643eddf7f6de72376844f4e3543f64b3dac2074e2eec33d
Opcode Fuzzy Hash: 026682f3415174e212e705e0ddf4bedf87979da344bc4af482e4127462fd3c4e
Instruction Fuzzy Hash: BE113D35500019BFCB00EFA8D8859FE77BAEF06301F108556F915E7252C730BA91CBA9

Function 006D1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,006D01FD,?,006D1250,?,00008000), ref: 006D166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,006D01FD,?,006D1250,?,00008000), ref: 006D1694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,006D01FD,?,006D1250,?,00008000), ref: 006D169E
Sleep.KERNEL32(?,?,?,?,?,?,?,006D01FD,?,006D1250,?,00008000), ref: 006D16D1

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 8b94e007ed98e1980c607474e8709c583f263587b3ae48c1514842bb5753d27e
Instruction ID: 75fc3cbd78fe156075816cef730c7f655365153817d85770e923653944d687ae
Opcode Fuzzy Hash: 8b94e007ed98e1980c607474e8709c583f263587b3ae48c1514842bb5753d27e
Instruction Fuzzy Hash: C7111831C0055DEBCF009FA5D948AEEBB79FF4A751F15409AEA40BA340CB709561CB96

Function 006A7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 006A722B

Part of subcall function 006A7912: __fltout2.LIBCMT ref: 006A793B

__cftog_l.LIBCMT ref: 006A7251
__cftoe_l.LIBCMT ref: 006A7283

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 7a5a5fd6d40cf32bb5532977263b1f96bce123ffd225d3e3cd77fe424454949a
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 28018C3204814ABBCF526E84DC019EE3F67BF2A340F088615FA1858131D337CAB1AF85

Function 006FB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006FB59E
ScreenToClient.USER32(?,?), ref: 006FB5B6
ScreenToClient.USER32(?,?), ref: 006FB5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006FB5F5

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 0c1adf45aba4cdc9007bf200900c7285725a762d7c7542ac9030435cd38d7afa
Instruction ID: b38e516198bf12734d4925b97e4ff8b7f82b65f4931916c51420b2a5301c2e2a
Opcode Fuzzy Hash: 0c1adf45aba4cdc9007bf200900c7285725a762d7c7542ac9030435cd38d7afa
Instruction Fuzzy Hash: 511134B9D00209EFDB41CF99C4849EEBBB5FF08310F105166E914E2220DB35AA55CF50

Function 006FB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006FB8FE
_memset.LIBCMT ref: 006FB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00737F20,00737F64), ref: 006FB93C
CloseHandle.KERNEL32 ref: 006FB94E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 84a6c3d59bedcd5d6bb6f93f03ba8e0eb62431e60615348bc0a1e42d7fc75f9e
Instruction ID: bfedb260e9f7114c8f1092ba2551164e135bd8ff47de068f87a32a750f11eca2
Opcode Fuzzy Hash: 84a6c3d59bedcd5d6bb6f93f03ba8e0eb62431e60615348bc0a1e42d7fc75f9e
Instruction Fuzzy Hash: 23F03AF254431A7BF6202765AC06FBB3A9DEB09355F009020BA08D5292D7794912C7AC

Function 006D6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006D6E88

Part of subcall function 006D794E: _memset.LIBCMT ref: 006D7983

_memmove.LIBCMT ref: 006D6EAB
_memset.LIBCMT ref: 006D6EB8
LeaveCriticalSection.KERNEL32(?), ref: 006D6EC8

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 019e535366cc4da0e26fa25ba3189e66744431523d8ac63d1a6124c1d5ac851d
Instruction ID: 0f571f91429596542fa39509bb0f363e676b531b6c4cade3a38e0bcc4cef7b6b
Opcode Fuzzy Hash: 019e535366cc4da0e26fa25ba3189e66744431523d8ac63d1a6124c1d5ac851d
Instruction Fuzzy Hash: 68F0543A100210ABCF416F55DC85A59BB2BEF45320B048065FE085F21AC731A911DBB9

Function 006FC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 006712F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0067134D
Part of subcall function 006712F3: SelectObject.GDI32(?,00000000), ref: 0067135C
Part of subcall function 006712F3: BeginPath.GDI32(?), ref: 00671373
Part of subcall function 006712F3: SelectObject.GDI32(?,00000000), ref: 0067139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 006FC030
LineTo.GDI32(00000000,?,?), ref: 006FC03D
EndPath.GDI32(00000000), ref: 006FC04D
StrokePath.GDI32(00000000), ref: 006FC05B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 20a97e9e52e265eb6145bd8005fc9e9f0ab58014cdbfd2766acfdb5348918460
Instruction ID: 2e423c22cd778edf575984236d6f646f920af1cc6143e55fbe7a9fe18df59db5
Opcode Fuzzy Hash: 20a97e9e52e265eb6145bd8005fc9e9f0ab58014cdbfd2766acfdb5348918460
Instruction Fuzzy Hash: CFF05E3100525DBBDB126F54AC09FEE3F5AAF0A321F048010FB11651E28BB95661DFA9

Function 006CA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 006CA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 006CA3AC
GetCurrentThreadId.KERNEL32 ref: 006CA3B3
AttachThreadInput.USER32(00000000), ref: 006CA3BA

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: a55b4c5181e287479ba3a3b4b42d431f25c8e4c1f4e53f3746f2db57ec7d088c
Instruction ID: 02eba31dbc1224bd26b21291d0ff840615ccef192d697b30b8fe563c2c527aae
Opcode Fuzzy Hash: a55b4c5181e287479ba3a3b4b42d431f25c8e4c1f4e53f3746f2db57ec7d088c
Instruction Fuzzy Hash: EDE03931145268BADB205BA2DC0CFF73F1EEF167A1F008028F908C80A0CA718941CBA0

Function 00672218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00672231
SetTextColor.GDI32(?,000000FF), ref: 0067223B
SetBkMode.GDI32(?,00000001), ref: 00672250
GetStockObject.GDI32(00000005), ref: 00672258
GetWindowDC.USER32(?,00000000), ref: 006AC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 006AC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 006AC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 006AC112
GetPixel.GDI32(00000000,?,?), ref: 006AC132
ReleaseDC.USER32(?,00000000), ref: 006AC13D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 5fb60aa0953e1160cdecfd3020385a5b0a5d6805046454a4352c9fa315455abf
Instruction ID: 936aa632a946fc0c71e481a6addf818fed7ea2bb9f7b9ce876608f7be370999f
Opcode Fuzzy Hash: 5fb60aa0953e1160cdecfd3020385a5b0a5d6805046454a4352c9fa315455abf
Instruction Fuzzy Hash: CEE0C932604244EADB219F64EC497E87B16AB16336F148366FA69581E187724990DB11

Function 006C8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 006C8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,006C882E), ref: 006C8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,006C882E), ref: 006C8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,006C882E), ref: 006C8C7E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: f44c88e29940422886c96ca2b830910bd092784e446a42551e5aacb225246677
Instruction ID: cedf9b740377978d0f76d15cbe51e7f7de11065c606c8bc7b5773d1a04a84927
Opcode Fuzzy Hash: f44c88e29940422886c96ca2b830910bd092784e446a42551e5aacb225246677
Instruction Fuzzy Hash: D5E08C36642311EFD7205FB0AD0DFB63BAEEF51792F085838B286CA080EA348441CB61

Function 006B2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 006B2187
GetDC.USER32(00000000), ref: 006B2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 006B21B1
ReleaseDC.USER32(?), ref: 006B21D2

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 30563d0d84d2770e8375c2ca49aaf50bb6d5117fc7c3491856687aac36232d9f
Instruction ID: 4313c96144a13a1a88af9b1a833563f628f61a5e64f6fd6f090f3af2bd952685
Opcode Fuzzy Hash: 30563d0d84d2770e8375c2ca49aaf50bb6d5117fc7c3491856687aac36232d9f
Instruction Fuzzy Hash: 13E0CAB5800204AFDB019FA0C848AAD7BF2EF48360F108429E95AE6220CB398182EF40

Function 006B219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 006B219B
GetDC.USER32(00000000), ref: 006B21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 006B21B1
ReleaseDC.USER32(?), ref: 006B21D2

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 58a89249fbc55b030cc4a5088b94aee97100a77ffa0c642ba20206e323ed87e7
Instruction ID: 58bfe058b41a0eb4b6dd3cdea0b66b4d05f2704e3f91819746d226caa83d5539
Opcode Fuzzy Hash: 58a89249fbc55b030cc4a5088b94aee97100a77ffa0c642ba20206e323ed87e7
Instruction Fuzzy Hash: 7BE0EEB5800204AFCF019FA0C8486AD7BF2EF4C320F108029F95AE7220CF399142DF40

Function 006763A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%p, xrefs: 006763AE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID: %p
API String ID: 0-1556559175
Opcode ID: 507997103755a28d22bf8b530705f8f970e84e3b0510b369b6823224087d77e9
Instruction ID: 77f74b701b332435b085a83fa2eb2bc481dc21bfa5c829c673b290a6f0041c9c
Opcode Fuzzy Hash: 507997103755a28d22bf8b530705f8f970e84e3b0510b369b6823224087d77e9
Instruction Fuzzy Hash: F2B1B17180050A9BCF14EF98C8819FDB7B6EF44310F54C16AF90AA7295EB359E82CB65

Function 006EB1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 006EB2C3

Strings

xrs, xrefs: 006EB2F9
xrs, xrefs: 006EB325

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __itow_s
String ID: xrs$xrs
API String ID: 3653519197-465849748
Opcode ID: 54e5b3033e84d4482e0b31d33a06708af23190463a2d8504392193399d10202e
Instruction ID: 292217d252249bb4771cf9d9536c7d361ffe094facac95388280e8337aceafde
Opcode Fuzzy Hash: 54e5b3033e84d4482e0b31d33a06708af23190463a2d8504392193399d10202e
Instruction Fuzzy Hash: 95B17E70A00249EFDB14DF55C881DAEB7FAFF58300F149469F9459B292EB70EA41CB64

Function 006DB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0068FEC6: _wcscpy.LIBCMT ref: 0068FEE9

Part of subcall function 00679997: __itow.LIBCMT ref: 006799C2
Part of subcall function 00679997: __swprintf.LIBCMT ref: 00679A0C

__wcsnicmp.LIBCMT ref: 006DB298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 006DB361

Strings

LPT, xrefs: 006DB292

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 6ff1202bcf7422bfb6a0f457f5edbf62b94dafadcd607e25bd4b5c7cc1f1ca2f
Instruction ID: a9ae044fa9f22fe791af59554bc9710150f1477b8b8aef3f6659679ef0e0ad61
Opcode Fuzzy Hash: 6ff1202bcf7422bfb6a0f457f5edbf62b94dafadcd607e25bd4b5c7cc1f1ca2f
Instruction Fuzzy Hash: 53616E75E00215EFCB14DB94C881EAEB7F6AF48310F16915AF506AB391DB70AE40DB94

Function 006B8A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006B8B1E
_memmove.LIBCMT ref: 006B8B78

Strings

Oah, xrefs: 006B8BF2, 006BE39A, 006BE3B6

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _memmove
String ID: Oah
API String ID: 4104443479-3137904739
Opcode ID: 36e9a697a148e0b04d02d90bb8fb97fa5ba96cc60a1cecb2d8038a8848d8e05a
Instruction ID: 8c72ed7ec19fd9e5142aad6cede581e6750282b87ec91be9af00f42361d9c3f9
Opcode Fuzzy Hash: 36e9a697a148e0b04d02d90bb8fb97fa5ba96cc60a1cecb2d8038a8848d8e05a
Instruction Fuzzy Hash: 33512EB0A00619DFCB64CF68C480AEEB7F6FF44314F14856AE85AD7350EB31A995CB51

Function 00682AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00682AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00682AE1

Strings

@, xrefs: 00682AD5

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 967cdebbf4a4769be209a695f03bc273c3715fc793cb3e57d1248bf45bab0a7a
Instruction ID: 9ce4dc1441c8322b3c02795fe3cb0f739dbfc7d038954aeabc4cba377a61d331
Opcode Fuzzy Hash: 967cdebbf4a4769be209a695f03bc273c3715fc793cb3e57d1248bf45bab0a7a
Instruction Fuzzy Hash: 615144724287449BD360AF14DC86BAFBBF8FF85314F82885DF1D9411A5DB308529CB2A

Function 006D99BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0067506B: __fread_nolock.LIBCMT ref: 00675089

_wcscmp.LIBCMT ref: 006D9AAE
_wcscmp.LIBCMT ref: 006D9AC1

Strings

FILE, xrefs: 006D99FA

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 131502369f56ecf4fac32d75b4faafd4348b7b0dd1e2892ef98f1824c3bcd475
Instruction ID: f8a9ca88979c2b99116d97a8f4283dfcc210d79163502759cc1bd01da71912ad
Opcode Fuzzy Hash: 131502369f56ecf4fac32d75b4faafd4348b7b0dd1e2892ef98f1824c3bcd475
Instruction Fuzzy Hash: D041D671A00619BADF209AA0DC85FEFBBBEDF45710F01406EB905B7281DAB59E0487A5

Function 006B099E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 006B09A9

Strings

Dts, xrefs: 0067A2B1
Dts, xrefs: 0067A477

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClearVariant
String ID: Dts$Dts
API String ID: 1473721057-3648379613
Opcode ID: ee98be42a82d370e8b79ca62af19ae4a04cca09ce4676459230ce077a3c81ba1
Instruction ID: 0d9a8795173b141372775cd76141b50f9b89cc13adbcdecd1f72b8463e7c52a0
Opcode Fuzzy Hash: ee98be42a82d370e8b79ca62af19ae4a04cca09ce4676459230ce077a3c81ba1
Instruction Fuzzy Hash: E251D5B4608341DFD764CF59C480A5ABBF2BB99354F54895CE9898B321D732E881CB52

Function 006E2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006E2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 006E28C8

Strings

|, xrefs: 006E2899

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: afc503b68b70d1fd67df8d51cbb0aed0b90e69d02d002e6ad8b845b979ac941a
Instruction ID: 48b963821f355b14d7c3fc362674b5b01cbe804cfc87a737426130c5b55a15aa
Opcode Fuzzy Hash: afc503b68b70d1fd67df8d51cbb0aed0b90e69d02d002e6ad8b845b979ac941a
Instruction Fuzzy Hash: 7431417180121AAFCF41DFA1CC85EEEBFBAFF08300F104069F815A6266DB315956DB60

Function 006F6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 006F6D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 006F6DC2

Strings

static, xrefs: 006F6D22

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 73a7b9a50b352bd10a519b01dc956860dc930b96115d302704172f173d9b690e
Instruction ID: 3e40a957eb15b6ea370b23c463fd7001ce093106831fd1f728f018e1952163a6
Opcode Fuzzy Hash: 73a7b9a50b352bd10a519b01dc956860dc930b96115d302704172f173d9b690e
Instruction Fuzzy Hash: 3031A171200208AEDB109F34CC40AFB77BAFF48720F10961DF9A987290CB71AC51CB64

Function 006D2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006D2E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 006D2E3B

Strings

0, xrefs: 006D2DF9

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 2ef0aed8d26114599cf11ac7d9e6aea6ff55ad2bc79ce9e7dadb5f7fd9977a2a
Instruction ID: e46148b60bd59869044d3b2704483ef1b853757b00a7d804de76d52065639ff1
Opcode Fuzzy Hash: 2ef0aed8d26114599cf11ac7d9e6aea6ff55ad2bc79ce9e7dadb5f7fd9977a2a
Instruction Fuzzy Hash: E831D531E0030AABEB248F58C985BEEBBBBEF55350F14442FE985973A1E7709941CB54

Function 006CAFDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0068619A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 006861B1

SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 006CB03B
_strlen.LIBCMT ref: 006CB046

Strings

@U=u, xrefs: 006CB03B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$Timeout_strlen
String ID: @U=u
API String ID: 2777139624-2594219639
Opcode ID: 911fa302d70e237d440fd505d693bfcc19539df7ec26049f467d122de5439669
Instruction ID: 12e442b5db271e430134d64fc653876530a5f8896bdad1f61d945d50e08e4fd5
Opcode Fuzzy Hash: 911fa302d70e237d440fd505d693bfcc19539df7ec26049f467d122de5439669
Instruction Fuzzy Hash: 3E11C33170420566CB54AA789883FBF7B6FDF45700F10106EFA1A9A293DE2689459258

Function 006F6AD4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D589F: GetLocalTime.KERNEL32 ref: 006D58AC
Part of subcall function 006D589F: _wcsncpy.LIBCMT ref: 006D58E1
Part of subcall function 006D589F: _wcsncpy.LIBCMT ref: 006D5913
Part of subcall function 006D589F: _wcsncpy.LIBCMT ref: 006D5946
Part of subcall function 006D589F: _wcsncpy.LIBCMT ref: 006D5988

SendMessageW.USER32(?,00001002,00000000,?), ref: 006F6B6E

Strings

@U=u, xrefs: 006F6B6E
SysDateTimePick32, xrefs: 006F6B2C

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _wcsncpy$LocalMessageSendTime
String ID: @U=u$SysDateTimePick32
API String ID: 2466184910-2530228043
Opcode ID: f7f5295d7b54f31432de569d274e73d8e6266395f78ea34821dc54483d65ea43
Instruction ID: 1bd14117a7ecac00f2ffd157a7dcacf005aec61220fed87f4ab0dbb3c20074f4
Opcode Fuzzy Hash: f7f5295d7b54f31432de569d274e73d8e6266395f78ea34821dc54483d65ea43
Instruction Fuzzy Hash: D121063134020D7FEF219E24CC82FFA736AEB54760F104519FA50EB2D0D6B1AC519BA0

Function 006C9707 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006C9720

Part of subcall function 006D18EE: GetWindowThreadProcessId.USER32(?,?), ref: 006D1919
Part of subcall function 006D18EE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,006C973C,00000034,?,?,00001004,00000000,00000000), ref: 006D1929
Part of subcall function 006D18EE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,006C973C,00000034,?,?,00001004,00000000,00000000), ref: 006D193F

Part of subcall function 006D19CC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006C9778,?,?,00000034,00000800,?,00000034), ref: 006D19F6

SendMessageW.USER32(?,00001073,00000000,?), ref: 006C9787

Part of subcall function 006D1997: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006C97A7,?,?,00000800,?,00001073,00000000,?,?), ref: 006D19C1

Strings

@U=u, xrefs: 006C9720, 006C9787

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Process$MemoryMessageSend$AllocOpenReadThreadVirtualWindowWrite
String ID: @U=u
API String ID: 1045663743-2594219639
Opcode ID: 1bcd026ec4e1245609eae7769618d2b4c01d09cad548fbbd7718c5193926cbb5
Instruction ID: 60e5ce7ea9ab01a49c0d6ae8d9c7c18ecada4abfe816373424eaa0c975479d11
Opcode Fuzzy Hash: 1bcd026ec4e1245609eae7769618d2b4c01d09cad548fbbd7718c5193926cbb5
Instruction Fuzzy Hash: F2215131902129ABDF51EFA4CC45FE9BBBAFF09350F1001A9F944EB290DA715A44DBA4

Function 0067C68D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 0067C73D

Strings

g, xrefs: 0067C6E9
g, xrefs: 0067C6D5

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: _wcscmp
String ID: g$g
API String ID: 856254489-2431062506
Opcode ID: ca3ab316ddfb4623b7714a5f984974613f76d9099da4567b19bb8db169cdcd42
Instruction ID: b8d82fab3ca9147f86c618557fe877f386c13dbaa0109d0fb962b14ca0699ab9
Opcode Fuzzy Hash: ca3ab316ddfb4623b7714a5f984974613f76d9099da4567b19bb8db169cdcd42
Instruction Fuzzy Hash: 8721B172808346DFC71ADF69D891599FFBAEF57310F09809AC8589F2A2E3319D41CB51

Function 006F6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 006F69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006F69DB

Strings

Combobox, xrefs: 006F699D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 7b23e649f99b3745d2bd9a1fa711cf6390d43c983d4c4e2aad2a5076b932fbfe
Instruction ID: e6ddfc7fa089adb38fdcf403aea4697ce53ea112dae6314182900585351c8594
Opcode Fuzzy Hash: 7b23e649f99b3745d2bd9a1fa711cf6390d43c983d4c4e2aad2a5076b932fbfe
Instruction Fuzzy Hash: C211827160420E7FEF119F24CC90EFB376BEB993A4F114129FA589B390D6B59C518BA0

Function 006F9962 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

@U=u, xrefs: 006F99E7, 006F9A10

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID:
String ID: @U=u
API String ID: 0-2594219639
Opcode ID: b8e4cd2b7b4f356caa52997e25d53b202be748eb479f30855853701e809a6d67
Instruction ID: 3bcf5a9a1b9d30e211219ccf2ebd06b70fe101193b0e86b89ab2403e73593af9
Opcode Fuzzy Hash: b8e4cd2b7b4f356caa52997e25d53b202be748eb479f30855853701e809a6d67
Instruction Fuzzy Hash: 8E218C3120810CBFEB109F648C41FFA37A6EB0A310F044159FB16EA2E1D6B09951DB74

Function 006F6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00671D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00671D73
Part of subcall function 00671D35: GetStockObject.GDI32(00000011), ref: 00671D87
Part of subcall function 00671D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00671D91

GetWindowRect.USER32(00000000,?), ref: 006F6EE0
GetSysColor.USER32(00000012), ref: 006F6EFA

Strings

static, xrefs: 006F6EBD

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: fd7fb3fd1eee598e3ad37b5f5f25c54af8dfe73eec407ed40602044c2d7b2193
Instruction ID: 3d807b0490963cc84863865ded239abb1f1d001227e3291e64b465231ea43b53
Opcode Fuzzy Hash: fd7fb3fd1eee598e3ad37b5f5f25c54af8dfe73eec407ed40602044c2d7b2193
Instruction Fuzzy Hash: 0C215972610209AFDB04DFB8DC45AFA7BBAFF08314F004629FA55D3250D634E861DB50

Function 006D2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006D2F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 006D2F30

Strings

0, xrefs: 006D2F07

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 8dd047538d23de0c22970e13e4b31151462d1e7367c92a6899cb7ea1f490a8c5
Instruction ID: 1d74629f7e858446f345ff597ec533003cbe3edc4dcc66025986097b5f09b690
Opcode Fuzzy Hash: 8dd047538d23de0c22970e13e4b31151462d1e7367c92a6899cb7ea1f490a8c5
Instruction Fuzzy Hash: 3C11E231D01226ABDB21DB98DD54BE977BBEB29310F0480B7E844E73A0D7B0AD06C795

Function 006E24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 006E2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 006E2549

Strings

<local>, xrefs: 006E2511

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: a62630d77078d79595f8fb1a24a56193a298e4f0d8d420ed2b4fa62143085069
Instruction ID: 0dca517a6e8857eebe1e434cec3fc48216a79b4098028954611579990142ee6b
Opcode Fuzzy Hash: a62630d77078d79595f8fb1a24a56193a298e4f0d8d420ed2b4fa62143085069
Instruction Fuzzy Hash: F811C170102366FADB248F528CA8EFBFFAFFF05351F10812AF50546140D2705985DAA0

Function 006F8752 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 006F879F

Strings

@U=u, xrefs: 006F879F, 006F87DB

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 5bc66d645f6a250a9e50851c551074395be90e652cd36e9891704f7dc05ed670
Instruction ID: d713c66f35d64dd40b5a551db74d208ca921c801071f0f4022d1414b5a622b78
Opcode Fuzzy Hash: 5bc66d645f6a250a9e50851c551074395be90e652cd36e9891704f7dc05ed670
Instruction Fuzzy Hash: EC21D37A60410EEF8B15DF98D8809EE7BB6FB4D340B104198FE05A3320DA31AD61DBA0

Function 006F6825 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000401,?,00000000), ref: 006F689B

Strings

@U=u, xrefs: 006F689B
button, xrefs: 006F6872

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u$button
API String ID: 3850602802-1762282863
Opcode ID: f30cbad6457008402573bdb673dc2ea440fce089264dda5afcda5d76cd17c7ec
Instruction ID: d0473cd483a562faaddf79ab88f1a34e8ecd8f2f18ee27d857b6a0862e73ceed
Opcode Fuzzy Hash: f30cbad6457008402573bdb673dc2ea440fce089264dda5afcda5d76cd17c7ec
Instruction Fuzzy Hash: D211CE32140209ABDF118F60CC41BFA376BEF58354F11411CFB64A6290C776E891AB60

Function 006F7AFB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000133E,00000000,?), ref: 006F7B47

Strings

@U=u, xrefs: 006F7B47

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 637fa28e85bea43fd83aa626d65b6248a5bd6ae69bffef63dfb97af09a15c7a5
Instruction ID: 7db676737aa7ec3747dc741a7303f5f6b0729c954a9f73a1fb64c5df20cd848b
Opcode Fuzzy Hash: 637fa28e85bea43fd83aa626d65b6248a5bd6ae69bffef63dfb97af09a15c7a5
Instruction Fuzzy Hash: 82118130508748AFD720DF74C891AF7B7EABF06310F10851DEAAA97391DB716941DB60

Function 006E80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 006E830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,006E80C8,?,00000000,?,?), ref: 006E8322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 006E80CB
htons.WSOCK32(00000000,?,00000000), ref: 006E8108

Strings

255.255.255.255, xrefs: 006E80E3

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: c5e78944cef1b028805c080dd0a148b734605c929fa515e42f8665beed94a0c5
Instruction ID: 85749aaa17cf3d6828134b81189e18dc9e4fec0e0d30b58361a81c77e71fbeb9
Opcode Fuzzy Hash: c5e78944cef1b028805c080dd0a148b734605c929fa515e42f8665beed94a0c5
Instruction Fuzzy Hash: AB11E574500345AFDB10AFA5DC46FFDB326FF14310F10852AF91997391DA71A805C659

Function 006C9989 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D19CC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006C9778,?,?,00000034,00000800,?,00000034), ref: 006D19F6

SendMessageW.USER32(?,0000102B,?,00000000), ref: 006C99EB
SendMessageW.USER32(?,0000102B,?,00000000), ref: 006C9A10

Strings

@U=u, xrefs: 006C99EB, 006C9A10

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend$MemoryProcessWrite
String ID: @U=u
API String ID: 1195347164-2594219639
Opcode ID: a927fa8af54371a88d6b44336a74c006c9ed531a346b0c0bc235ec089f1111c5
Instruction ID: 15c6a3adf79d25f9a75343b5d6c0382229d0bd4fd4daf80c4323bdbe5ec3dfc5
Opcode Fuzzy Hash: a927fa8af54371a88d6b44336a74c006c9ed531a346b0c0bc235ec089f1111c5
Instruction Fuzzy Hash: 03012B32900218EBDB21AB64DC46FFABB7ADF04320F00016EF911A71D1DB705E54CB60

Function 00680A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00673C26,007362F8,?,?,?), ref: 00680ACE

Part of subcall function 00677D2C: _memmove.LIBCMT ref: 00677D66

_wcscat.LIBCMT ref: 006B50E1

Strings

cs, xrefs: 00680B0E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: cs
API String ID: 257928180-1676512382
Opcode ID: 78665708ab81a18af27f88a1412e20ad858ff4ec1f0f41a27a64f79605580c42
Instruction ID: 03452ba661e5641d749243276a709f227df82d59e7974228767b4aa953113366
Opcode Fuzzy Hash: 78665708ab81a18af27f88a1412e20ad858ff4ec1f0f41a27a64f79605580c42
Instruction Fuzzy Hash: 1711A535904208AADB90FBA4CC01ED973BAEF08340F0085A9B98DD7251EA74DB888B65

Function 006D901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006D9036
__fread_nolock.LIBCMT ref: 006D904B

Strings

EA06, xrefs: 006D907D

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 21579c060a7c7f380869b282dbd081ffc34eec2b05e8b8048fc671ceb145aa88
Instruction ID: 56d7eeeb88c79b21b826e2656af6ad14c3f43250d626c3722bce82cf1dd3ddf4
Opcode Fuzzy Hash: 21579c060a7c7f380869b282dbd081ffc34eec2b05e8b8048fc671ceb145aa88
Instruction Fuzzy Hash: 9001F971C042687EDF69C6A8D816EFE7BFC9B15301F00419FF552D2681E575E6048B60

Function 006FC86D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00672612: GetWindowLongW.USER32(?,000000EB), ref: 00672623

DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,006ABB8A,?,?,?), ref: 006FC8E1

Part of subcall function 006725DB: GetWindowLongW.USER32(?,000000EB), ref: 006725EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 006FC8C7

Strings

@U=u, xrefs: 006FC8C7

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: @U=u
API String ID: 982171247-2594219639
Opcode ID: a72f0dfa15e26d18cfc9cee60ac0101b2577b4293fa83ca0fafa3a6a115005f4
Instruction ID: e9c53fb6722470edb19be7c6054142b5d0ae1d5ffe3c641898bcc11d629d6bfd
Opcode Fuzzy Hash: a72f0dfa15e26d18cfc9cee60ac0101b2577b4293fa83ca0fafa3a6a115005f4
Instruction Fuzzy Hash: 6D01B53120020CABDB215F54CD94EB63FA7FF89364F144128FA654B2A1CB715842EB95

Function 00696DAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00696DD0
__calloc_crt.LIBCMT ref: 00696DE9

Strings

@Rs, xrefs: 00696E00

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: __calloc_crt
String ID: @Rs
API String ID: 3494438863-3462024066
Opcode ID: 2d5e770c09c26e3a1566ddc829f76db17b4b07caca36dd73c19a1db8e31f11b2
Instruction ID: 226f60bf114db605db811df39981fa124c1399374b41e2d914ab4ba8d62103c1
Opcode Fuzzy Hash: 2d5e770c09c26e3a1566ddc829f76db17b4b07caca36dd73c19a1db8e31f11b2
Instruction Fuzzy Hash: B7F06871308726ABFF65CF14FD01692279EFB05720B11C43AF111CB690EB3888455658

Function 006C9A1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006C9A2E
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 006C9A46

Strings

@U=u, xrefs: 006C9A2E, 006C9A46

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: b9684dd09c2fdefbb62175c66a760f5e7babe9b28f065bbda3979e4c04a601a9
Instruction ID: a380df08f86c13ec7ede54cd60563d7fbe44c79167ec8f7a281f09bb3a739068
Opcode Fuzzy Hash: b9684dd09c2fdefbb62175c66a760f5e7babe9b28f065bbda3979e4c04a601a9
Instruction Fuzzy Hash: 92E0653534135176F72056654C4EFF76E5BDF89B61F15102DBB01991D1CAD14841C2B4

Function 006CA1A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006CA1BA
SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 006CA1EA

Strings

@U=u, xrefs: 006CA1BA, 006CA1EA

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 5ecb86d2020da674c4c950aaee8ddde3fe782478421442f34b17ba6b03d4985b
Instruction ID: b2be5bdb56f2edd2bf36108a4ebe194d78512683c732b150b877ec00018876d0
Opcode Fuzzy Hash: 5ecb86d2020da674c4c950aaee8ddde3fe782478421442f34b17ba6b03d4985b
Instruction Fuzzy Hash: 1CF08C35244308BBEB126B909C8AFFA3A5EEF09BA5F00402CF7059A1A1D9E25C4097A4

Function 006CA327 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006C9E2E: SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 006C9E47
Part of subcall function 006C9E2E: SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 006C9E81

SendMessageW.USER32(?,0000110B,00000005,00000000), ref: 006CA34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 006CA35B

Strings

@U=u, xrefs: 006CA34B, 006CA35B

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: daecbf4323c7b74f6458880d18b2946d449f621954778ed2c211971ba0bc221f
Instruction ID: 293634804499e4ec7a94ab657545b5ce531ff0f3bd0cd4e2c4065c30ca95fc0d
Opcode Fuzzy Hash: daecbf4323c7b74f6458880d18b2946d449f621954778ed2c211971ba0bc221f
Instruction Fuzzy Hash: 95E092752083097BF7251B619C4AEB63B1EDF49755B11003DB200851A0EEA28C50A624

Function 006D51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 006D51E8
_wcscmp.LIBCMT ref: 006D51FA

Strings

#32770, xrefs: 006D51F4

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: ea1d70c416ff545230071ccf426a92080550ad705babe1a3d312415a83c33343
Instruction ID: 999ffd54118ac9ec5c5699f92ea8be40372369aaba727f00ac33746ebcd08ef2
Opcode Fuzzy Hash: ea1d70c416ff545230071ccf426a92080550ad705babe1a3d312415a83c33343
Instruction Fuzzy Hash: 12E02272A002286BEB20AA99AC49AA7F7ACEB40722F00006BF910D3140E5609A04CBE4

Function 006C81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 006C81CA

Part of subcall function 00693598: _doexit.LIBCMT ref: 006935A2

Strings

Error allocating memory., xrefs: 006C81C3
AutoIt, xrefs: 006C81BE

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 0fe68b8a8d575cc1a265d759e02229eb61e6ae72182df7907a05f4defe6ca4d6
Instruction ID: 524d52807a83b84009abbd7661cd5d62958ad2c0eb81c4195a27a4a857c01ac6
Opcode Fuzzy Hash: 0fe68b8a8d575cc1a265d759e02229eb61e6ae72182df7907a05f4defe6ca4d6
Instruction Fuzzy Hash: 52D02B323C032836D25033A42C0BFC6358D4F05B51F544019BB0C959C38ED688C182EC

Function 006AB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006AB564: _memset.LIBCMT ref: 006AB571

Part of subcall function 00690B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,006AB540,?,?,?,0067100A), ref: 00690B89

IsDebuggerPresent.KERNEL32(?,?,?,0067100A), ref: 006AB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0067100A), ref: 006AB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 006AB54E

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 8940ede1233abc382597d9bd99138f391940b030f986cc9ab57f9fb325f716f0
Instruction ID: 8cf56f6d203cf849af9299083dd888c679fe496129dce7d33cbe8a0302c0fc9a
Opcode Fuzzy Hash: 8940ede1233abc382597d9bd99138f391940b030f986cc9ab57f9fb325f716f0
Instruction Fuzzy Hash: 0EE06DB06003118FE760EF28D4083827BE5BF00714F04892CE446C2752E7B8D848CFA1

Function 006C98BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 006C98CB
SendMessageW.USER32(00000000,00001200,00000000,00000000), ref: 006C98D9

Strings

@U=u, xrefs: 006C98CB, 006C98D9

Memory Dump Source

Source File: 00000000.00000002.1377485282.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1377436750.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377724661.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1377785023.000000000072F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378259021.0000000000738000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_Xre0Nmqk09.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: a1204074186d058d71096d977918df21e15ac2bf0722377c28c06b65e2b5f929
Instruction ID: 27361197142272cac085e6ee0029d91cdafbbe9b24a0527ba5ad516fb4ed3688
Opcode Fuzzy Hash: a1204074186d058d71096d977918df21e15ac2bf0722377c28c06b65e2b5f929
Instruction Fuzzy Hash: 25C00231145180BAEB211B77AC0DD973E3EEFCBF52711116CB211D50B58A650095D628

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Xre0Nmqk09.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Lityerses

C:\Users\user\AppData\Local\Temp\aut49BE.tmp

C:\Users\user\AppData\Local\Temp\aut4E61.tmp

C:\Users\user\AppData\Local\Temp\aut5305.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Xre0Nmqk09.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre