Edit tour

Windows Analysis Report
prgNb8YFEA.exe

Overview

General Information

Sample name:	prgNb8YFEA.exe renamed because original name is a hash value
Original sample name:	e248994d1154ecc091a72040543631f6faf42e980b524193b6ea207262a374a7.exe
Analysis ID:	1588806
MD5:	5314dc731381de014b294374b0eb7666
SHA1:	9e3577f1495fdbb76115231a8a6680db0bed3632
SHA256:	e248994d1154ecc091a72040543631f6faf42e980b524193b6ea207262a374a7
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected Snake Keylogger

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Drops VBS files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Generic Downloader

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

prgNb8YFEA.exe (PID: 2644 cmdline: "C:\Users\user\Desktop\prgNb8YFEA.exe" MD5: 5314DC731381DE014B294374B0EB7666)

brontothere.exe (PID: 2892 cmdline: "C:\Users\user\Desktop\prgNb8YFEA.exe" MD5: 5314DC731381DE014B294374B0EB7666)

RegSvcs.exe (PID: 6952 cmdline: "C:\Users\user\Desktop\prgNb8YFEA.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

wscript.exe (PID: 4696 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

brontothere.exe (PID: 6448 cmdline: "C:\Users\user\AppData\Local\Milburr\brontothere.exe" MD5: 5314DC731381DE014B294374B0EB7666)

RegSvcs.exe (PID: 6480 cmdline: "C:\Users\user\AppData\Local\Milburr\brontothere.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "FTP", "FTP Server": "ftp://ftp.hogarsancamilo.org/", "FTP Username": "Johnson@hogarsancamilo.org", "Password": "eg0wtRsF5HKA", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.3754528656.000000000283B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1257:$a1: get_encryptedPassword 0x153b:$a2: get_encryptedUsername 0x1063:$a3: get_timePasswordChanged 0x115e:$a4: get_passwordField 0x126d:$a5: set_encryptedPassword 0x28ee:$a7: get_logins 0x2851:$a10: KeyLoggerEventArgs 0x24bc:$a11: KeyLoggerEventArgsEventHandler
00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x624d:$x1: $%SMTPDV$ 0x4c10:$x2: $#TheHashHere%& 0x4bbc:$x3: %FTPDV$ 0x6323:$x4: $%TelegramDv$ 0x24bc:$x5: KeyLoggerEventArgs 0x2851:$x5: KeyLoggerEventArgs 0x6219:$m2: Clipboard Logs ID 0x6473:$m2: Screenshot Logs ID 0x6583:$m2: keystroke Logs ID 0x685d:$m3: SnakePW 0x644b:$m4: \SnakeKeylogger\
0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14457:$a1: get_encryptedPassword 0x1473b:$a2: get_encryptedUsername 0x14263:$a3: get_timePasswordChanged 0x1435e:$a4: get_passwordField 0x1446d:$a5: set_encryptedPassword 0x15aee:$a7: get_logins 0x15a51:$a10: KeyLoggerEventArgs 0x156bc:$a11: KeyLoggerEventArgsEventHandler
0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be1f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b051:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b484:$a4: \Orbitum\User Data\Default\Login Data 0x1c4c3:$a5: \Kometa\User Data\Default\Login Data
0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15049:$s1: UnHook 0x15050:$s2: SetHook 0x15058:$s3: CallNextHook 0x15065:$s4: _hook
0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1944d:$x1: $%SMTPDV$ 0x17e10:$x2: $#TheHashHere%& 0x17dbc:$x3: %FTPDV$ 0x19523:$x4: $%TelegramDv$ 0x156bc:$x5: KeyLoggerEventArgs 0x15a51:$x5: KeyLoggerEventArgs 0x19419:$m2: Clipboard Logs ID 0x19673:$m2: Screenshot Logs ID 0x19783:$m2: keystroke Logs ID 0x19a5d:$m3: SnakePW 0x1964b:$m4: \SnakeKeylogger\
0000000C.00000002.3754528656.0000000002671000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14457:$a1: get_encryptedPassword 0x1473b:$a2: get_encryptedUsername 0x14263:$a3: get_timePasswordChanged 0x1435e:$a4: get_passwordField 0x1446d:$a5: set_encryptedPassword 0x15aee:$a7: get_logins 0x15a51:$a10: KeyLoggerEventArgs 0x156bc:$a11: KeyLoggerEventArgsEventHandler
00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be1f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b051:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b484:$a4: \Orbitum\User Data\Default\Login Data 0x1c4c3:$a5: \Kometa\User Data\Default\Login Data
00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15049:$s1: UnHook 0x15050:$s2: SetHook 0x15058:$s3: CallNextHook 0x15065:$s4: _hook
00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1944d:$x1: $%SMTPDV$ 0x17e10:$x2: $#TheHashHere%& 0x17dbc:$x3: %FTPDV$ 0x19523:$x4: $%TelegramDv$ 0x156bc:$x5: KeyLoggerEventArgs 0x15a51:$x5: KeyLoggerEventArgs 0x19419:$m2: Clipboard Logs ID 0x19673:$m2: Screenshot Logs ID 0x19783:$m2: keystroke Logs ID 0x19a5d:$m3: SnakePW 0x1964b:$m4: \SnakeKeylogger\
00000008.00000002.3754613774.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000008.00000002.3754613774.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: brontothere.exe PID: 2892	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: brontothere.exe PID: 2892	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x220898:$a1: get_encryptedPassword 0x220b72:$a2: get_encryptedUsername 0x2206ae:$a3: get_timePasswordChanged 0x2207a9:$a4: get_passwordField 0x2208ae:$a5: set_encryptedPassword 0x222d5c:$a7: get_logins 0x222cbf:$a10: KeyLoggerEventArgs 0x22292a:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: brontothere.exe PID: 2892	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x22292a:$x5: KeyLoggerEventArgs 0x222cbf:$x5: KeyLoggerEventArgs 0x2235c6:$x5: KeyLoggerEventArgs 0x223927:$x5: KeyLoggerEventArgs 0x224ef6:$m2: Clipboard Logs ID 0x22500a:$m2: Screenshot Logs ID 0x225060:$m2: keystroke Logs ID 0x225195:$m3: SnakePW 0x224ff6:$m4: \SnakeKeylogger\
Process Memory Space: RegSvcs.exe PID: 6952	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 6952	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x110b7:$a1: get_encryptedPassword 0x11391:$a2: get_encryptedUsername 0x10ecd:$a3: get_timePasswordChanged 0x10fc8:$a4: get_passwordField 0x110cd:$a5: set_encryptedPassword 0x1357b:$a7: get_logins 0x134de:$a10: KeyLoggerEventArgs 0x13149:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 6952	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x13149:$x5: KeyLoggerEventArgs 0x134de:$x5: KeyLoggerEventArgs 0x13de5:$x5: KeyLoggerEventArgs 0x14146:$x5: KeyLoggerEventArgs 0x15715:$m2: Clipboard Logs ID 0x15829:$m2: Screenshot Logs ID 0x1587f:$m2: keystroke Logs ID 0x159b4:$m3: SnakePW 0x15815:$m4: \SnakeKeylogger\
Process Memory Space: brontothere.exe PID: 6448	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: brontothere.exe PID: 6448	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x15cbcc:$a1: get_encryptedPassword 0x15cea6:$a2: get_encryptedUsername 0x15c9e2:$a3: get_timePasswordChanged 0x15cadd:$a4: get_passwordField 0x15cbe2:$a5: set_encryptedPassword 0x15f090:$a7: get_logins 0x15eff3:$a10: KeyLoggerEventArgs 0x15ec5e:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: brontothere.exe PID: 6448	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x15ec5e:$x5: KeyLoggerEventArgs 0x15eff3:$x5: KeyLoggerEventArgs 0x15f8fa:$x5: KeyLoggerEventArgs 0x15fc5b:$x5: KeyLoggerEventArgs 0x16122a:$m2: Clipboard Logs ID 0x16133e:$m2: Screenshot Logs ID 0x161394:$m2: keystroke Logs ID 0x1614c9:$m3: SnakePW 0x16132a:$m4: \SnakeKeylogger\
Process Memory Space: RegSvcs.exe PID: 6480	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.brontothere.exe.14c0000.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
11.2.brontothere.exe.14c0000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12657:$a1: get_encryptedPassword 0x1293b:$a2: get_encryptedUsername 0x12463:$a3: get_timePasswordChanged 0x1255e:$a4: get_passwordField 0x1266d:$a5: set_encryptedPassword 0x13cee:$a7: get_logins 0x13c51:$a10: KeyLoggerEventArgs 0x138bc:$a11: KeyLoggerEventArgsEventHandler
11.2.brontothere.exe.14c0000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a01f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19251:$a3: \Google\Chrome\User Data\Default\Login Data 0x19684:$a4: \Orbitum\User Data\Default\Login Data 0x1a6c3:$a5: \Kometa\User Data\Default\Login Data
11.2.brontothere.exe.14c0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13249:$s1: UnHook 0x13250:$s2: SetHook 0x13258:$s3: CallNextHook 0x13265:$s4: _hook
11.2.brontothere.exe.14c0000.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1764d:$x1: $%SMTPDV$ 0x16010:$x2: $#TheHashHere%& 0x15fbc:$x3: %FTPDV$ 0x17723:$x4: $%TelegramDv$ 0x138bc:$x5: KeyLoggerEventArgs 0x13c51:$x5: KeyLoggerEventArgs 0x17619:$m2: Clipboard Logs ID 0x17873:$m2: Screenshot Logs ID 0x17983:$m2: keystroke Logs ID 0x17c5d:$m3: SnakePW 0x1784b:$m4: \SnakeKeylogger\
7.2.brontothere.exe.2860000.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
7.2.brontothere.exe.2860000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12657:$a1: get_encryptedPassword 0x1293b:$a2: get_encryptedUsername 0x12463:$a3: get_timePasswordChanged 0x1255e:$a4: get_passwordField 0x1266d:$a5: set_encryptedPassword 0x13cee:$a7: get_logins 0x13c51:$a10: KeyLoggerEventArgs 0x138bc:$a11: KeyLoggerEventArgsEventHandler
7.2.brontothere.exe.2860000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a01f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19251:$a3: \Google\Chrome\User Data\Default\Login Data 0x19684:$a4: \Orbitum\User Data\Default\Login Data 0x1a6c3:$a5: \Kometa\User Data\Default\Login Data
7.2.brontothere.exe.2860000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13249:$s1: UnHook 0x13250:$s2: SetHook 0x13258:$s3: CallNextHook 0x13265:$s4: _hook
7.2.brontothere.exe.2860000.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1764d:$x1: $%SMTPDV$ 0x16010:$x2: $#TheHashHere%& 0x15fbc:$x3: %FTPDV$ 0x17723:$x4: $%TelegramDv$ 0x138bc:$x5: KeyLoggerEventArgs 0x13c51:$x5: KeyLoggerEventArgs 0x17619:$m2: Clipboard Logs ID 0x17873:$m2: Screenshot Logs ID 0x17983:$m2: keystroke Logs ID 0x17c5d:$m3: SnakePW 0x1784b:$m4: \SnakeKeylogger\
11.2.brontothere.exe.14c0000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
11.2.brontothere.exe.14c0000.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
11.2.brontothere.exe.14c0000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14457:$a1: get_encryptedPassword 0x1473b:$a2: get_encryptedUsername 0x14263:$a3: get_timePasswordChanged 0x1435e:$a4: get_passwordField 0x1446d:$a5: set_encryptedPassword 0x15aee:$a7: get_logins 0x15a51:$a10: KeyLoggerEventArgs 0x156bc:$a11: KeyLoggerEventArgsEventHandler
11.2.brontothere.exe.14c0000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be1f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b051:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b484:$a4: \Orbitum\User Data\Default\Login Data 0x1c4c3:$a5: \Kometa\User Data\Default\Login Data
11.2.brontothere.exe.14c0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15049:$s1: UnHook 0x15050:$s2: SetHook 0x15058:$s3: CallNextHook 0x15065:$s4: _hook
11.2.brontothere.exe.14c0000.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1944d:$x1: $%SMTPDV$ 0x17e10:$x2: $#TheHashHere%& 0x17dbc:$x3: %FTPDV$ 0x19523:$x4: $%TelegramDv$ 0x156bc:$x5: KeyLoggerEventArgs 0x15a51:$x5: KeyLoggerEventArgs 0x19419:$m2: Clipboard Logs ID 0x19673:$m2: Screenshot Logs ID 0x19783:$m2: keystroke Logs ID 0x19a5d:$m3: SnakePW 0x1964b:$m4: \SnakeKeylogger\
7.2.brontothere.exe.2860000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.brontothere.exe.2860000.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
7.2.brontothere.exe.2860000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14457:$a1: get_encryptedPassword 0x1473b:$a2: get_encryptedUsername 0x14263:$a3: get_timePasswordChanged 0x1435e:$a4: get_passwordField 0x1446d:$a5: set_encryptedPassword 0x15aee:$a7: get_logins 0x15a51:$a10: KeyLoggerEventArgs 0x156bc:$a11: KeyLoggerEventArgsEventHandler
7.2.brontothere.exe.2860000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be1f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b051:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b484:$a4: \Orbitum\User Data\Default\Login Data 0x1c4c3:$a5: \Kometa\User Data\Default\Login Data
7.2.brontothere.exe.2860000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15049:$s1: UnHook 0x15050:$s2: SetHook 0x15058:$s3: CallNextHook 0x15065:$s4: _hook
7.2.brontothere.exe.2860000.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1944d:$x1: $%SMTPDV$ 0x17e10:$x2: $#TheHashHere%& 0x17dbc:$x3: %FTPDV$ 0x19523:$x4: $%TelegramDv$ 0x156bc:$x5: KeyLoggerEventArgs 0x15a51:$x5: KeyLoggerEventArgs 0x19419:$m2: Clipboard Logs ID 0x19673:$m2: Screenshot Logs ID 0x19783:$m2: keystroke Logs ID 0x19a5d:$m3: SnakePW 0x1964b:$m4: \SnakeKeylogger\
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14457:$a1: get_encryptedPassword 0x1473b:$a2: get_encryptedUsername 0x14263:$a3: get_timePasswordChanged 0x1435e:$a4: get_passwordField 0x1446d:$a5: set_encryptedPassword 0x15aee:$a7: get_logins 0x15a51:$a10: KeyLoggerEventArgs 0x156bc:$a11: KeyLoggerEventArgsEventHandler
8.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be1f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b051:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b484:$a4: \Orbitum\User Data\Default\Login Data 0x1c4c3:$a5: \Kometa\User Data\Default\Login Data
8.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15049:$s1: UnHook 0x15050:$s2: SetHook 0x15058:$s3: CallNextHook 0x15065:$s4: _hook
8.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1944d:$x1: $%SMTPDV$ 0x17e10:$x2: $#TheHashHere%& 0x17dbc:$x3: %FTPDV$ 0x19523:$x4: $%TelegramDv$ 0x156bc:$x5: KeyLoggerEventArgs 0x15a51:$x5: KeyLoggerEventArgs 0x19419:$m2: Clipboard Logs ID 0x19673:$m2: Screenshot Logs ID 0x19783:$m2: keystroke Logs ID 0x19a5d:$m3: SnakePW 0x1964b:$m4: \SnakeKeylogger\
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs" , ProcessId: 4696, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs" , ProcessId: 4696, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Milburr\brontothere.exe, ProcessId: 2892, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:44:14.428651+0100	2803305	3	Unknown Traffic	192.168.2.7	49703	104.21.112.1	443	TCP
2025-01-11T05:44:17.317027+0100	2803305	3	Unknown Traffic	192.168.2.7	49713	104.21.112.1	443	TCP
2025-01-11T05:44:18.661966+0100	2803305	3	Unknown Traffic	192.168.2.7	49725	104.21.112.1	443	TCP
2025-01-11T05:44:21.524781+0100	2803305	3	Unknown Traffic	192.168.2.7	49744	104.21.112.1	443	TCP
2025-01-11T05:44:25.519627+0100	2803305	3	Unknown Traffic	192.168.2.7	49776	104.21.112.1	443	TCP
2025-01-11T05:44:30.694284+0100	2803305	3	Unknown Traffic	192.168.2.7	49817	104.21.112.1	443	TCP
2025-01-11T05:44:31.996574+0100	2803305	3	Unknown Traffic	192.168.2.7	49823	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:44:12.839145+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49701	193.122.6.168	80	TCP
2025-01-11T05:44:13.792316+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49701	193.122.6.168	80	TCP
2025-01-11T05:44:15.432902+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49704	193.122.6.168	80	TCP
2025-01-11T05:44:16.698738+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49707	193.122.6.168	80	TCP
2025-01-11T05:44:24.089423+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49762	193.122.6.168	80	TCP
2025-01-11T05:44:24.964350+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49762	193.122.6.168	80	TCP
2025-01-11T05:44:26.214397+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49783	193.122.6.168	80	TCP
2025-01-11T05:44:27.448861+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49791	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000C.00000002.3754528656.0000000002671000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "FTP", "FTP Server": "ftp://ftp.hogarsancamilo.org/", "FTP Username": "Johnson@hogarsancamilo.org", "Password": "eg0wtRsF5HKA", "Version": "5.1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Virustotal: Detection: 73%			Perma Link

Multi AV Scanner detection for submitted file

Source: prgNb8YFEA.exe	Virustotal: Detection: 73%			Perma Link
Source: prgNb8YFEA.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: prgNb8YFEA.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: prgNb8YFEA.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49702 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49769 version: TLS 1.0

Source:	Binary string: wntdll.pdbUGP source: brontothere.exe, 00000007.00000003.1306310184.0000000004700000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 00000007.00000003.1295020976.0000000004560000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 0000000B.00000003.1421324631.0000000003C60000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 0000000B.00000003.1418348752.0000000003E00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: brontothere.exe, 00000007.00000003.1306310184.0000000004700000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 00000007.00000003.1295020976.0000000004560000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 0000000B.00000003.1421324631.0000000003C60000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 0000000B.00000003.1418348752.0000000003E00000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D84696 GetFileAttributesW,FindFirstFileW,FindClose,	5_2_00D84696
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_00D8C9C7
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8C93C FindFirstFileW,FindClose,	5_2_00D8C93C
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00D8F200
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00D8F35D
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_00D8F65E
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D83A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00D83A2B
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D83D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00D83D4E
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_00D8BF27
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B74696 GetFileAttributesW,FindFirstFileW,FindClose,	7_2_00B74696
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	7_2_00B7C9C7
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7C93C FindFirstFileW,FindClose,	7_2_00B7C93C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00B7F200
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00B7F35D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	7_2_00B7F65E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B73A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00B73A2B
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B73D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00B73D4E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	7_2_00B7BF27
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B74696 GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00B74696
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00B7C9C7
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7C93C FindFirstFileW,FindClose,	11_2_00B7C93C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00B7F200
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00B7F35D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00B7F65E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B73A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00B73A2B
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B73D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00B73D4E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00B7BF27

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 02C9FA39h	8_2_02C9F778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 02C9E61Fh	8_2_02C9E431
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 02C9EFA9h	8_2_02C9E431
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_02C9D7F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054E1011h	8_2_054E0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EC761h	8_2_054EC4B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054E15D8h	8_2_054E11C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054ED011h	8_2_054ECD68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054E15D8h	8_2_054E1506
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EBEB1h	8_2_054EBC08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EF729h	8_2_054EF480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054E0751h	8_2_054E04A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EEA21h	8_2_054EE778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EB1A9h	8_2_054EAF00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EBA59h	8_2_054EB7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054ED8C1h	8_2_054ED618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EE171h	8_2_054EDEC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054E0BB1h	8_2_054E0900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054ECBB9h	8_2_054EC910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054ED469h	8_2_054ED1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054E15D8h	8_2_054E11B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054E02F1h	8_2_054E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EC309h	8_2_054EC060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EF2D1h	8_2_054EF028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EFB81h	8_2_054EF8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EB601h	8_2_054EB358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EE5C9h	8_2_054EE320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EEE79h	8_2_054EEBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 054EDD19h	8_2_054EDA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E7BF5h	8_2_068E78B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E6473h	8_2_068E61C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E4A39h	8_2_068E4790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E6A01h	8_2_068E6758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E5741h	8_2_068E5498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E0741h	8_2_068E0498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E7709h	8_2_068E7460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E5FF1h	8_2_068E5D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E6E59h	8_2_068E6BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E4E91h	8_2_068E4BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E45B9h	8_2_068E4310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E5B99h	8_2_068E58F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E0B99h	8_2_068E08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E72B1h	8_2_068E7008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E02E9h	8_2_068E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 068E52E9h	8_2_068E5040

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49704 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49707 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49701 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49783 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49791 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49762 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49776 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49725 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49713 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49823 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49703 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49744 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49817 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49702 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49769 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D925E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

5_2_00D925E2

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: RegSvcs.exe, 00000008.00000002.3754613774.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002735000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000008.00000002.3754613774.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002ED9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027FF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002729000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002735000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002778000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000008.00000002.3754613774.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002671000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: brontothere.exe, 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, brontothere.exe, 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000008.00000002.3754613774.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000274D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000008.00000002.3754613774.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002671000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000008.00000002.3754613774.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002735000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002778000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: brontothere.exe, 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, brontothere.exe, 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002735000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002778000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.1898

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D9425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

5_2_00D9425A

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D94458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	5_2_00D94458
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B84458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	7_2_00B84458
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B84458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	11_2_00B84458

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

5_2_00D9425A

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D80219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

5_2_00D80219

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DACDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	5_2_00DACDAC
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9CDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	7_2_00B9CDAC
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9CDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	11_2_00B9CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: brontothere.exe PID: 2892, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: brontothere.exe PID: 2892, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 6952, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 6952, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: brontothere.exe PID: 6448, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: brontothere.exe PID: 6448, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: This is a third-party compiled AutoIt script.	5_2_00D23B4C
Source: prgNb8YFEA.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: prgNb8YFEA.exe, 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5a92bc8e-7
Source: prgNb8YFEA.exe, 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9a68f3a4-2
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: This is a third-party compiled AutoIt script.	7_2_00B13B4C
Source: brontothere.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: brontothere.exe, 00000007.00000002.1308456068.0000000000BC5000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ea2221a6-6
Source: brontothere.exe, 00000007.00000002.1308456068.0000000000BC5000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_41b389bf-9
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: This is a third-party compiled AutoIt script.	11_2_00B13B4C
Source: brontothere.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: brontothere.exe, 0000000B.00000002.1424429262.0000000000BC5000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4a03fbee-9
Source: brontothere.exe, 0000000B.00000002.1424429262.0000000000BC5000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_4569a26f-9

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D23633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	5_2_00D23633
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DAC27C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	5_2_00DAC27C
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DAC220 NtdllDialogWndProc_W,	5_2_00DAC220
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DAC49C PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	5_2_00DAC49C
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DAC788 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	5_2_00DAC788
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DAC8EE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	5_2_00DAC8EE
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DAC86D SendMessageW,NtdllDialogWndProc_W,	5_2_00DAC86D
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DACBF9 NtdllDialogWndProc_W,	5_2_00DACBF9
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DACBAE NtdllDialogWndProc_W,	5_2_00DACBAE
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DACB50 NtdllDialogWndProc_W,	5_2_00DACB50
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DACB7F NtdllDialogWndProc_W,	5_2_00DACB7F
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DACC2E ClientToScreen,NtdllDialogWndProc_W,	5_2_00DACC2E
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DACDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	5_2_00DACDAC
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DACD6C GetWindowLongW,NtdllDialogWndProc_W,	5_2_00DACD6C
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D21290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	5_2_00D21290
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D21287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74E4C8D0,NtdllDialogWndProc_W,	5_2_00D21287
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D216DE GetParent,NtdllDialogWndProc_W,	5_2_00D216DE
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DAD6C6 NtdllDialogWndProc_W,	5_2_00DAD6C6
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D216B5 NtdllDialogWndProc_W,	5_2_00D216B5
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D2167D NtdllDialogWndProc_W,	5_2_00D2167D
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DAD74C GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	5_2_00DAD74C
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D2189B NtdllDialogWndProc_W,	5_2_00D2189B
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DADA9A NtdllDialogWndProc_W,	5_2_00DADA9A
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DABF4D NtdllDialogWndProc_W,CallWindowProcW,	5_2_00DABF4D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B13633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	7_2_00B13633
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9C220 NtdllDialogWndProc_W,	7_2_00B9C220
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9C27C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	7_2_00B9C27C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9C49C PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	7_2_00B9C49C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9C788 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	7_2_00B9C788
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9C8EE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	7_2_00B9C8EE
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9C86D SendMessageW,NtdllDialogWndProc_W,	7_2_00B9C86D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9CBAE NtdllDialogWndProc_W,	7_2_00B9CBAE
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9CBF9 NtdllDialogWndProc_W,	7_2_00B9CBF9
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9CB7F NtdllDialogWndProc_W,	7_2_00B9CB7F
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9CB50 NtdllDialogWndProc_W,	7_2_00B9CB50
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9CC2E ClientToScreen,NtdllDialogWndProc_W,	7_2_00B9CC2E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9CDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	7_2_00B9CDAC
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9CD6C GetWindowLongW,NtdllDialogWndProc_W,	7_2_00B9CD6C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B11290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	7_2_00B11290
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B11287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74E4C8D0,NtdllDialogWndProc_W,	7_2_00B11287
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B116B5 NtdllDialogWndProc_W,	7_2_00B116B5
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B116DE GetParent,NtdllDialogWndProc_W,	7_2_00B116DE
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9D6C6 NtdllDialogWndProc_W,	7_2_00B9D6C6
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B1167D NtdllDialogWndProc_W,	7_2_00B1167D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9D74C GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	7_2_00B9D74C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B1189B NtdllDialogWndProc_W,	7_2_00B1189B
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9DA9A NtdllDialogWndProc_W,	7_2_00B9DA9A
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9BF4D NtdllDialogWndProc_W,CallWindowProcW,	7_2_00B9BF4D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B13633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	11_2_00B13633
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9C220 NtdllDialogWndProc_W,	11_2_00B9C220
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9C27C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	11_2_00B9C27C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9C49C PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	11_2_00B9C49C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9C788 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	11_2_00B9C788
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9C8EE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	11_2_00B9C8EE
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9C86D SendMessageW,NtdllDialogWndProc_W,	11_2_00B9C86D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9CBAE NtdllDialogWndProc_W,	11_2_00B9CBAE
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9CBF9 NtdllDialogWndProc_W,	11_2_00B9CBF9
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9CB7F NtdllDialogWndProc_W,	11_2_00B9CB7F
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9CB50 NtdllDialogWndProc_W,	11_2_00B9CB50
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9CC2E ClientToScreen,NtdllDialogWndProc_W,	11_2_00B9CC2E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9CDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	11_2_00B9CDAC
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9CD6C GetWindowLongW,NtdllDialogWndProc_W,	11_2_00B9CD6C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B11290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	11_2_00B11290
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B11287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74E4C8D0,NtdllDialogWndProc_W,	11_2_00B11287
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B116B5 NtdllDialogWndProc_W,	11_2_00B116B5
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B116DE GetParent,NtdllDialogWndProc_W,	11_2_00B116DE
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9D6C6 NtdllDialogWndProc_W,	11_2_00B9D6C6
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B1167D NtdllDialogWndProc_W,	11_2_00B1167D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9D74C GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	11_2_00B9D74C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B1189B NtdllDialogWndProc_W,	11_2_00B1189B
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9DA9A NtdllDialogWndProc_W,	11_2_00B9DA9A
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9BF4D NtdllDialogWndProc_W,CallWindowProcW,	11_2_00B9BF4D

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D840B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

5_2_00D840B1

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D78858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74F35590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

5_2_00D78858

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	5_2_00D8545F
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	7_2_00B7545F
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	11_2_00B7545F

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D2E800	5_2_00D2E800
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D4DBB5	5_2_00D4DBB5
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D2FE40	5_2_00D2FE40
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DA804A	5_2_00DA804A
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D2E060	5_2_00D2E060
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D34140	5_2_00D34140
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D42405	5_2_00D42405
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D56522	5_2_00D56522
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D5267E	5_2_00D5267E
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DA0665	5_2_00DA0665
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D36843	5_2_00D36843
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D4283A	5_2_00D4283A
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D589DF	5_2_00D589DF
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DA0AE2	5_2_00DA0AE2
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D56A94	5_2_00D56A94
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D38A0E	5_2_00D38A0E
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D88B13	5_2_00D88B13
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D7EB07	5_2_00D7EB07
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D4CD61	5_2_00D4CD61
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D57006	5_2_00D57006
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D33190	5_2_00D33190
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D3710E	5_2_00D3710E
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D21287	5_2_00D21287
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D433C7	5_2_00D433C7
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D4F419	5_2_00D4F419
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D416C4	5_2_00D416C4
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D35680	5_2_00D35680
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D478D3	5_2_00D478D3
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D358C0	5_2_00D358C0
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D41BB8	5_2_00D41BB8
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D59D05	5_2_00D59D05
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D41FD0	5_2_00D41FD0
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D4BFE6	5_2_00D4BFE6
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_0122B4A8	5_2_0122B4A8
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B3DBB5	7_2_00B3DBB5
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B1E060	7_2_00B1E060
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B9804A	7_2_00B9804A
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B24140	7_2_00B24140
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B32405	7_2_00B32405
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B46522	7_2_00B46522
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B4267E	7_2_00B4267E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B90665	7_2_00B90665
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B3283A	7_2_00B3283A
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B1E800	7_2_00B1E800
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B26843	7_2_00B26843
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B489DF	7_2_00B489DF
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B46A94	7_2_00B46A94
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B90AE2	7_2_00B90AE2
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B28A0E	7_2_00B28A0E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B78B13	7_2_00B78B13
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B6EB07	7_2_00B6EB07
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B3CD61	7_2_00B3CD61
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B47006	7_2_00B47006
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B23190	7_2_00B23190
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B2710E	7_2_00B2710E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B11287	7_2_00B11287
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B333C7	7_2_00B333C7
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B3F419	7_2_00B3F419
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B25680	7_2_00B25680
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B316C4	7_2_00B316C4
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B378D3	7_2_00B378D3
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B258C0	7_2_00B258C0
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B31BB8	7_2_00B31BB8
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B49D05	7_2_00B49D05
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B1FE40	7_2_00B1FE40
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B3BFE6	7_2_00B3BFE6
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B31FD0	7_2_00B31FD0
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_0184BD78	7_2_0184BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9B328	8_2_02C9B328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9C190	8_2_02C9C190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C96108	8_2_02C96108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9C752	8_2_02C9C752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9F778	8_2_02C9F778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9C470	8_2_02C9C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9E431	8_2_02C9E431
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C94AD9	8_2_02C94AD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9CA32	8_2_02C9CA32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9BBB8	8_2_02C9BBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C96880	8_2_02C96880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C99858	8_2_02C99858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9BEB0	8_2_02C9BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9D7E0	8_2_02C9D7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9D7F0	8_2_02C9D7F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C9B4F2	8_2_02C9B4F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02C93572	8_2_02C93572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E0D60	8_2_054E0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EC4B8	8_2_054EC4B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E77A8	8_2_054E77A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E7E78	8_2_054E7E78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E3288	8_2_054E3288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054ECD58	8_2_054ECD58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E0D50	8_2_054E0D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054ECD68	8_2_054ECD68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E6DF6	8_2_054E6DF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EF471	8_2_054EF471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EBC08	8_2_054EBC08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EF480	8_2_054EF480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E0491	8_2_054E0491
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EC4A8	8_2_054EC4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E04A0	8_2_054E04A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EE768	8_2_054EE768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EE778	8_2_054EE778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EAF00	8_2_054EAF00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EB7A0	8_2_054EB7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EB7B0	8_2_054EB7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054ED609	8_2_054ED609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E7E02	8_2_054E7E02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E6E00	8_2_054E6E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054ED618	8_2_054ED618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EDEC8	8_2_054EDEC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EAEEF	8_2_054EAEEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EDEB8	8_2_054EDEB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EC902	8_2_054EC902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E0900	8_2_054E0900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EC910	8_2_054EC910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054ED1C0	8_2_054ED1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054ED1B0	8_2_054ED1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E0040	8_2_054E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EC050	8_2_054EC050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EC060	8_2_054EC060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E0006	8_2_054E0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EF018	8_2_054EF018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EF028	8_2_054EF028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EF8C9	8_2_054EF8C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EF8D8	8_2_054EF8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E08F0	8_2_054E08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EB348	8_2_054EB348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EB358	8_2_054EB358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EE310	8_2_054EE310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EE320	8_2_054EE320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EEBC1	8_2_054EEBC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EEBD0	8_2_054EEBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EBBF8	8_2_054EBBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EDA61	8_2_054EDA61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E327E	8_2_054E327E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054EDA70	8_2_054EDA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E7EB2	8_2_068E7EB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EA6B0	8_2_068EA6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EBFE8	8_2_068EBFE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E8D80	8_2_068E8D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EAD00	8_2_068EAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E0D48	8_2_068E0D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E9A18	8_2_068E9A18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E93D0	8_2_068E93D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EB350	8_2_068EB350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E78B8	8_2_068E78B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EA060	8_2_068EA060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EB9A0	8_2_068EB9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E61C8	8_2_068E61C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EA6A4	8_2_068EA6A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E4782	8_2_068E4782
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E4790	8_2_068E4790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EBFD8	8_2_068EBFD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E6FF9	8_2_068E6FF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E7F00	8_2_068E7F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E6748	8_2_068E6748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E6758	8_2_068E6758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E548A	8_2_068E548A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E0488	8_2_068E0488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E5498	8_2_068E5498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E0498	8_2_068E0498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EACF0	8_2_068EACF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E7450	8_2_068E7450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E7460	8_2_068E7460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E35A8	8_2_068E35A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E5D3A	8_2_068E5D3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E5D48	8_2_068E5D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E8D6F	8_2_068E8D6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E9A07	8_2_068E9A07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E6BA0	8_2_068E6BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E6BB0	8_2_068E6BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E93C0	8_2_068E93C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E4BD8	8_2_068E4BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E4BE8	8_2_068E4BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E4300	8_2_068E4300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E4310	8_2_068E4310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EB340	8_2_068EB340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E28A8	8_2_068E28A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E78A8	8_2_068E78A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E58E0	8_2_068E58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E08E1	8_2_068E08E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E58F0	8_2_068E58F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E08F0	8_2_068E08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E7008	8_2_068E7008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E0006	8_2_068E0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E5032	8_2_068E5032
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E0040	8_2_068E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E5040	8_2_068E5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EA050	8_2_068EA050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EB99B	8_2_068EB99B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068E61B8	8_2_068E61B8
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B1E800	11_2_00B1E800
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B3DBB5	11_2_00B3DBB5
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B1FE40	11_2_00B1FE40
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B1E060	11_2_00B1E060
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B9804A	11_2_00B9804A
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B24140	11_2_00B24140
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B32405	11_2_00B32405
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B46522	11_2_00B46522
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B4267E	11_2_00B4267E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B90665	11_2_00B90665
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B3283A	11_2_00B3283A
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B26843	11_2_00B26843
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B489DF	11_2_00B489DF
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B46A94	11_2_00B46A94
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B90AE2	11_2_00B90AE2
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B28A0E	11_2_00B28A0E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B78B13	11_2_00B78B13
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B6EB07	11_2_00B6EB07
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B3CD61	11_2_00B3CD61
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B47006	11_2_00B47006
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B23190	11_2_00B23190
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B2710E	11_2_00B2710E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B11287	11_2_00B11287
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B333C7	11_2_00B333C7
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B3F419	11_2_00B3F419
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B25680	11_2_00B25680
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B316C4	11_2_00B316C4
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B378D3	11_2_00B378D3
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B258C0	11_2_00B258C0
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B31BB8	11_2_00B31BB8
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B49D05	11_2_00B49D05
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B3BFE6	11_2_00B3BFE6
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B31FD0	11_2_00B31FD0
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_016BD530	11_2_016BD530

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: String function: 00D48B40 appears 42 times
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: String function: 00D27F41 appears 35 times
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: String function: 00D40D27 appears 70 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B39FB5 appears 46 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B11D35 appears 38 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B33A0B appears 38 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B38B40 appears 84 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B17F41 appears 70 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B19A20 appears 46 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B41B90 appears 58 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B15A64 appears 50 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B30D27 appears 140 times
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: String function: 00B3313D appears 42 times

Source: prgNb8YFEA.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: brontothere.exe PID: 2892, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: brontothere.exe PID: 2892, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RegSvcs.exe PID: 6952, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 6952, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: brontothere.exe PID: 6448, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: brontothere.exe PID: 6448, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@10/6@2/2

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D8A2D5 GetLastError,FormatMessageW,

5_2_00D8A2D5

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D78713 AdjustTokenPrivileges,CloseHandle,	5_2_00D78713
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D78CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	5_2_00D78CC3
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B68713 AdjustTokenPrivileges,CloseHandle,	7_2_00B68713
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B68CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	7_2_00B68CC3
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B68713 AdjustTokenPrivileges,CloseHandle,	11_2_00B68713
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B68CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	11_2_00B68CC3

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D8B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

5_2_00D8B59E

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D9F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

5_2_00D9F121

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D986D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

5_2_00D986D0

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D24FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

5_2_00D24FE9

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

File created: C:\Users\user\AppData\Local\Milburr

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

File created: C:\Users\user~1\AppData\Local\Temp\autBACB.tmp

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000008.00000002.3754613774.00000000030A8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.000000000309B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000003074000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000003056000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000003066000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3756941917.0000000003EAD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000028A3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000028E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000028B3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3756660371.00000000036FB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000028C1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: prgNb8YFEA.exe	Virustotal: Detection: 73%
Source: prgNb8YFEA.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

File read: C:\Users\user\Desktop\prgNb8YFEA.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\prgNb8YFEA.exe "C:\Users\user\Desktop\prgNb8YFEA.exe"
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Process created: C:\Users\user\AppData\Local\Milburr\brontothere.exe "C:\Users\user\Desktop\prgNb8YFEA.exe"
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\prgNb8YFEA.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Milburr\brontothere.exe "C:\Users\user\AppData\Local\Milburr\brontothere.exe"
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Milburr\brontothere.exe"
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Process created: C:\Users\user\AppData\Local\Milburr\brontothere.exe "C:\Users\user\Desktop\prgNb8YFEA.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\prgNb8YFEA.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Milburr\brontothere.exe "C:\Users\user\AppData\Local\Milburr\brontothere.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Milburr\brontothere.exe"	Jump to behavior

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: brontothere.exe, 00000007.00000003.1306310184.0000000004700000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 00000007.00000003.1295020976.0000000004560000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 0000000B.00000003.1421324631.0000000003C60000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 0000000B.00000003.1418348752.0000000003E00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: brontothere.exe, 00000007.00000003.1306310184.0000000004700000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 00000007.00000003.1295020976.0000000004560000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 0000000B.00000003.1421324631.0000000003C60000.00000004.00001000.00020000.00000000.sdmp, brontothere.exe, 0000000B.00000003.1418348752.0000000003E00000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00E37080 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

5_2_00E37080

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D48B85 push ecx; ret	5_2_00D48B98
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B38B85 push ecx; ret	7_2_00B38B98
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_0184CF19 push es; iretd	7_2_0184CF1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E2EFA pushad ; iretd	8_2_054E2F01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_054E2890 push eax; retf	8_2_054E2891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EDA21 push esp; iretd	8_2_068EDA35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_068EDA36 push esp; iretd	8_2_068EDA39
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B38B85 push ecx; ret	11_2_00B38B98
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_016BDB41 push es; iretd	11_2_016BDB42
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_016B9DA4 push ebp; ret	11_2_016B9EB9

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

File created: C:\Users\user\AppData\Local\Milburr\brontothere.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs

Jump to behavior

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D24A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	5_2_00D24A35
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00DA55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	5_2_00DA55FD
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B14A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	7_2_00B14A35
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B955FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	7_2_00B955FD
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B14A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	11_2_00B14A35
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B955FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	11_2_00B955FD

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D433C7 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00D433C7

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	API/Special instruction interceptor: Address: 184B99C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	API/Special instruction interceptor: Address: 16BD154

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599728	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598825	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598690	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597060	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596102	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595778	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595492	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595319	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595182	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594982	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593795	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593664	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592983	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592168	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597981	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595466	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594995	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593458	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593328	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3395	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2762	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7063	Jump to behavior

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_5-100435
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	API coverage: 4.4 %
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	API coverage: 4.6 %
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	API coverage: 4.5 %

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D84696 GetFileAttributesW,FindFirstFileW,FindClose,	5_2_00D84696
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_00D8C9C7
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8C93C FindFirstFileW,FindClose,	5_2_00D8C93C
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00D8F200
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00D8F35D
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_00D8F65E
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D83A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00D83A2B
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D83D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00D83D4E
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D8BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_00D8BF27
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B74696 GetFileAttributesW,FindFirstFileW,FindClose,	7_2_00B74696
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	7_2_00B7C9C7
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7C93C FindFirstFileW,FindClose,	7_2_00B7C93C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00B7F200
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00B7F35D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	7_2_00B7F65E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B73A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00B73A2B
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B73D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00B73D4E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B7BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	7_2_00B7BF27
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B74696 GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00B74696
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00B7C9C7
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7C93C FindFirstFileW,FindClose,	11_2_00B7C93C
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00B7F200
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00B7F35D
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00B7F65E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B73A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00B73A2B
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B73D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00B73D4E
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B7BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00B7BF27

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D24AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_00D24AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599728	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598825	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598690	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597060	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596102	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595778	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595492	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595319	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595182	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594982	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593795	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593664	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592983	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592168	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597981	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595466	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594995	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593458	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593328	Jump to behavior

Source: RegSvcs.exe, 00000008.00000002.3753105579.0000000001037000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: RegSvcs.exe, 0000000C.00000002.3753150890.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	API call chain: ExitProcess graph end node	graph_5-98909
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	API call chain: ExitProcess graph end node	graph_5-99143
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_054E77A8 LdrInitializeThunk,

8_2_054E77A8

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D941FD BlockInput,

5_2_00D941FD

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D23B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00D23B4C

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D55CCC RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

5_2_00D55CCC

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00E37080 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

5_2_00E37080

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_0122B338 mov eax, dword ptr fs:[00000030h]	5_2_0122B338
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_0122B398 mov eax, dword ptr fs:[00000030h]	5_2_0122B398
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_01229CD8 mov eax, dword ptr fs:[00000030h]	5_2_01229CD8
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_0184A5A8 mov eax, dword ptr fs:[00000030h]	7_2_0184A5A8
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_0184BC08 mov eax, dword ptr fs:[00000030h]	7_2_0184BC08
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_0184BC68 mov eax, dword ptr fs:[00000030h]	7_2_0184BC68
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_016BD3C0 mov eax, dword ptr fs:[00000030h]	11_2_016BD3C0
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_016BD420 mov eax, dword ptr fs:[00000030h]	11_2_016BD420
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_016BBD60 mov eax, dword ptr fs:[00000030h]	11_2_016BBD60

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D781F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

5_2_00D781F7

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D4A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00D4A395
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D4A364 SetUnhandledExceptionFilter,	5_2_00D4A364
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B3A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00B3A395
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B3A364 SetUnhandledExceptionFilter,	7_2_00B3A364
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B3A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00B3A395
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B3A364 SetUnhandledExceptionFilter,	11_2_00B3A364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: DE7008			Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40C008			Jump to behavior

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D78C93 LogonUserW,

5_2_00D78C93

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D23B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00D23B4C

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D24A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

5_2_00D24A35

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D84EC9 mouse_event,

5_2_00D84EC9

Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\prgNb8YFEA.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Milburr\brontothere.exe "C:\Users\user\AppData\Local\Milburr\brontothere.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Milburr\brontothere.exe"	Jump to behavior

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

5_2_00D781F7

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D84C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

5_2_00D84C03

Source: prgNb8YFEA.exe, 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmp, brontothere.exe, 00000007.00000002.1308456068.0000000000BC5000.00000040.00000001.01000000.00000005.sdmp, brontothere.exe, 0000000B.00000002.1424429262.0000000000BC5000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: brontothere.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D4886B cpuid

5_2_00D4886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D550D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00D550D7

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D62230 GetUserNameW,

5_2_00D62230

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D5418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

5_2_00D5418A

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Code function: 5_2_00D24AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_00D24AFE

Source: C:\Users\user\Desktop\prgNb8YFEA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3754528656.000000000283B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3754528656.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3754613774.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3754613774.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: brontothere.exe PID: 2892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: brontothere.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6480, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: brontothere.exe	Binary or memory string: WIN_81
Source: brontothere.exe	Binary or memory string: WIN_XP
Source: brontothere.exe	Binary or memory string: WIN_XPe
Source: brontothere.exe	Binary or memory string: WIN_VISTA
Source: brontothere.exe	Binary or memory string: WIN_7
Source: brontothere.exe	Binary or memory string: WIN_8
Source: brontothere.exe, 0000000B.00000002.1424429262.0000000000BC5000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 11.2.brontothere.exe.14c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.brontothere.exe.2860000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.brontothere.exe.14c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.brontothere.exe.2860000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3754528656.000000000283B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3754528656.0000000002671000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3754613774.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3754613774.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: brontothere.exe PID: 2892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: brontothere.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6480, type: MEMORYSTR

Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D96596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	5_2_00D96596
Source: C:\Users\user\Desktop\prgNb8YFEA.exe	Code function: 5_2_00D96A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	5_2_00D96A5A
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B86596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	7_2_00B86596
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 7_2_00B86A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	7_2_00B86A5A
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B86596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	11_2_00B86596
Source: C:\Users\user\AppData\Local\Milburr\brontothere.exe	Code function: 11_2_00B86A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_00B86A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	2 Valid Accounts	31 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Software Packing	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	231 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
prgNb8YFEA.exe	73%	Virustotal		Browse
prgNb8YFEA.exe	61%	ReversingLabs	Win32.Spyware.Snakekeylogger
prgNb8YFEA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Milburr\brontothere.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Milburr\brontothere.exe	61%	ReversingLabs	Win32.Spyware.Snakekeylogger
C:\Users\user\AppData\Local\Milburr\brontothere.exe	73%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.112.1	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org	RegSvcs.exe, 00000008.00000002.3754613774.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002735000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002778000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.1898	RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000008.00000002.3754613774.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002ED9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027FF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002729000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002735000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002778000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000008.00000002.3754613774.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002735000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000008.00000002.3754613774.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002671000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	brontothere.exe, 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, brontothere.exe, 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002778000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000008.00000002.3754613774.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F89000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000282D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027E4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000274D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.000000000281F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	brontothere.exe, 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3754613774.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, brontothere.exe, 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3754528656.0000000002735000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.112.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588806
Start date and time:	2025-01-11 05:43:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	prgNb8YFEA.exe renamed because original name is a hash value
Original Sample Name:	e248994d1154ecc091a72040543631f6faf42e980b524193b6ea207262a374a7.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@10/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 56 Number of non-executed functions: 276
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:44:10	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs
23:44:12	API Interceptor	12109043x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	BalphRTkPS.exe	Get hash	malicious	FormBook	Browse	www.kkpmoneysocial.top/86am/
	9MZZG92yMO.exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/qzi3/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/w98i/
	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads.php
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
193.122.6.168	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
reallyfreegeoip.org	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
CLOUDFLARENETUS	wSoShbuXnJ.exe	Get hash	malicious	FormBook	Browse	104.21.86.111
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	C6Abn5cBei.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	ZcshRk2lgh.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
	ydJaT4b5N8.exe	Get hash	malicious	FormBook	Browse	104.21.48.1
	leUmNO9XPu.exe	Get hash	malicious	HawkEye, MailPassView	Browse	104.19.223.79
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1

Process:	C:\Users\user\Desktop\prgNb8YFEA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	modified
Size (bytes):	609280
Entropy (8bit):	7.586046761793758
Encrypted:	false
SSDEEP:	12288:oYV6MorX7qzuC3QHO9FQVHPF51jgc7nbUwhIZLBZE:HBXu9HGaVH7nbUwGfE
MD5:	5314DC731381DE014B294374B0EB7666
SHA1:	9E3577F1495FDBB76115231A8A6680DB0BED3632
SHA-256:	E248994D1154ECC091A72040543631F6FAF42E980B524193B6EA207262A374A7
SHA-512:	0EB21211A73870D1D9681CD236BCB6EDFE5E2049477FC4773C8F7E3F9868352DAC55BD95DF8B3547BDAD060AE2EE05B8E8A7280B904F273DEFF0C2881B431F44
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61% Antivirus: Virustotal, Detection: 73%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r...........#.S..._@'.S...R.k.S....".S...RichR...................PE..L.....jg.........."......p...........p............@..........................p............@...@.......@......................]..$............................b......................................dr..H...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Local\Temp\autBACB.tmp

Download File

Process:	C:\Users\user\Desktop\prgNb8YFEA.exe
File Type:	data
Category:	dropped
Size (bytes):	87750
Entropy (8bit):	7.904845056128631
Encrypted:	false
SSDEEP:	1536:QI8LaSvhGSW7QlGOn4xlomSt9lVynGSTUAJ/kEFCuDJg0DHCvrVmXA:pSvhGz71On+lomafUGSTNJfPW0mvYA
MD5:	080F0A7871A4B2664AE741D4AA16D99C
SHA1:	BB6008B3B45BCA6DD65DD22A76F2DB85AB12F06B
SHA-256:	94B2EF3D6075BB2D32D96F0FD6F844D9F6A171757025569D5C9B7B49BF200086
SHA-512:	7576F61F3EF4017125B78A652EB16FF582DF3740B16373AFBD85BE41E04DA97EA6954F78F568FFC9E9A2565A29A90722063B8946FEDCF04CCD7138CA9AC10A86
Malicious:	false
Reputation:	low
Preview:	EA06........Y.6gH.Uf4...m4.....$.sM..)..E.s6.N@..3...6`.D........g.E..-.y..M..M..5bE..Ikuy...,.Dg.:.Z.W..#.x.REW..+..5..#1K.....j...F.....6cI..,4.7No4....1.....`.......I.... U.4...Fh..Z.Q'3i..F't.6.U..(..FQQ.I@.1!...&.1.A@6...i...u\|..4.j.....~.Y.6v.%..5...v/;..f....CO...zqO.T..>..>q1.Q.S.......~f..Hhf@....q...s....9..ZfsO.H5s../..P..Z\|~....J....i........s5.$55.$.#V.R>.....e.r...%......wL.U...MN......).@."(.HV.....AG.$&..........P.B..HW.....!F.$$....U.....r1O.V....#H.W.4.4.eG....I..7....7.u6.Og.......q.h.2.3.Lg4...=5.l..uVU#..f...3.D.Mg5h..W.....'i.T.R..6gS.].4.4.. ..U......?..x.!...;...... .(.i......z..a~....@.-W..."...w..)...q,.Z,..../...Z.......jo........I9.W...EJW...f..p..n....\|J.D..@..d...D#.z\|..G.Nh.:U6Q..Q..I....D.....1.[.@..uy...6*..V#.y.P.......}2...4..N.H..-5.d..X.l..}FA9..@.....J.S....P...V%.0."9...%.......2...`...$.p...s...J...........'T...cb...$...i;:\|.n......5L.F.z'.......JuVkg.D.i..iQ.Lbv.....[g1..E.Q&..<V.5...).z6. r

C:\Users\user\AppData\Local\Temp\autBE75.tmp

Download File

Process:	C:\Users\user\AppData\Local\Milburr\brontothere.exe
File Type:	data
Category:	dropped
Size (bytes):	87750
Entropy (8bit):	7.904845056128631
Encrypted:	false
SSDEEP:	1536:QI8LaSvhGSW7QlGOn4xlomSt9lVynGSTUAJ/kEFCuDJg0DHCvrVmXA:pSvhGz71On+lomafUGSTNJfPW0mvYA
MD5:	080F0A7871A4B2664AE741D4AA16D99C
SHA1:	BB6008B3B45BCA6DD65DD22A76F2DB85AB12F06B
SHA-256:	94B2EF3D6075BB2D32D96F0FD6F844D9F6A171757025569D5C9B7B49BF200086
SHA-512:	7576F61F3EF4017125B78A652EB16FF582DF3740B16373AFBD85BE41E04DA97EA6954F78F568FFC9E9A2565A29A90722063B8946FEDCF04CCD7138CA9AC10A86
Malicious:	false
Reputation:	low
Preview:	EA06........Y.6gH.Uf4...m4.....$.sM..)..E.s6.N@..3...6`.D........g.E..-.y..M..M..5bE..Ikuy...,.Dg.:.Z.W..#.x.REW..+..5..#1K.....j...F.....6cI..,4.7No4....1.....`.......I.... U.4...Fh..Z.Q'3i..F't.6.U..(..FQQ.I@.1!...&.1.A@6...i...u\|..4.j.....~.Y.6v.%..5...v/;..f....CO...zqO.T..>..>q1.Q.S.......~f..Hhf@....q...s....9..ZfsO.H5s../..P..Z\|~....J....i........s5.$55.$.#V.R>.....e.r...%......wL.U...MN......).@."(.HV.....AG.$&..........P.B..HW.....!F.$$....U.....r1O.V....#H.W.4.4.eG....I..7....7.u6.Og.......q.h.2.3.Lg4...=5.l..uVU#..f...3.D.Mg5h..W.....'i.T.R..6gS.].4.4.. ..U......?..x.!...;...... .(.i......z..a~....@.-W..."...w..)...q,.Z,..../...Z.......jo........I9.W...EJW...f..p..n....\|J.D..@..d...D#.z\|..G.Nh.:U6Q..Q..I....D.....1.[.@..uy...6*..V#.y.P.......}2...4..N.H..-5.d..X.l..}FA9..@.....J.S....P...V%.0."9...%.......2...`...$.p...s...J...........'T...cb...$...i;:\|.n......5L.F.z'.......JuVkg.D.i..iQ.Lbv.....[g1..E.Q&..<V.5...).z6. r

C:\Users\user\AppData\Local\Temp\autEC6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Milburr\brontothere.exe
File Type:	data
Category:	dropped
Size (bytes):	87750
Entropy (8bit):	7.904845056128631
Encrypted:	false
SSDEEP:	1536:QI8LaSvhGSW7QlGOn4xlomSt9lVynGSTUAJ/kEFCuDJg0DHCvrVmXA:pSvhGz71On+lomafUGSTNJfPW0mvYA
MD5:	080F0A7871A4B2664AE741D4AA16D99C
SHA1:	BB6008B3B45BCA6DD65DD22A76F2DB85AB12F06B
SHA-256:	94B2EF3D6075BB2D32D96F0FD6F844D9F6A171757025569D5C9B7B49BF200086
SHA-512:	7576F61F3EF4017125B78A652EB16FF582DF3740B16373AFBD85BE41E04DA97EA6954F78F568FFC9E9A2565A29A90722063B8946FEDCF04CCD7138CA9AC10A86
Malicious:	false
Reputation:	low
Preview:	EA06........Y.6gH.Uf4...m4.....$.sM..)..E.s6.N@..3...6`.D........g.E..-.y..M..M..5bE..Ikuy...,.Dg.:.Z.W..#.x.REW..+..5..#1K.....j...F.....6cI..,4.7No4....1.....`.......I.... U.4...Fh..Z.Q'3i..F't.6.U..(..FQQ.I@.1!...&.1.A@6...i...u\|..4.j.....~.Y.6v.%..5...v/;..f....CO...zqO.T..>..>q1.Q.S.......~f..Hhf@....q...s....9..ZfsO.H5s../..P..Z\|~....J....i........s5.$55.$.#V.R>.....e.r...%......wL.U...MN......).@."(.HV.....AG.$&..........P.B..HW.....!F.$$....U.....r1O.V....#H.W.4.4.eG....I..7....7.u6.Og.......q.h.2.3.Lg4...=5.l..uVU#..f...3.D.Mg5h..W.....'i.T.R..6gS.].4.4.. ..U......?..x.!...;...... .(.i......z..a~....@.-W..."...w..)...q,.Z,..../...Z.......jo........I9.W...EJW...f..p..n....\|J.D..@..d...D#.z\|..G.Nh.:U6Q..Q..I....D.....1.[.@..uy...6*..V#.y.P.......}2...4..N.H..-5.d..X.l..}FA9..@.....J.S....P...V%.0."9...%.......2...`...$.p...s...J...........'T...cb...$...i;:\|.n......5L.F.z'.......JuVkg.D.i..iQ.Lbv.....[g1..E.Q&..<V.5...).z6. r

C:\Users\user\AppData\Local\Temp\nonplacental

Download File

Process:	C:\Users\user\Desktop\prgNb8YFEA.exe
File Type:	data
Category:	modified
Size (bytes):	131072
Entropy (8bit):	6.998701347678074
Encrypted:	false
SSDEEP:	3072:uWsp4sHRAyqrjGwVtZOtaJ5YyYage3Vjd3KCAPdtvCin:UpVHivmwLJ5t9KNn
MD5:	CDD378F43140DDD4B4487EE7459D98D7
SHA1:	8EEF98A4C9DE80E461125304D25F62D7CF27B777
SHA-256:	A5D1AA75FD07BFEC093BA72CEC8BE5A1F5537774A3BCC96D06426F56B5554EFE
SHA-512:	9A18EE8BC2C6E07F72EDEB236C9EC57812F63D4131B8841871627C7855A91FDC2A99E475A4BB663CA9057771C77EFC914BA4DB32AFC2CF13F38F0BBB0F979D56
Malicious:	false
Reputation:	low
Preview:	u..5:M3HJU1L..64.O8QD59MsHNU1LF9649O8QD59M3HNU1LF9649O8QD59M.HNU?S.76.0...Ey.lg '&.<4VQFX".2%[W"Gh,0.>3W.]Wo\|...T"W-`X<Fb9649O8Q.p9M.IMU.a._649O8QD5.M1IETaLF.749[8QD59M.ALU1lF96.;O8Q.59m3HNW1LB9649O8Q@59M3HNU1,D9669O8QD5;Ms.NU!LF)649O(QD%9M3HNU!LF9649O8QD5ID1H.U1LF.44._8QD59M3HNU1LF9649O8.F55M3HNU1LF9649O8QD59M3HNU1LF9649O8QD59M3HNU1LF9649O8QD.9M;HNU1LF9649O0qD5qM3HNU1LF964.;])059M..OU1lF96.8O8SD59M3HNU1LF964.O81jGJ?PHNU.\F96.;O8CD59.2HNU1LF9649O8Q.59..:+9^/F9:49O8.F59O3HN.0LF9649O8QD59MsHN.1LF9649O8QD59M3H.\3LF964qO8QF5<M.SOU..F9549O.QD3.V2H.U1LF9649O8QD59M3HNU1LF9649O8QD59M3HNU1LF964.2.^..$@.U1LF965;L<WL=9M3HNU1L8964.O8Q.59M.HNU.LF9[49O.QD5GM3H0U1L"964KO8Q%59MtHNU^LF9X49OFQD5'O.hNU;f`94..O8[D..>.HN_.MF92G.O8[.79M7;jU1F.:64=<.QD?.I3HJ&.LF3.19O<{.5:.%NNU*#.96>9L.DB59V.nNW.vF9<4.i8R. ?M3Sdw1N.064=en"Y59K..NU;8O966.E8Q@.'O..NU;fdG&49K.Qn.G\3HJ~1fdG$49K.Qn.G^3HJ~1fdG"49K.Qn+;.'HNQ.n8,64=d8{fK/M3LeU.n8.64=d8{Z7.Z3HJ.7f$9D^%OHR+.9M5`.U1FnY64?O.kDK.M3LL:.LF3..gO:yG49G3JM(.LF=40Dx8Q@.oM13wU

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs

Download File

Process:	C:\Users\user\AppData\Local\Milburr\brontothere.exe
File Type:	data
Category:	modified
Size (bytes):	286
Entropy (8bit):	3.4247564872866394
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclMMlW8g1UEZ+lX1olFe3CnDdnriIM8lfQVn:DsO+vNlMkXg1Q1olE3AmA2n
MD5:	724591EB75B9AC723085FFDCA4749631
SHA1:	2C143E8A219D5B916760B5BA7540F81E32D56A5E
SHA-256:	10AA83853CAEC24F1B4B51495B37C33DA7E918A07AE1AA213FC3DE2877DE853A
SHA-512:	3CE7F7690C533893C4533BBE68B9B3B263C98B36218FF01BDE7AD36D6F3A117B09BFF15CC0FE94F42F8FACAA816BB78E718C6A75A209C68A5D6E032E45AAD20D
Malicious:	true
Reputation:	low
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.l.b.u.r.r.\.b.r.o.n.t.o.t.h.e.r.e...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.586046761793758
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	prgNb8YFEA.exe
File size:	609'280 bytes
MD5:	5314dc731381de014b294374b0eb7666
SHA1:	9e3577f1495fdbb76115231a8a6680db0bed3632
SHA256:	e248994d1154ecc091a72040543631f6faf42e980b524193b6ea207262a374a7
SHA512:	0eb21211a73870d1d9681cd236bcb6edfe5e2049477fc4773c8f7e3f9868352dac55bd95df8b3547bdad060ae2ee05b8e8a7280b904f273deff0c2881b431f44
SSDEEP:	12288:oYV6MorX7qzuC3QHO9FQVHPF51jgc7nbUwhIZLBZE:HBXu9HGaVH7nbUwGfE
TLSH:	90D401877680556BC425FEB784371D20E397AD99A5B87206298F7D24A3B76E3303318F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	0d2d0d1723293133

Static PE Info

General

Entrypoint:	0x517080
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x676A9DB0 [Tue Dec 24 11:40:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc6683d30d9f25244a50fd5357825e79

Entrypoint Preview

Instruction
pushad
mov esi, 004C1000h
lea edi, dword ptr [esi-000C0000h]
push edi
jmp 00007F47ACE6CAFDh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F47ACE6CAF9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F47ACE6CADFh
mov eax, 00000001h
add ebx, ebx
jne 00007F47ACE6CAF9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F47ACE6CAFDh
jne 00007F47ACE6CB1Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F47ACE6CB11h
dec eax
add ebx, ebx
jne 00007F47ACE6CAF9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F47ACE6CAC6h
add ebx, ebx
jne 00007F47ACE6CAF9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F47ACE6CB44h
xor ecx, ecx
sub eax, 03h
jc 00007F47ACE6CB03h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F47ACE6CB67h
sar eax, 1
mov ebp, eax
jmp 00007F47ACE6CAFDh
add ebx, ebx
jne 00007F47ACE6CAF9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F47ACE6CABEh
inc ecx
add ebx, ebx
jne 00007F47ACE6CAF9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F47ACE6CAB0h
add ebx, ebx
jne 00007F47ACE6CAF9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F47ACE6CAE1h
jne 00007F47ACE6CAFBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F47ACE6CAD6h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F47ACE6CB00h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x155dec	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x118000	0x3ddec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x156210	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x117264	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xc0000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xc1000	0x57000	0x56400	257d01144382bba87ae8e16daa6f23b4	False	0.9873018568840579	data	7.935347181695601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x118000	0x3f000	0x3e400	0ee25dbab1e18e2c7cb8f7d79f892599	False	0.6623329254518072	data	6.716918087091885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11851c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x118648	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x118774	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x1188a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	Great Britain	0.45567375886524825
RT_ICON	0x118d0c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	Great Britain	0.299953095684803
RT_ICON	0x119db8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	Great Britain	0.2274896265560166
RT_ICON	0x11c364	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	Great Britain	0.18865139348134152
RT_ICON	0x120590	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	Great Britain	0.13214243463858985
RT_MENU	0xe0d98	0x50	data	English	Great Britain	1.1375
RT_STRING	0xe0de8	0x594	data	English	Great Britain	1.007703081232493
RT_STRING	0xe137c	0x68a	data	English	Great Britain	1.0065710872162486
RT_STRING	0xe1a08	0x490	data	English	Great Britain	1.009417808219178
RT_STRING	0xe1e98	0x5fc	data	English	Great Britain	1.0071801566579635
RT_STRING	0xe2494	0x65c	data	English	Great Britain	1.0067567567567568
RT_STRING	0xe2af0	0x466	data	English	Great Britain	1.0097690941385435
RT_STRING	0xe2f58	0x158	data	English	Great Britain	1.0319767441860466
RT_RCDATA	0x130dbc	0x24ac3	data			1.0003728089154589
RT_GROUP_ICON	0x155884	0x4c	data	English	Great Britain	0.8157894736842105
RT_GROUP_ICON	0x1558d4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1558ec	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x155904	0x14	data	English	Great Britain	1.25
RT_VERSION	0x15591c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1559fc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	GetAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetOpenFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:44:12.839145+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49701	193.122.6.168	80	TCP
2025-01-11T05:44:13.792316+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49701	193.122.6.168	80	TCP
2025-01-11T05:44:14.428651+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49703	104.21.112.1	443	TCP
2025-01-11T05:44:15.432902+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49704	193.122.6.168	80	TCP
2025-01-11T05:44:16.698738+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49707	193.122.6.168	80	TCP
2025-01-11T05:44:17.317027+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49713	104.21.112.1	443	TCP
2025-01-11T05:44:18.661966+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49725	104.21.112.1	443	TCP
2025-01-11T05:44:21.524781+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49744	104.21.112.1	443	TCP
2025-01-11T05:44:24.089423+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49762	193.122.6.168	80	TCP
2025-01-11T05:44:24.964350+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49762	193.122.6.168	80	TCP
2025-01-11T05:44:25.519627+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49776	104.21.112.1	443	TCP
2025-01-11T05:44:26.214397+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49783	193.122.6.168	80	TCP
2025-01-11T05:44:27.448861+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49791	193.122.6.168	80	TCP
2025-01-11T05:44:30.694284+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49817	104.21.112.1	443	TCP
2025-01-11T05:44:31.996574+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49823	104.21.112.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:44:11.956439018 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:11.961349010 CET	80	49701	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:11.961441994 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:11.965744972 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:11.970561028 CET	80	49701	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:12.597281933 CET	80	49701	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:12.601984024 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:12.606765985 CET	80	49701	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:12.788983107 CET	80	49701	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:12.839144945 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:12.844633102 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:12.844656944 CET	443	49702	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:12.847904921 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:12.858766079 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:12.858783007 CET	443	49702	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:13.343553066 CET	443	49702	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:13.343748093 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.350959063 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.350981951 CET	443	49702	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:13.351289034 CET	443	49702	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:13.401638985 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.414532900 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.455334902 CET	443	49702	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:13.534130096 CET	443	49702	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:13.534195900 CET	443	49702	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:13.535898924 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.554713964 CET	49702	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.559809923 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:13.564593077 CET	80	49701	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:13.746769905 CET	80	49701	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:13.792315960 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:13.826977015 CET	49703	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.827102900 CET	443	49703	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:13.827193975 CET	49703	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.828111887 CET	49703	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:13.828140020 CET	443	49703	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:14.282782078 CET	443	49703	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:14.305496931 CET	49703	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:14.305583000 CET	443	49703	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:14.428663969 CET	443	49703	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:14.428752899 CET	443	49703	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:14.428864002 CET	49703	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:14.433964014 CET	49703	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:14.752917051 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:14.758573055 CET	80	49701	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:14.758645058 CET	49701	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:14.760576010 CET	49704	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:14.766767025 CET	80	49704	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:14.766843081 CET	49704	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:14.767126083 CET	49704	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:14.772177935 CET	80	49704	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:15.390126944 CET	80	49704	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:15.392182112 CET	49706	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:15.392242908 CET	443	49706	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:15.392317057 CET	49706	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:15.392640114 CET	49706	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:15.392657042 CET	443	49706	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:15.432902098 CET	49704	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:15.846970081 CET	443	49706	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:15.849306107 CET	49706	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:15.849351883 CET	443	49706	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:15.979640961 CET	443	49706	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:15.979708910 CET	443	49706	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:15.980150938 CET	49706	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:15.980401993 CET	49706	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:15.985378981 CET	49704	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:15.985384941 CET	49707	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:15.990216017 CET	80	49707	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:15.990329981 CET	80	49704	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:15.990341902 CET	49707	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:15.990463972 CET	49704	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:15.990464926 CET	49707	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:15.995505095 CET	80	49707	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:16.657473087 CET	80	49707	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:16.662161112 CET	49713	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:16.662267923 CET	443	49713	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:16.662837982 CET	49713	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:16.663203001 CET	49713	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:16.663238049 CET	443	49713	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:16.698738098 CET	49707	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:17.170401096 CET	443	49713	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:17.172174931 CET	49713	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:17.172218084 CET	443	49713	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:17.317064047 CET	443	49713	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:17.317141056 CET	443	49713	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:17.317214012 CET	49713	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:17.331295013 CET	49713	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:17.383300066 CET	49719	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:17.388258934 CET	80	49719	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:17.388329983 CET	49719	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:17.388576031 CET	49719	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:17.393394947 CET	80	49719	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:18.014130116 CET	80	49719	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:18.017250061 CET	49725	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:18.017297983 CET	443	49725	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:18.017682076 CET	49725	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:18.018654108 CET	49725	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:18.018671036 CET	443	49725	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:18.059957027 CET	49719	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:18.502624035 CET	443	49725	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:18.516778946 CET	49725	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:18.516817093 CET	443	49725	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:18.661982059 CET	443	49725	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:18.662043095 CET	443	49725	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:18.663703918 CET	49725	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:18.688072920 CET	49725	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:18.863374949 CET	49719	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:18.864835024 CET	49729	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:18.868491888 CET	80	49719	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:18.868571043 CET	49719	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:18.869688034 CET	80	49729	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:18.869756937 CET	49729	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:18.869885921 CET	49729	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:18.874716997 CET	80	49729	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:19.514828920 CET	80	49729	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:19.516427040 CET	49732	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:19.516474962 CET	443	49732	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:19.516546965 CET	49732	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:19.516845942 CET	49732	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:19.516858101 CET	443	49732	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:19.558001995 CET	49729	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:19.988450050 CET	443	49732	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:19.990497112 CET	49732	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:19.990525007 CET	443	49732	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:20.129419088 CET	443	49732	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:20.129487038 CET	443	49732	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:20.129559040 CET	49732	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:20.130132914 CET	49732	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:20.133616924 CET	49729	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:20.134984970 CET	49738	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:20.138657093 CET	80	49729	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:20.139727116 CET	80	49738	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:20.139789104 CET	49729	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:20.139832020 CET	49738	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:20.139964104 CET	49738	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:20.144711018 CET	80	49738	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:20.794580936 CET	80	49738	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:20.797094107 CET	49744	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:20.797143936 CET	443	49744	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:20.797213078 CET	49744	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:20.797540903 CET	49744	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:20.797550917 CET	443	49744	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:20.839260101 CET	49738	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:21.267030001 CET	443	49744	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:21.272135973 CET	49744	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:21.272185087 CET	443	49744	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:21.524806023 CET	443	49744	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:21.524878025 CET	443	49744	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:21.525074005 CET	49744	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:21.538628101 CET	49744	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:21.617753029 CET	49738	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:21.622900963 CET	80	49738	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:21.626138926 CET	49750	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:21.626179934 CET	49738	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:21.630959988 CET	80	49750	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:21.631052017 CET	49750	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:21.635050058 CET	49750	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:21.639909029 CET	80	49750	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:22.285343885 CET	80	49750	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:22.303031921 CET	49756	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:22.303086996 CET	443	49756	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:22.303162098 CET	49756	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:22.304168940 CET	49756	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:22.304187059 CET	443	49756	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:22.339327097 CET	49750	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:22.767189980 CET	443	49756	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:22.769936085 CET	49756	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:22.769974947 CET	443	49756	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:22.896955013 CET	443	49756	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:22.897152901 CET	443	49756	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:22.897200108 CET	49756	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:22.897697926 CET	49756	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:23.201390028 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:23.206480026 CET	80	49762	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:23.206563950 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:23.206820965 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:23.211653948 CET	80	49762	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:23.845026016 CET	80	49762	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:23.852066040 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:23.856983900 CET	80	49762	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:24.038342953 CET	80	49762	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:24.075109959 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.075151920 CET	443	49769	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.075582027 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.079547882 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.079564095 CET	443	49769	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.089422941 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:24.532954931 CET	443	49769	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.533994913 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.534842014 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.534851074 CET	443	49769	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.535183907 CET	443	49769	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.589359999 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.609777927 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.651334047 CET	443	49769	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.715065002 CET	443	49769	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.715152025 CET	443	49769	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.716131926 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.719923019 CET	49769	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.723336935 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:24.728147030 CET	80	49762	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:24.912143946 CET	80	49762	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:24.914706945 CET	49776	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.914751053 CET	443	49776	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.914813995 CET	49776	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.915138960 CET	49776	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:24.915152073 CET	443	49776	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:24.964349985 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:25.371685028 CET	443	49776	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:25.382870913 CET	49776	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:25.382909060 CET	443	49776	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:25.519721031 CET	443	49776	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:25.519887924 CET	443	49776	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:25.519943953 CET	49776	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:25.520410061 CET	49776	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:25.526714087 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:25.530977011 CET	49783	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:25.531713963 CET	80	49762	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:25.531779051 CET	49762	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:25.535866022 CET	80	49783	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:25.535948992 CET	49783	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:25.536076069 CET	49783	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:25.541567087 CET	80	49783	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:26.162110090 CET	80	49783	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:26.163671970 CET	49788	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:26.163723946 CET	443	49788	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:26.168150902 CET	49788	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:26.168530941 CET	49788	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:26.168545961 CET	443	49788	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:26.214396954 CET	49783	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:26.628144026 CET	443	49788	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:26.640300035 CET	49788	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:26.640346050 CET	443	49788	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:26.756067991 CET	443	49788	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:26.756143093 CET	443	49788	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:26.756225109 CET	49788	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:26.756757021 CET	49788	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:26.760546923 CET	49783	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:26.761990070 CET	49791	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:26.765597105 CET	80	49783	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:26.765707016 CET	49783	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:26.766896009 CET	80	49791	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:26.766984940 CET	49791	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:26.767137051 CET	49791	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:26.771986008 CET	80	49791	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:27.394572973 CET	80	49791	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:27.396373034 CET	49797	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:27.396451950 CET	443	49797	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:27.396687984 CET	49797	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:27.397027969 CET	49797	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:27.397047043 CET	443	49797	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:27.448860884 CET	49791	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:27.874036074 CET	443	49797	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:27.876177073 CET	49797	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:27.876204014 CET	443	49797	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:28.010452032 CET	443	49797	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:28.010528088 CET	443	49797	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:28.010644913 CET	49797	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:28.011158943 CET	49797	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:28.030122995 CET	49801	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:28.035037994 CET	80	49801	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:28.040177107 CET	49801	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:28.040343046 CET	49801	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:28.046664000 CET	80	49801	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:28.751349926 CET	80	49801	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:28.755548954 CET	49807	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:28.755615950 CET	443	49807	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:28.755721092 CET	49807	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:28.755996943 CET	49807	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:28.756016016 CET	443	49807	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:28.808243036 CET	49801	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:29.238116980 CET	443	49807	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:29.241491079 CET	49807	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:29.241516113 CET	443	49807	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:29.393687963 CET	443	49807	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:29.393937111 CET	443	49807	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:29.394012928 CET	49807	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:29.394412994 CET	49807	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:29.398542881 CET	49801	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:29.399596930 CET	49813	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:29.403630018 CET	80	49801	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:29.403723955 CET	49801	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:29.404529095 CET	80	49813	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:29.404601097 CET	49813	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:29.418751001 CET	49813	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:29.423813105 CET	80	49813	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:30.040564060 CET	80	49813	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:30.074724913 CET	49817	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:30.074762106 CET	443	49817	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:30.074837923 CET	49817	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:30.075165987 CET	49817	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:30.075180054 CET	443	49817	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:30.089428902 CET	49813	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:30.553752899 CET	443	49817	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:30.586169958 CET	49817	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:30.586200953 CET	443	49817	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:30.694407940 CET	443	49817	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:30.694582939 CET	443	49817	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:30.694659948 CET	49817	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:30.698523998 CET	49817	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:30.737224102 CET	49813	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:30.738900900 CET	49820	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:30.742345095 CET	80	49813	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:30.742412090 CET	49813	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:30.743801117 CET	80	49820	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:30.743864059 CET	49820	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:30.743983030 CET	49820	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:30.748764992 CET	80	49820	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:31.369410992 CET	80	49820	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:31.374655008 CET	49823	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:31.374703884 CET	443	49823	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:31.374771118 CET	49823	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:31.375082970 CET	49823	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:31.375098944 CET	443	49823	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:31.417591095 CET	49820	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:31.829736948 CET	443	49823	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:31.831444025 CET	49823	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:31.831535101 CET	443	49823	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:31.996584892 CET	443	49823	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:31.996640921 CET	443	49823	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:31.996792078 CET	49823	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:31.997312069 CET	49823	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:32.000883102 CET	49820	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:32.002036095 CET	49829	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:32.006001949 CET	80	49820	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:32.006920099 CET	80	49829	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:32.006997108 CET	49820	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:32.007035971 CET	49829	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:32.007167101 CET	49829	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:32.011996031 CET	80	49829	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:32.641592026 CET	80	49829	193.122.6.168	192.168.2.7
Jan 11, 2025 05:44:32.643150091 CET	49835	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:32.643193960 CET	443	49835	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:32.643291950 CET	49835	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:32.643624067 CET	49835	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:32.643640041 CET	443	49835	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:32.683260918 CET	49829	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:44:33.117435932 CET	443	49835	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:33.138479948 CET	49835	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:33.138516903 CET	443	49835	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:33.265141010 CET	443	49835	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:33.265233040 CET	443	49835	104.21.112.1	192.168.2.7
Jan 11, 2025 05:44:33.265346050 CET	49835	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:44:33.268115044 CET	49835	443	192.168.2.7	104.21.112.1
Jan 11, 2025 05:45:21.658471107 CET	80	49707	193.122.6.168	192.168.2.7
Jan 11, 2025 05:45:21.658806086 CET	49707	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:45:27.287617922 CET	80	49750	193.122.6.168	192.168.2.7
Jan 11, 2025 05:45:27.287769079 CET	49750	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:45:32.506222963 CET	80	49791	193.122.6.168	192.168.2.7
Jan 11, 2025 05:45:32.509315014 CET	49791	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:45:37.642745972 CET	80	49829	193.122.6.168	192.168.2.7
Jan 11, 2025 05:45:37.642904043 CET	49829	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:46:02.313404083 CET	49750	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:46:02.318360090 CET	80	49750	193.122.6.168	192.168.2.7
Jan 11, 2025 05:46:12.654488087 CET	49829	80	192.168.2.7	193.122.6.168
Jan 11, 2025 05:46:12.659276962 CET	80	49829	193.122.6.168	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:44:11.896862030 CET	49608	53	192.168.2.7	1.1.1.1
Jan 11, 2025 05:44:11.903780937 CET	53	49608	1.1.1.1	192.168.2.7
Jan 11, 2025 05:44:12.834908009 CET	61900	53	192.168.2.7	1.1.1.1
Jan 11, 2025 05:44:12.842525005 CET	53	61900	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:44:11.896862030 CET	192.168.2.7	1.1.1.1	0x3b90	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:12.834908009 CET	192.168.2.7	1.1.1.1	0xbeaf	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:44:11.903780937 CET	1.1.1.1	192.168.2.7	0x3b90	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:44:11.903780937 CET	1.1.1.1	192.168.2.7	0x3b90	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:11.903780937 CET	1.1.1.1	192.168.2.7	0x3b90	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:11.903780937 CET	1.1.1.1	192.168.2.7	0x3b90	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:11.903780937 CET	1.1.1.1	192.168.2.7	0x3b90	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:11.903780937 CET	1.1.1.1	192.168.2.7	0x3b90	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:12.842525005 CET	1.1.1.1	192.168.2.7	0xbeaf	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:12.842525005 CET	1.1.1.1	192.168.2.7	0xbeaf	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:12.842525005 CET	1.1.1.1	192.168.2.7	0xbeaf	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:12.842525005 CET	1.1.1.1	192.168.2.7	0xbeaf	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:12.842525005 CET	1.1.1.1	192.168.2.7	0xbeaf	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:12.842525005 CET	1.1.1.1	192.168.2.7	0xbeaf	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:44:12.842525005 CET	1.1.1.1	192.168.2.7	0xbeaf	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	193.122.6.168	80	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:11.965744972 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:12.597281933 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 05:44:12.601984024 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 05:44:12.788983107 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 05:44:13.559809923 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 05:44:13.746769905 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	193.122.6.168	80	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:14.767126083 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 05:44:15.390126944 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49707	193.122.6.168	80	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:15.990464926 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 05:44:16.657473087 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49719	193.122.6.168	80	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:17.388576031 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:18.014130116 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49729	193.122.6.168	80	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:18.869885921 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:19.514828920 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49738	193.122.6.168	80	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:20.139964104 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:20.794580936 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49750	193.122.6.168	80	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:21.635050058 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:22.285343885 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49762	193.122.6.168	80	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:23.206820965 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:23.845026016 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 05:44:23.852066040 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 05:44:24.038342953 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 05:44:24.723336935 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 05:44:24.912143946 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49783	193.122.6.168	80	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:25.536076069 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 05:44:26.162110090 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49791	193.122.6.168	80	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:26.767137051 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 05:44:27.394572973 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49801	193.122.6.168	80	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:28.040343046 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:28.751349926 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49813	193.122.6.168	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:29.418751001 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:30.040564060 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49820	193.122.6.168	80	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:30.743983030 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:31.369410992 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49829	193.122.6.168	80	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:44:32.007167101 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 05:44:32.641592026 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	104.21.112.1	443	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:13 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:13 UTC	849	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885442 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HLck3tQU9oSXbgHf9842Oh9Oxdb7xJa66mjcMoYKEfumBxhZBjrqVcJzGOMDfjEFuUBaAqiEDwIIYQDzz2hyPi7KSUjgDmz4Ia2dJWREdFL2OYO2xWllIqJAC5LlF4QAHKbyC1xM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900240183fe7c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1485&min_rtt=1482&rtt_var=563&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1931216&cwnd=181&unsent_bytes=0&cid=078bd9380417d4cc&ts=207&x=0"
2025-01-11 04:44:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	104.21.112.1	443	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:14 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 04:44:14 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:14 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885443 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QzT6%2FPiwVEp6PgYdP9hJ0D9R3MMa%2BaMj32PTxnzyHqhTatypRezlCg7PGw9aQrmnFMwQn7ApnHzMC8KwgArRROG5zB0cGIFDSlAibE7Bk1g2pPkyNr8BQv9tVWZ2NT2c7S4U%2FGzu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002401decbfc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1493&rtt_var=614&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1955793&cwnd=181&unsent_bytes=0&cid=d7e5ab3883893e41&ts=149&x=0"
2025-01-11 04:44:14 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49706	104.21.112.1	443	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:15 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:15 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:15 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885445 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3J9G4kdIYpvLYGWnWwE9UIsS0j%2FPJc4eOiUsdP9xH%2F8f51iNwOC6FdAQbtP4QBRLdJIjmGLW43hn6fX%2BLzncYw%2FQeIjohJ23MrjwdInx5NupOGlVfi5V3n1LhtIVB4bepRUcNmWv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900240279caf43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1602&rtt_var=603&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1810291&cwnd=203&unsent_bytes=0&cid=4fedfedb987824d6&ts=137&x=0"
2025-01-11 04:44:15 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49713	104.21.112.1	443	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:17 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 04:44:17 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:17 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885446 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q4g01lNiZDCwa2NfHyD0SBsgy93pwui6Ppx4cqq7ikaNfyAWUU9eQbbcIhkdEc0OYYROb2ljS6FwMLNtdUsXSze%2BmMeAOfs0%2Fj%2BqGCetvkk9UMtfdmEDcM5PfotvfJbXWwRCVMW9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002402ffd69c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1442&min_rtt=1434&rtt_var=554&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1945369&cwnd=181&unsent_bytes=0&cid=76bc3da022e058ba&ts=153&x=0"
2025-01-11 04:44:17 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49725	104.21.112.1	443	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:18 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 04:44:18 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:18 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885447 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gUdfN80WJHhNGibxy5a3sZ34btOoAk4Awx3dYP4qmkK7tZwgWHXr3k%2F0B%2F65wOu9CRqqrt8e%2BmHyXY5BdsJ5eh0AXj8GvB03VEZb9Rspi54yHlvR2EMd9c0HUr9PW98NCUgogAtA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002403848e4727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1886&min_rtt=1878&rtt_var=720&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1503604&cwnd=234&unsent_bytes=0&cid=21d5f540aec6494e&ts=164&x=0"
2025-01-11 04:44:18 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49732	104.21.112.1	443	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:19 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:20 UTC	851	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:20 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885449 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XlzYJMCxcRjIyCM4s3I3O6S7y5rraD4PJAQAmHs8B0cXEbCxUY45JWcmpZ0Z3rjsAmqmLjbsNsovrwgQzMjej5iTehN95MLyKu02yhrM%2BYrNDFVqHgtZMRGAgHQ0o62cb4E5HsEj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900240417fa843b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1572&rtt_var=591&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1849271&cwnd=203&unsent_bytes=0&cid=b1a1ef72efd37f2e&ts=144&x=0"
2025-01-11 04:44:20 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49744	104.21.112.1	443	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:21 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 04:44:21 UTC	851	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:21 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885450 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DalBYepSTk5kj5Foy5vrJqhc%2Bqx3XOz92KC079jDvIoZZAqCCNFV8ROG9eaNx5071BECtPIZFkuRADwtRQmwyTb61DfFBVoQdufQpN7aAOM8GMdEHovGQBHMkrdJsMQjEJVq1rug"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002404a08620f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1616&rtt_var=618&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1754807&cwnd=221&unsent_bytes=0&cid=9eea253f681fd8c5&ts=240&x=0"
2025-01-11 04:44:21 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49756	104.21.112.1	443	6952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:22 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:22 UTC	861	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885451 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7HOinA%2FoqnKayDU0PkuvDR4AEVQiOb%2FLxGSWyYdZL2qe5JzUSG%2BYd8Oq619q15HS3SzowrDhx5%2FvRR7nf6B8euSgy%2FQ5kqb4wk06PMBxLf65g%2BdPKntIAaOLnAImjAWHSwGOSZUZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90024052da370f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1578&rtt_var=601&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1808049&cwnd=221&unsent_bytes=0&cid=9b3e17142ed16950&ts=136&x=0"
2025-01-11 04:44:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49769	104.21.112.1	443	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:24 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885453 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Rf9vjG7uGKI7UmxQE80KziVR1xmy6AOEwRnNO%2F2%2BfmSkXwAH7MP1Dy5iOpmFpkngWuEwXntugUYXtKKKeoFshSltAA9MxMVYveJZm5yzRhgISsI77bN1map3A9ImdEge4m6c8dN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002405e3b44727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1898&min_rtt=1886&rtt_var=731&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1473259&cwnd=234&unsent_bytes=0&cid=af82258923204b66&ts=185&x=0"
2025-01-11 04:44:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49776	104.21.112.1	443	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:25 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 04:44:25 UTC	863	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885454 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kDKi%2FoNjJWPNooo4tbQBVZtuTqbwCe85%2FbcLSbRjA%2B6DRMojGKchzI5qFf9ElIegYCoMsDinKV2%2B5OvGsYCR9r9WZrRp3BaR9hMgn%2B0QPzhnHVytI%2FtExshBZjH%2Bny7EvTViIaNy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900240633907727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1959&min_rtt=1959&rtt_var=735&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1489036&cwnd=234&unsent_bytes=0&cid=998751a2948efcd2&ts=155&x=0"
2025-01-11 04:44:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49788	104.21.112.1	443	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:26 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:26 UTC	862	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:26 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885455 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tLbIZgd8SD6SoBWWVMSrzZ3U4hlZ%2FzOMd8gqJQyyXzj%2B6aVwFUWY%2BBXwpZ9RjVL8C1Ba0b2IuELwHxVWxZ96rCG8SNdvVB%2FArkT51dRWUZ6HV1NqgprTZwF1E9%2B%2ByKBmoqfeXi8e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002406afbfd0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5171&min_rtt=1665&rtt_var=2872&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1753753&cwnd=221&unsent_bytes=0&cid=6b4def70d23914b5&ts=131&x=0"
2025-01-11 04:44:26 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49797	104.21.112.1	443	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:27 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:28 UTC	861	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:27 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885457 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CXQTpppSlQNthZzdiEHU%2FzoB5AJ1K%2BlbiWrD0LH2Db6p%2B1CCB3yGk9asD2YpGyVWcQpxTegTaijkwRpkY4TFuissS8%2F4TI4WI85RxvV%2Fs0ihbvDuaA7yt7dfDIrpAsb%2FUrbU0MR4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90024072caab727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1990&min_rtt=1980&rtt_var=762&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1417475&cwnd=234&unsent_bytes=0&cid=ec3a48b944304e4a&ts=139&x=0"
2025-01-11 04:44:28 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49807	104.21.112.1	443	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:29 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:29 UTC	863	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885458 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lp9v%2F%2FX42adaBYzcfJHVs2%2FCFSw7UFB7loG%2B9DEYXLdWy7r7nJRXC6LMnzYP3bwHalvl1h5Ah4%2BjrS4BMY4xqRfJXdC%2F9%2F6GMm2G2gb2f32rJblsEuN6qQgk3BQlcBzO1HudJMVi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002407b6cac727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1976&min_rtt=1973&rtt_var=746&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1460730&cwnd=234&unsent_bytes=0&cid=dda9caeae16a569f&ts=166&x=0"
2025-01-11 04:44:29 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49817	104.21.112.1	443	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:30 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 04:44:30 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885459 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zI%2FMcJelMy1cCRajGiMcw%2B9UtnOvwtRC9Dz0HzK1qcDg7DZsPzl9hpmPNmuQ4a2WIP3LUrQgtIDBJ3g7rpC8odpjMQIX6OJE0QBcoBlQ5CN2dRQaWuXtN0zyNWOm9OezdbzvFbCD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900240838cf643b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1575&min_rtt=1570&rtt_var=600&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1808049&cwnd=203&unsent_bytes=0&cid=62108686afc4bfef&ts=149&x=0"
2025-01-11 04:44:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49823	104.21.112.1	443	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:31 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 04:44:31 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:31 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885461 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G2ZfoTML55VS45OLm82Oj6QjJw8OtMLfqfdK5wXf6mbqYFYTeH9NYiCn4QTGyG9JnLY5UVNUHQftTP%2BfkBtKhUZx4gB0dQuIN0v0f%2FZkOQ7A6gyEgu%2F2YMhu7m7BwL79OM6jyiPu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002408b9850424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1577&min_rtt=1567&rtt_var=609&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1765417&cwnd=248&unsent_bytes=0&cid=c44c74295af6e505&ts=156&x=0"
2025-01-11 04:44:31 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49835	104.21.112.1	443	6480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:44:33 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 04:44:33 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 04:44:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1885462 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qy7eW%2BDsrK1H0LwBAlltQdqErec8WJZhyRcq5BDMgBrawYdOQmwnTjHmg20QOJHjObrbAWovSvPLGBLPJwWdznWbQIGUxqR2FkYR5se334SvCCSe3Mho3tdW3sS%2BOsll6lfYvW4Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900240937f4cc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1522&min_rtt=1514&rtt_var=585&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1842271&cwnd=181&unsent_bytes=0&cid=84c3bebf07764a3a&ts=146&x=0"
2025-01-11 04:44:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	5
Start time:	23:44:06
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\prgNb8YFEA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\prgNb8YFEA.exe"
Imagebase:	0xd20000
File size:	609'280 bytes
MD5 hash:	5314DC731381DE014B294374B0EB7666
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:44:07
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\Milburr\brontothere.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\prgNb8YFEA.exe"
Imagebase:	0xb10000
File size:	609'280 bytes
MD5 hash:	5314DC731381DE014B294374B0EB7666
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000007.00000002.1312613369.0000000002860000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs Detection: 73%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:44:09
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\prgNb8YFEA.exe"
Imagebase:	0xb90000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000008.00000002.3752407618.0000000000415000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.3754613774.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.3754613774.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:44:18
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs"
Imagebase:	0x7ff76b730000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:44:19
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\Milburr\brontothere.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Milburr\brontothere.exe"
Imagebase:	0xb10000
File size:	609'280 bytes
MD5 hash:	5314DC731381DE014B294374B0EB7666
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 0000000B.00000002.1424887574.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:44:20
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Milburr\brontothere.exe"
Imagebase:	0x310000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000C.00000002.3754528656.000000000283B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000C.00000002.3754528656.0000000002671000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	169

Executed Functions

Function 00D23B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D23B7A
IsDebuggerPresent.KERNEL32 ref: 00D23B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00DE62F8,00DE62E0,?,?), ref: 00D23BFD

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

Part of subcall function 00D30A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00D23C26,00DE62F8,?,?,?), ref: 00D30ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00D23C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00DD93F0,00000010), ref: 00D5D4BC
SetCurrentDirectoryW.KERNEL32(?,00DE62F8,?,?,?), ref: 00D5D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00DD5D40,00DE62F8,?,?,?), ref: 00D5D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00D5D581

Part of subcall function 00D23A58: GetSysColorBrush.USER32(0000000F), ref: 00D23A62
Part of subcall function 00D23A58: LoadCursorW.USER32(00000000,00007F00), ref: 00D23A71
Part of subcall function 00D23A58: LoadIconW.USER32(00000063), ref: 00D23A88
Part of subcall function 00D23A58: LoadIconW.USER32(000000A4), ref: 00D23A9A
Part of subcall function 00D23A58: LoadIconW.USER32(000000A2), ref: 00D23AAC
Part of subcall function 00D23A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00D23AD2
Part of subcall function 00D23A58: RegisterClassExW.USER32(?), ref: 00D23B28

Part of subcall function 00D239E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D23A15
Part of subcall function 00D239E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D23A36
Part of subcall function 00D239E7: ShowWindow.USER32(00000000,?,?), ref: 00D23A4A
Part of subcall function 00D239E7: ShowWindow.USER32(00000000,?,?), ref: 00D23A53

Part of subcall function 00D243DB: _memset.LIBCMT ref: 00D24401
Part of subcall function 00D243DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D244A6

Strings

This is a third-party compiled AutoIt script., xrefs: 00D5D4B4
runas, xrefs: 00D5D575

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: ffbadf38973ed34f151c806e8315b8e074bd01d336936e0c783e204c03bc1443
Instruction ID: 385fb2281aa6803d04a8af961d5dbc3d0e419eb1b24a06a411a53557fbd52d0e
Opcode Fuzzy Hash: ffbadf38973ed34f151c806e8315b8e074bd01d336936e0c783e204c03bc1443
Instruction Fuzzy Hash: BD511530908398AECF21FBB0FC45EED7B79EB25348B0441A5F951A63A1DA748605DB35

Function 00D23633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00D236D2
KillTimer.USER32(?,00000001), ref: 00D236FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D2371F
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00D2372A
CreatePopupMenu.USER32 ref: 00D2373E
PostQuitMessage.USER32(00000000), ref: 00D2375F

Strings

TaskbarCreated, xrefs: 00D23725

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: b4bf7ec92f3b816e0aabae2ae6fd367e56cf9f5b6ead67d7d86a05529af70bd9
Instruction ID: a030858b91bb821be86ff3ef1b605a1aae5308a928f4bf2d1d317b1fece2a94c
Opcode Fuzzy Hash: b4bf7ec92f3b816e0aabae2ae6fd367e56cf9f5b6ead67d7d86a05529af70bd9
Instruction Fuzzy Hash: 264148B1200255BBDF207F68FC89B793759EB71345F080128FA82C63E1CA69DE019775

Function 00D24AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00D24B2B

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

GetCurrentProcess.KERNEL32(?,00DAFAEC,00000000,00000000,?), ref: 00D24BF8
IsWow64Process.KERNEL32(00000000), ref: 00D24BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00D24C45
FreeLibrary.KERNEL32(00000000), ref: 00D24C50
GetSystemInfo.KERNEL32(00000000), ref: 00D24C81
GetSystemInfo.KERNEL32(00000000), ref: 00D24C8D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 28ab9d0f97a7c306b39ae6a1c65901b5842eabbbbad01ae77eebddba06bff5b4
Instruction ID: 862cca1694b8223f694af594a09758fe2742a81dfb9b5518ce97cfcdc307e9d6
Opcode Fuzzy Hash: 28ab9d0f97a7c306b39ae6a1c65901b5842eabbbbad01ae77eebddba06bff5b4
Instruction Fuzzy Hash: D691E53154A7D0DECB31CB6894511AABFE5AF3A304B484D9DE8CB93A01D220E908D779

Function 00D24FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00D24FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00D24EEE,?,?,00000000,00000000), ref: 00D25010
LoadResource.KERNEL32(?,00000000,?,?,00D24EEE,?,?,00000000,00000000,?,?,?,?,?,?,00D24F8F), ref: 00D5DD60
SizeofResource.KERNEL32(?,00000000,?,?,00D24EEE,?,?,00000000,00000000,?,?,?,?,?,?,00D24F8F), ref: 00D5DD75
LockResource.KERNEL32(00D24EEE,?,?,00D24EEE,?,?,00000000,00000000,?,?,?,?,?,?,00D24F8F,00000000), ref: 00D5DD88

Strings

SCRIPT, xrefs: 00D25006

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 1e9c401aaa633336fa97b49730e1e377b11d2a39336b14339227b7caa34e21bf
Instruction ID: 8b036937f6ed4b541e736faac46b92ea91e3a9f52b4100ecba0697a9537b4b3a
Opcode Fuzzy Hash: 1e9c401aaa633336fa97b49730e1e377b11d2a39336b14339227b7caa34e21bf
Instruction Fuzzy Hash: EB117C75240700BFD7218BA5EC58F677BB9EBCAB16F2441ACF406CA264DB71EC0086B0

Function 00E37080 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 00E371BA
GetProcAddress.KERNEL32(?,00E30FF9), ref: 00E371D8
ExitProcess.KERNEL32(?,00E30FF9), ref: 00E371E9
VirtualProtect.KERNELBASE(00D20000,00001000,00000004,?,00000000), ref: 00E37237
VirtualProtect.KERNELBASE(00D20000,00001000), ref: 00E3724C

Memory Dump Source

Source File: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: 8783289a0e8441c311daff7a58b3808c4b9a86d2b8a923c3c7e977b40eabf210
Instruction ID: d9421bcfe5d40edad6ec2859ded649cdda107d2135baf597ec87223c67fe96aa
Opcode Fuzzy Hash: 8783289a0e8441c311daff7a58b3808c4b9a86d2b8a923c3c7e977b40eabf210
Instruction Fuzzy Hash: 28514BF2A593524BD7348AB8CCC86A1BFA0EB41328F181778D9E1E73C5E7A05C05C760

Function 00D2FE40 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: e27b22b863d08bd5918582bbcdcbeff368bb814c57357fc08b26d77bbe999043
Instruction ID: 0ea2b7bad77cfe66675dd0090977e3700a4e683c7163ce877db4f8ad6bde698c
Opcode Fuzzy Hash: e27b22b863d08bd5918582bbcdcbeff368bb814c57357fc08b26d77bbe999043
Instruction Fuzzy Hash: 5A9248746083519FD724DF18C590B6ABBE1FF88304F18896DE98A8B352D771EC45CBA2

Function 00D84696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00D5E7C1), ref: 00D846A6
FindFirstFileW.KERNELBASE(?,?), ref: 00D846B7
FindClose.KERNEL32(00000000), ref: 00D846C7

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: ccaf79711f8e9c6fd0e64e0bdb7c6998829c8357fda9bb6853f5c6861d2cb382
Instruction ID: 28d06350bb5fc7505d022848171d72f6700449380f663c38768cb611261fab4b
Opcode Fuzzy Hash: ccaf79711f8e9c6fd0e64e0bdb7c6998829c8357fda9bb6853f5c6861d2cb382
Instruction Fuzzy Hash: 4BE0DF328106016B8610B778EC4E9EA779CDE07335F100766F876C22E0FBB09D6086BA

Function 00D2E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00D6428C

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 8fad81a2f69c10b9f1cb7a71ff1e86b00964e6dc195265aa4e3290109c6a1378
Instruction ID: 352f6efc99f07020c291339a01853a5a48a1d67c7415a6a2a37750c2d6fe809b
Opcode Fuzzy Hash: 8fad81a2f69c10b9f1cb7a71ff1e86b00964e6dc195265aa4e3290109c6a1378
Instruction Fuzzy Hash: 1CA2C674A04225CFCB14CF58E580AADB7B1FF68308F688469E956AB351D731ED42CBB1

Function 00D30B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D30BBB
timeGetTime.WINMM ref: 00D30E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D30FB3
TranslateMessage.USER32(?), ref: 00D30FC7
DispatchMessageW.USER32(?), ref: 00D30FD5
Sleep.KERNEL32(0000000A), ref: 00D30FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00D3105A
DestroyWindow.USER32 ref: 00D31066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D31080
Sleep.KERNEL32(0000000A,?,?), ref: 00D652AD
TranslateMessage.USER32(?), ref: 00D6608A
DispatchMessageW.USER32(?), ref: 00D66098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D660AC

Strings

@GUI_CTRLHANDLE, xrefs: 00D6540E
@COM_EVENTOBJ, xrefs: 00D6591A
@TRAY_ID, xrefs: 00D65BB9
@GUI_WINHANDLE, xrefs: 00D653B9
@GUI_CTRLID, xrefs: 00D65364

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 67d9e0303276658fbc3da51a0887fff93af19b46d514f44cae492c36ce88456d
Instruction ID: 0a0bb36bf8d49e1d04dac3ddfdc2c73ef496cb035585d7c4bf25b33fc1ea7a38
Opcode Fuzzy Hash: 67d9e0303276658fbc3da51a0887fff93af19b46d514f44cae492c36ce88456d
Instruction Fuzzy Hash: 86B2AB70608741DBD724DF24D894BAABBE4FF94304F18495DF48A972A1DB71E884CBB2

Function 00D893DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D891E9: __time64.LIBCMT ref: 00D891F3

Part of subcall function 00D25045: _fseek.LIBCMT ref: 00D2505D

__wsplitpath.LIBCMT ref: 00D894BE

Part of subcall function 00D4432E: __wsplitpath_helper.LIBCMT ref: 00D4436E

_wcscpy.LIBCMT ref: 00D894D1
_wcscat.LIBCMT ref: 00D894E4
__wsplitpath.LIBCMT ref: 00D89509
_wcscat.LIBCMT ref: 00D8951F
_wcscat.LIBCMT ref: 00D89532

Part of subcall function 00D8922F: _memmove.LIBCMT ref: 00D89268
Part of subcall function 00D8922F: _memmove.LIBCMT ref: 00D89277

_wcscmp.LIBCMT ref: 00D89479

Part of subcall function 00D899BE: _wcscmp.LIBCMT ref: 00D89AAE
Part of subcall function 00D899BE: _wcscmp.LIBCMT ref: 00D89AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00D896DC
_wcsncpy.LIBCMT ref: 00D8974F
DeleteFileW.KERNEL32(?,?), ref: 00D89785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00D8979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D897AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D897BE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 78cf4b47bcbe274394fbce0289f730fb92a4559d743b133b02e02309f4363df7
Instruction ID: ad414477aff43f16fa8e75012ef98563fe92c64d681a6d491eceb07f5407daa5
Opcode Fuzzy Hash: 78cf4b47bcbe274394fbce0289f730fb92a4559d743b133b02e02309f4363df7
Instruction Fuzzy Hash: 18C13BB1900229ABCF21EF95DC85EEEB7BCEF55300F0440AAF649E6151EB309A448F75

Function 00D271EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D24864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00DE62F8,?,00D237C0,?), ref: 00D24882

Part of subcall function 00D4074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00D272C5), ref: 00D40771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00D27308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00D5ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00D5ED32
RegCloseKey.ADVAPI32(?), ref: 00D5ED70
_wcscat.LIBCMT ref: 00D5EDC9

Strings

\Include\, xrefs: 00D272C5
\, xrefs: 00D5EDEC
Software\AutoIt v3\AutoIt, xrefs: 00D272FE
Include, xrefs: 00D5ECE8, 00D5ED29

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 95da427c30348e6a2907de3302206e353b9958cb573240de0520f46a6b58a178
Instruction ID: 2ccda3a4c3113a8ac7ecfaa615e455499b8e9d9b2e92fd89c63a1ac09eea0fb3
Opcode Fuzzy Hash: 95da427c30348e6a2907de3302206e353b9958cb573240de0520f46a6b58a178
Instruction Fuzzy Hash: FE717C714083419EC754EF65EC819ABBBE8FF59300F44042EFA45DB2A0EB309949CB7A

Function 00D23A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D23A62
LoadCursorW.USER32(00000000,00007F00), ref: 00D23A71
LoadIconW.USER32(00000063), ref: 00D23A88
LoadIconW.USER32(000000A4), ref: 00D23A9A
LoadIconW.USER32(000000A2), ref: 00D23AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00D23AD2
RegisterClassExW.USER32(?), ref: 00D23B28

Part of subcall function 00D23041: GetSysColorBrush.USER32(0000000F), ref: 00D23074
Part of subcall function 00D23041: RegisterClassExW.USER32(00000030), ref: 00D2309E
Part of subcall function 00D23041: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00D230AF
Part of subcall function 00D23041: LoadIconW.USER32(000000A9), ref: 00D230F2

Strings

0, xrefs: 00D23B06
AutoIt v3, xrefs: 00D23B17
#, xrefs: 00D23B0D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: 03c5f4d8639ef44888814eb694660fbddb23ed5690977971441a57c7625a69a2
Instruction ID: e158a5a773fa0f9839b97fd83eca72f81996db8bf254cac1875909b0ccfeb9e0
Opcode Fuzzy Hash: 03c5f4d8639ef44888814eb694660fbddb23ed5690977971441a57c7625a69a2
Instruction Fuzzy Hash: 5D215E71D00354AFDB10AFA4EC89B9D7BB4FB18755F000169F604EA3A0D3BA95548F78

Function 00D23778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 00D238A4
/AutoIt3ExecuteScript, xrefs: 00D238CE
/ErrorStdOut, xrefs: 00D2388F
/AutoIt3ExecuteLine, xrefs: 00D238B9
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00D237C0
CMDLINERAW, xrefs: 00D2380D
CMDLINE, xrefs: 00D23834

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 53e1d05537fd879c7e50d620f74cf30b978f8bfb4abbebf40b6ec0631331bb0f
Instruction ID: e150f1a73e97c9958dad001ab31629941e92f1dc60f54c30a27e2fff669ad04e
Opcode Fuzzy Hash: 53e1d05537fd879c7e50d620f74cf30b978f8bfb4abbebf40b6ec0631331bb0f
Instruction Fuzzy Hash: A0A14D719102699ADF14EBA0EC92EEEB778FF24314F440529F812B7191DB749A09CB70

Function 00D23015 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 73
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D23074
RegisterClassExW.USER32(00000030), ref: 00D2309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00D230AF
LoadIconW.USER32(000000A9), ref: 00D230F2

Strings

0, xrefs: 00D23056
AutoIt v3 GUI, xrefs: 00D23090
+, xrefs: 00D2305D
TaskbarCreated, xrefs: 00D230A4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 801a3a32879a0e41690de061cd38c412c1852ac0618fe7cef01202384e44b5f6
Instruction ID: 9e75d24b4eb025a238801dcd2faed4dac525ca495b07149498b4f4a5a68a0597
Opcode Fuzzy Hash: 801a3a32879a0e41690de061cd38c412c1852ac0618fe7cef01202384e44b5f6
Instruction Fuzzy Hash: B23147B1801349AFEB50AFE4D885AD9BBF4FB1A310F10456AE540EA3A0E3B54545CFA5

Function 00D23041 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D23074
RegisterClassExW.USER32(00000030), ref: 00D2309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00D230AF
LoadIconW.USER32(000000A9), ref: 00D230F2

Strings

0, xrefs: 00D23056
AutoIt v3 GUI, xrefs: 00D23090
+, xrefs: 00D2305D
TaskbarCreated, xrefs: 00D230A4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: ac63eed37872e69a2d08a5dff43f3d2488565f249d6146037a2216c81cf9c87c
Instruction ID: e4a8dcdc43ce8bd475d553eaa49310309dcd4934d8d8de801f26bd73cd2871c5
Opcode Fuzzy Hash: ac63eed37872e69a2d08a5dff43f3d2488565f249d6146037a2216c81cf9c87c
Instruction Fuzzy Hash: 7F21E5B1900358AFDB00EFE4E889B9DBBF4FB19750F00456AF610EA3A0D7B145448FA5

Function 01228758 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0122879D

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction ID: 8b766bb851da76f9eb27daf51f31eb52e4f27eb39d02d5d40b08664b3d30671b
Opcode Fuzzy Hash: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction Fuzzy Hash: CA510D75A60209FBEF20DFA4CC49FDE77B8AF48700F108554F60AEB280DAB49644CB60

Function 00D273E5 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00D5EE62
758ED0D0.COMDLG32(?), ref: 00D5EEAC

Part of subcall function 00D248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D248A1,?,?,00D237C0,?), ref: 00D248CE

Part of subcall function 00D409D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00D409F4

Strings

AutoIt script files (*.au3, *.a3x), xrefs: 00D5EE90
X, xrefs: 00D5EE7A
au3, xrefs: 00D5EEA5
Run Script:, xrefs: 00D5EE81

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: NamePath$FullLong_memset
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$X$au3
API String ID: 3051022977-1954568251
Opcode ID: c27a300e7d9d266f03c8f09cf8e5f8697f52ffa71a5d3fe16018f6a101453268
Instruction ID: ab002504f207e354de532b9b7d48b641a1b38e6b417916f685df06af649b3373
Opcode Fuzzy Hash: c27a300e7d9d266f03c8f09cf8e5f8697f52ffa71a5d3fe16018f6a101453268
Instruction Fuzzy Hash: DC21A4719102589BCF15AF94D8457EEBBF8DF59305F04405AE808E7341DBB4598A8FB1

Function 00D239E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D23A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D23A36
ShowWindow.USER32(00000000,?,?), ref: 00D23A4A
ShowWindow.USER32(00000000,?,?), ref: 00D23A53

Strings

AutoIt v3, xrefs: 00D23A0D, 00D23A12, 00D23A13
edit, xrefs: 00D23A30

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 112dc71bb8f3811173425c940cc37d35c0aafdedaf0c045829849df8c4ee0b86
Instruction ID: 7a0bb5039170d73d1a3d602f5719b1f3b3db36a1804a8050883685949fb2c6cb
Opcode Fuzzy Hash: 112dc71bb8f3811173425c940cc37d35c0aafdedaf0c045829849df8c4ee0b86
Instruction Fuzzy Hash: 70F030706003D07EEA3027536C88E773E7DD7D7FA0B000069BA00E6370C1A55840CA74

Function 00D2410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00D5D5EC

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

_memset.LIBCMT ref: 00D2418D
_wcscpy.LIBCMT ref: 00D241E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D241F1

Strings

Line: , xrefs: 00D5D615

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 2b38eb7883570aa1c829828bcc8e08922df360ee1ba991b14b4c3dea66550c5b
Instruction ID: c1e8064acbf2b458aedba82139b441b3f0bf85b89d7aa1124739656c2b9df405
Opcode Fuzzy Hash: 2b38eb7883570aa1c829828bcc8e08922df360ee1ba991b14b4c3dea66550c5b
Instruction Fuzzy Hash: 9431B5710083649AD732EB60EC86FDB77E8EF74308F14451AF58596191EB70A648C7B6

Function 00D4564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D456AB
_memcpy_s.LIBCMT ref: 00D4571D
__read_nolock.LIBCMT ref: 00D4577B
__filbuf.LIBCMT ref: 00D4579E
_memset.LIBCMT ref: 00D457E2

Part of subcall function 00D48D68: __getptd_noexit.LIBCMT ref: 00D48D68

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: efc2d9f757000146e59f39f744598be14688e768d1162778b130ff8829ba74d7
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 2B51C130A00B05DBDB248FA9E88066E77A1EF40320F288739F865962DAD7709D549B70

Function 00D269CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00D24F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00DE62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D24F6F

_free.LIBCMT ref: 00D5E68C
_free.LIBCMT ref: 00D5E6D3

Part of subcall function 00D26BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00D26D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00D5E462
Bad directive syntax error, xrefs: 00D5E6BB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 8333959ea6304119ba0055d2f83bd0f2a75896ddb7d034d96f57810d6b2f3fce
Instruction ID: 73767c737375b63e7202f2a97f86d3c5d55ab41c57d9a3772195f2a02aa03b7c
Opcode Fuzzy Hash: 8333959ea6304119ba0055d2f83bd0f2a75896ddb7d034d96f57810d6b2f3fce
Instruction Fuzzy Hash: A9914D719102299FCF18EFA4D8919EDB7B4FF19315B14446AFC15AB291EB30DA09CB70

Function 0122A218 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 158fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0122A108: Sleep.KERNELBASE(000001F4), ref: 0122A119

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0122A35C

Strings

8QD59M3HNU1LF9649O, xrefs: 0122A3DC, 0122A3DF

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID: CreateFileSleep
String ID: 8QD59M3HNU1LF9649O
API String ID: 2694422964-585315891
Opcode ID: 1d55aae29ea521e211a89930ebd26db8cb2e5d468b4d02a5c5fa03e16dce0d5a
Instruction ID: 5b2b2845613d4f5a26f8e2734a4189207beff7ed80ed939b4062d15ccbd367f1
Opcode Fuzzy Hash: 1d55aae29ea521e211a89930ebd26db8cb2e5d468b4d02a5c5fa03e16dce0d5a
Instruction Fuzzy Hash: 5561B530D14259EBEF11DBB4C844BEEBBB9AF14300F104199E609BB2C1D7BA4B45CB65

Function 00D235B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00D235A1,SwapMouseButtons,00000004,?), ref: 00D235D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00D235A1,SwapMouseButtons,00000004,?,?,?,?,00D22754), ref: 00D235F5
RegCloseKey.KERNELBASE(00000000,?,?,00D235A1,SwapMouseButtons,00000004,?,?,?,?,00D22754), ref: 00D23617

Strings

Control Panel\Mouse, xrefs: 00D235D2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: b5168eaea84aa5e857fd99411821ee73f2937119b592c9cfe272987fc51c29d4
Instruction ID: cce0abe239684bda5a431fb83163e24ab5bbcfaf2ae8db8ce92632107044ea7d
Opcode Fuzzy Hash: b5168eaea84aa5e857fd99411821ee73f2937119b592c9cfe272987fc51c29d4
Instruction Fuzzy Hash: 5D114571610228BFDB208FA4EC80AAEBBBCEF55745F018469E805D7210E2719E409BB4

Function 00D897E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00D25045: _fseek.LIBCMT ref: 00D2505D

Part of subcall function 00D899BE: _wcscmp.LIBCMT ref: 00D89AAE
Part of subcall function 00D899BE: _wcscmp.LIBCMT ref: 00D89AC1

_free.LIBCMT ref: 00D8992C
_free.LIBCMT ref: 00D89933
_free.LIBCMT ref: 00D8999E

Part of subcall function 00D42F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00D49C64), ref: 00D42FA9
Part of subcall function 00D42F95: GetLastError.KERNEL32(00000000,?,00D49C64), ref: 00D42FBB

_free.LIBCMT ref: 00D899A6

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: d9ae0c5d453641694606f69828c3ed73b5fd5779769f00272cc49afe01aba135
Instruction ID: f3891d12401228233551c9ad9e86ca5f3bf8f1ea6a920368d1267f04c4c02e22
Opcode Fuzzy Hash: d9ae0c5d453641694606f69828c3ed73b5fd5779769f00272cc49afe01aba135
Instruction Fuzzy Hash: A25150B1904218AFDF249F64DC41AAEBBB9EF48314F1404AEF649A7241DB715E80CF78

Function 00D4493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D449D0
__flush.LIBCMT ref: 00D449F0
__write.LIBCMT ref: 00D44A23
__flsbuf.LIBCMT ref: 00D44A51

Part of subcall function 00D48D68: __getptd_noexit.LIBCMT ref: 00D48D68

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 94f9651dae3056c977c36bd7d3ac926119ada3eda5abe8c640e54cf934546a33
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 7741E7716007059BDF28CEA9C881BAF77A6EF84364B28813DE895C7680D770DDC09B74

Function 00D8901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D89036
__fread_nolock.LIBCMT ref: 00D8904B

Strings

EA06, xrefs: 00D8907D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 5e411d3a79d285044533ddec3855df76f13ad8dc5bb576e11f0e8c4db9e940f6
Instruction ID: 02dfd80b877a36e09d6dc40602f6ccf1d699a43cdef1e695dbc202e9f3724f42
Opcode Fuzzy Hash: 5e411d3a79d285044533ddec3855df76f13ad8dc5bb576e11f0e8c4db9e940f6
Instruction Fuzzy Hash: 3401F9718042186FDB28C6A8D816EFEBBF8DB01301F04419BF592D2181E575E608CB70

Function 00D40FF6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D4594C: __FF_MSGBANNER.LIBCMT ref: 00D45963
Part of subcall function 00D4594C: __NMSG_WRITE.LIBCMT ref: 00D4596A
Part of subcall function 00D4594C: RtlAllocateHeap.NTDLL(01090000,00000000,00000001), ref: 00D4598F

std::exception::exception.LIBCMT ref: 00D4102C
__CxxThrowException@8.LIBCMT ref: 00D41041

Part of subcall function 00D487DB: RaiseException.KERNEL32(?,?,00000000,00DDBAF8,?,00000001,?,?,?,00D41046,00000000,00DDBAF8,00D29FEC,00000001), ref: 00D48830

Strings

bad allocation, xrefs: 00D41021

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: 9db3467d5686ec638194673d0649572f96961aae1eb86449579d70d60ca94b60
Instruction ID: cf7c56f7eaebaad2a43ea6066fb90913442593b5fb221533abc53a19b2cb6479
Opcode Fuzzy Hash: 9db3467d5686ec638194673d0649572f96961aae1eb86449579d70d60ca94b60
Instruction Fuzzy Hash: 64F0A439500259A7CB20BB58EC16AEF7BA8DF01391F140426F804A6692DFB18AC496F4

Function 01228E38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01228E7D
ExitProcess.KERNEL32(00000000), ref: 01228E9C

Strings

D, xrefs: 01228E49

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID: Process$CreateExit
String ID: D
API String ID: 126409537-2746444292
Opcode ID: 8ff53cc741f04adc946779470c72492426263afa614c789403871e93d35377f7
Instruction ID: 1d00bc6e22ebd27b5916e76346f49cf195a9b9c3559fa81e82ed33ec6c7dc94b
Opcode Fuzzy Hash: 8ff53cc741f04adc946779470c72492426263afa614c789403871e93d35377f7
Instruction Fuzzy Hash: 58F0ECB195025DABDB60EFE0CC49FEE7778BF04701F448508FB0A9A180DA74D6088B61

Function 00D89B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00D89B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00D89B99

Strings

aut, xrefs: 00D89B93

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: c0d47ef105b8a266c254bf1d510f15c2c7d47ce8c1f4c2b6126236ed189b537b
Instruction ID: ac7c59caf0546b27cd1841983e49c0d1aadda4499a353d97786a385ea4bc297d
Opcode Fuzzy Hash: c0d47ef105b8a266c254bf1d510f15c2c7d47ce8c1f4c2b6126236ed189b537b
Instruction Fuzzy Hash: FDD05E7954030DABDB109BD4DC0EFDA772CE705705F0042E1BE94D12A1DEB455988BA5

Function 00D9CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1a00366304add2f781e52a9e8fcca9faddf4c75dadfbc4d56260b9cc5f21ce
Instruction ID: a7bf2f2c917b1ffbe369e6b874a23cc3bcf9f5df6bc921773ea10de4cf2b9f16
Opcode Fuzzy Hash: dd1a00366304add2f781e52a9e8fcca9faddf4c75dadfbc4d56260b9cc5f21ce
Instruction Fuzzy Hash: FAF14771A083019FCB14DF28C484A6ABBE5FF88314F14892EF8999B351D731E945CFA2

Function 00D2F8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D403A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D403D3
Part of subcall function 00D403A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00D403DB
Part of subcall function 00D403A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D403E6
Part of subcall function 00D403A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D403F1
Part of subcall function 00D403A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00D403F9
Part of subcall function 00D403A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00D40401

Part of subcall function 00D36259: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 00D362B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D2FB2D
OleInitialize.OLE32(00000000), ref: 00D2FBAA
CloseHandle.KERNEL32(00000000), ref: 00D649F2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Virtual$Handle$ClipboardCloseFormatInitializeRegister
String ID:
API String ID: 3094916012-0
Opcode ID: 2fc713a38393dfcf04cc6a5bd33d2919777f0dd36cabc3285c2ebd66d14d696f
Instruction ID: f7792ed6a7648f16a0384022d89e99b313473361ce99fbb93dbafa16c14f3424
Opcode Fuzzy Hash: 2fc713a38393dfcf04cc6a5bd33d2919777f0dd36cabc3285c2ebd66d14d696f
Instruction Fuzzy Hash: 6C81BAB09083D08EC394FF7AE9906157BE4EB78398714853AE019CB3A2EB31D4048F71

Function 00D243DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D24401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D244A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D244C3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 305d81cca67442d9b7085af1ac82368683b7dd10ca9d7b18cd70b6b1b099e693
Instruction ID: a81cba6560c298e2f6a587c6f96375e71bc82408144b797bd12877cb5e7b0f0b
Opcode Fuzzy Hash: 305d81cca67442d9b7085af1ac82368683b7dd10ca9d7b18cd70b6b1b099e693
Instruction Fuzzy Hash: 573180705047518FD721EF24E88479BBBE8FB69308F04092EEA9AC7241D7B5A944CB76

Function 00D4594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00D45963

Part of subcall function 00D4A3AB: __NMSG_WRITE.LIBCMT ref: 00D4A3D2
Part of subcall function 00D4A3AB: __NMSG_WRITE.LIBCMT ref: 00D4A3DC

__NMSG_WRITE.LIBCMT ref: 00D4596A

Part of subcall function 00D4A408: GetModuleFileNameW.KERNEL32(00000000,00DE43BA,00000104,00000000,00000001,00000000), ref: 00D4A49A
Part of subcall function 00D4A408: ___crtMessageBoxW.LIBCMT ref: 00D4A548

Part of subcall function 00D432DF: ___crtCorExitProcess.LIBCMT ref: 00D432E5
Part of subcall function 00D432DF: ExitProcess.KERNEL32 ref: 00D432EE

Part of subcall function 00D48D68: __getptd_noexit.LIBCMT ref: 00D48D68

RtlAllocateHeap.NTDLL(01090000,00000000,00000001), ref: 00D4598F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 0c69fd1c519bdcfc1986cd11729d5d21ec6344e37a89dbb28547298ab5416669
Instruction ID: 01210cdd95322a77f291793ae50ae8d496c9dba57b983c08f1a4e9bb6cf6cd4c
Opcode Fuzzy Hash: 0c69fd1c519bdcfc1986cd11729d5d21ec6344e37a89dbb28547298ab5416669
Instruction Fuzzy Hash: 7301DE32241B15EFE6217B69FC82B2E7288DF52770F18002AF545EA282DB709D019A74

Function 00D89B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00D897D2,?,?,?,?,?,00000004), ref: 00D89B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00D897D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00D89B5B
CloseHandle.KERNEL32(00000000,?,00D897D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00D89B62

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: b01fed7480f1004761c1152666ee8db2ce81de851c37d853bece218a53f7268f
Instruction ID: dca890957d0f0c1a125f6aa8572937c536bae12230626712dd777f351dc05ae3
Opcode Fuzzy Hash: b01fed7480f1004761c1152666ee8db2ce81de851c37d853bece218a53f7268f
Instruction Fuzzy Hash: ECE08632681314BBDB312B94EC09FDA7B18AB06761F144120FB54A91E0C7B1651197A8

Function 00D88F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D88FA5

Part of subcall function 00D42F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00D49C64), ref: 00D42FA9
Part of subcall function 00D42F95: GetLastError.KERNEL32(00000000,?,00D49C64), ref: 00D42FBB

_free.LIBCMT ref: 00D88FB6
_free.LIBCMT ref: 00D88FC8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction ID: cac514f63f8380f89f6dddc553b6101edcd8458fb406e9b533f988a1f96f1b70
Opcode Fuzzy Hash: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction Fuzzy Hash: 10E012A16097115BCA24B579AD40AA35BEE9F883907DC081DB609DB142DE24F8459634

Function 00D2AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00D6002B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 9a7ffe1889a5f3d73b4c86bc10a56e7f2a0d0fea96819c15a126a8edeef3ee3b
Instruction ID: 554484cac1f3f11f64cd45bac9bb647ffc034eb956d464a311ab9d2c4cc1df22
Opcode Fuzzy Hash: 9a7ffe1889a5f3d73b4c86bc10a56e7f2a0d0fea96819c15a126a8edeef3ee3b
Instruction Fuzzy Hash: 8E223874508361CFC724DF18D490B2ABBE1FF54318F19895DE89A8B262D771EC85CBA2

Function 00D24DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D24E1A

Strings

EA06, xrefs: 00D5DCF5

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: e3520c5efab02e532aac6f1f3cb700829d1dccaf555b390be6355842dcda78a2
Instruction ID: e4b2e3d94ef4816957d8bd9cf781ba0adf2478fe022827c345feaafd89040e91
Opcode Fuzzy Hash: e3520c5efab02e532aac6f1f3cb700829d1dccaf555b390be6355842dcda78a2
Instruction Fuzzy Hash: E0418931A041745BEF219B64FD51BBE7FA2EF65308F2D4065FC829B286C6319D8487B1

Function 00D27BB1 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D27C0B
_memmove.LIBCMT ref: 00D27C76

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 888ce228c65e5e126e2c0d83d6bef63a0f4650b727a1fb86e52d4496ebb79edc
Instruction ID: ee0f0986bcb43cde75c7c736376679fe153273708b1df351a666950df87e908b
Opcode Fuzzy Hash: 888ce228c65e5e126e2c0d83d6bef63a0f4650b727a1fb86e52d4496ebb79edc
Instruction Fuzzy Hash: 7631C5B1604516AFC724DF38E8D1E6AF3A9FF583147198629E915CB291DB70E860CBB0

Function 00D2492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

74E4C8D0.UXTHEME ref: 00D24992

Part of subcall function 00D435AC: __lock.LIBCMT ref: 00D435B2
Part of subcall function 00D435AC: RtlDecodePointer.NTDLL(00000001), ref: 00D435BE
Part of subcall function 00D435AC: RtlEncodePointer.NTDLL(?), ref: 00D435C9

Part of subcall function 00D24A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00D24A73
Part of subcall function 00D24A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00D24A88

Part of subcall function 00D23B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D23B7A
Part of subcall function 00D23B4C: IsDebuggerPresent.KERNEL32 ref: 00D23B8C
Part of subcall function 00D23B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00DE62F8,00DE62E0,?,?), ref: 00D23BFD
Part of subcall function 00D23B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00D23C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00D249D2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$DebuggerDecodeEncodeFullNamePathPresent__lock
String ID:
API String ID: 2688871447-0
Opcode ID: 3557b080ca9d984aa3a9a1e2993d78cb99049809402f11ecc07ef6f79b1215a4
Instruction ID: 7529bcd0e6ffb65950f6ee268167a74d4944cfa1f4a8f11dafc4311577a6fdea
Opcode Fuzzy Hash: 3557b080ca9d984aa3a9a1e2993d78cb99049809402f11ecc07ef6f79b1215a4
Instruction Fuzzy Hash: 51116A719083A19BC700EF68E88590AFBE8EBA4754F00451EF545CB2A1DB709544CBB6

Function 00D4582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D4585C
__lock_file.LIBCMT ref: 00D4587D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: e97508a1a328af5ab706ecb60ad47e921ee7bc757c4a9803fe452d31dfbb8d09
Instruction ID: 87e2a72d470640626a4d537abe02e735fb592c779200373076ca0616435d5d06
Opcode Fuzzy Hash: e97508a1a328af5ab706ecb60ad47e921ee7bc757c4a9803fe452d31dfbb8d09
Instruction Fuzzy Hash: 90018471C00609EBCF22AF699C0159E7B61EF413A0F188215B8146A1A6DF31CA21EBB1

Function 00D455D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D48D68: __getptd_noexit.LIBCMT ref: 00D48D68

__lock_file.LIBCMT ref: 00D4561B

Part of subcall function 00D46E4E: __lock.LIBCMT ref: 00D46E71

__fclose_nolock.LIBCMT ref: 00D45626

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: d82f7e81dc1a4683c502b3e33b9efde28b86297b2a4ab19c2d46c9a28a947923
Instruction ID: 906fa3c4f2b045abc154a5178205f0a871c67bd43d735f434485785534f2e99e
Opcode Fuzzy Hash: d82f7e81dc1a4683c502b3e33b9efde28b86297b2a4ab19c2d46c9a28a947923
Instruction Fuzzy Hash: 29F0B471801A049FDB20BF79980276E77E1EF42774F5A820AA455BB1C7CF7C8901AB75

Function 01228EA8 Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 01228718: GetFileAttributesW.KERNELBASE(?), ref: 01228723

CreateDirectoryW.KERNELBASE(?,00000000), ref: 01229004

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: bbc34b5e2c915c905ceecf86f7bbd45722c993e9a33a4ccb37766f9c384d9c3c
Instruction ID: 31769445a001c32333c166729525e1384128afa5190ef411f1c1eb5905df99e7
Opcode Fuzzy Hash: bbc34b5e2c915c905ceecf86f7bbd45722c993e9a33a4ccb37766f9c384d9c3c
Instruction Fuzzy Hash: BF519431A2121DA6EF14EFA4C844BEE7379EF58300F108568E609F7290EB799B45CB65

Function 00D40E48 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00D40EF7

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: b56e6c92ceaed3dbb17f303ec3e73305e6bb436e9e9c58da3c9f09fb4206405c
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7931F671A00105EFC718DF58C480969FBB6FF99300B688AA5E64ACB651D731EDD1CBE0

Function 00D600D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00D600E1

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b2e8c66e4447142a6573351cb92c49fe37e514ae68132dc9755f51c6f88714ed
Instruction ID: b096bc86ba864612ff9517eb3426bb62fdbabd3197fa0609e0b01965efd9059f
Opcode Fuzzy Hash: b2e8c66e4447142a6573351cb92c49fe37e514ae68132dc9755f51c6f88714ed
Instruction Fuzzy Hash: 4341E4746083518FDB24DF18C484B1ABBE0EF55318F19889CE8998B762D376E885CB62

Function 00D27CB3 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D27D13

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 38e7d15e5132be21b870738e1665a70c02cbf5fd8b91a308b87757b1efea3b30
Instruction ID: fd039baba545c402319c5c196725ed3703bcadf2a01bed2ea79c118ac1533732
Opcode Fuzzy Hash: 38e7d15e5132be21b870738e1665a70c02cbf5fd8b91a308b87757b1efea3b30
Instruction Fuzzy Hash: E421FE31604A09EBDF204F29FC42B797BB8FF60351F25846AE886C9191EB30D0949771

Function 00D24F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D24D13: FreeLibrary.KERNEL32(00000000,?), ref: 00D24D4D

Part of subcall function 00D4548B: __wfsopen.LIBCMT ref: 00D45496

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00DE62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D24F6F

Part of subcall function 00D24CC8: FreeLibrary.KERNEL32(00000000), ref: 00D24D02

Part of subcall function 00D24DD0: _memmove.LIBCMT ref: 00D24E1A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 161503acba2608360dd29a648dbf6cf29a5473cdb400cdfd0b46409d7a544d52
Instruction ID: 0b4f46f234bd772735b69952317cdab5c7c83241f6ba70057cbdec68fb4b0f40
Opcode Fuzzy Hash: 161503acba2608360dd29a648dbf6cf29a5473cdb400cdfd0b46409d7a544d52
Instruction Fuzzy Hash: 2811E731600325ABCF20BF74ED12FAE77A5DFD0705F208469FD81AA1C1DA719A059B70

Function 00D601AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00D601BB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 5a20ef1c2411fa6a073d6d3310d15f5a98ff6e288623c9e07dbf0773ad5e8c4e
Instruction ID: 34a2379b4c6fffd12c19aaf8f4712f17fd8ba59c2e01550e6655b88d7e67305d
Opcode Fuzzy Hash: 5a20ef1c2411fa6a073d6d3310d15f5a98ff6e288623c9e07dbf0773ad5e8c4e
Instruction Fuzzy Hash: C2211374608351CFCB24DF68D445A1ABBE0FF99318F098968F88A87721D731E845CB62

Function 00D44A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00D44AD6

Part of subcall function 00D48D68: __getptd_noexit.LIBCMT ref: 00D48D68

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: e31ced0c8f37ea7f6f3c90c44fcdf794d900f3b2345e5f1ec52ddad95d71face
Instruction ID: 4084d4c8891902eef7dda48ee0e23b8de892f4e232d60db7918287f4dc1205c6
Opcode Fuzzy Hash: e31ced0c8f37ea7f6f3c90c44fcdf794d900f3b2345e5f1ec52ddad95d71face
Instruction Fuzzy Hash: 28F0AF31940209AFDF61AF64CC0639E36A1EF00369F098519B424AB1D1CB788A90EF71

Function 00D24FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00DE62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D24FDE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ebc5862c4f78b39d9716e581e5a2edd33462b79f7fee69b9fed9fe47ccc4ce75
Instruction ID: 466c42def5a78498a22c7add461932f5d56b1be55420557efb80c35554c4350b
Opcode Fuzzy Hash: ebc5862c4f78b39d9716e581e5a2edd33462b79f7fee69b9fed9fe47ccc4ce75
Instruction Fuzzy Hash: 0DF03971105722CFCB349F64F694822BBE1FF643293248A7EE9D682A10C732A844DF70

Function 00D409D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00D409F4

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 40f37fdefc50734e53e83bc9926dd2959db825c3a6e5e17999d445452c9f3015
Instruction ID: df333bd40503c5bcce4526cc2628695d1bf852ef7e6e9d81ec24f44cc3c90577
Opcode Fuzzy Hash: 40f37fdefc50734e53e83bc9926dd2959db825c3a6e5e17999d445452c9f3015
Instruction Fuzzy Hash: B0E0863690522857C720D6989C05FFA77ADDF89691F0401B5FC4CD7205D9609C8186B0

Function 00D89129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00D8914B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 59917afe3cf631cc2e2f4f22481b71599c0836f36445bef37213ba517de6b3fc
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 59E092B0118B005FD7349A24D8147E3B3E0EB06315F04081CF2DA83342EF6378418769

Function 01228718 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 01228723

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction ID: ed3c2dabede1bf28499fd358fbc69bc3e663d6f4288fb42ba578290195bec4c7
Opcode Fuzzy Hash: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction Fuzzy Hash: 3BE08C38936218FBDB68CAA89905AAD73F8AB04320F008664EA06C7280D570CA20E658

Function 012286E8 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 012286F3

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction ID: 293e408bf27089128df13cd12d2fd7af907fc8eb56a734079eb81574584891c5
Opcode Fuzzy Hash: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction Fuzzy Hash: E9D05E3492520CABCB10CAA89D0899D77E89705320F004754E91583280D53199109750

Function 00D4548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00D45496

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: fcd819953ff53b6fdfefcfe00bfa42affa10e5e9af335c05226194cbbb050b28
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: EAB0927684020C77DE012E82FC02A593B199B40678F808020FB0C1C162A673AAA096A9

Function 0122A104 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 0122A119

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 701c0b62aed968d15d1024802980c50725b5cecdfc4ebce95f545f1741bfef63
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 58E0BF7494110DEFDB00DFA4D5496DD7BB4EF04312F1005A1FD05D7680DB309E548A62

Function 0122A108 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 0122A119

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 444d920b30ecef5e6a72962936d409bd03871c2c1bda939f9ae59e9d77c3d512
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 2FE0E67494110DEFDB00DFB4D54969D7BB4EF04302F100161FD01D2680D6309D508A62

Non-executed Functions

Function 00DACDAC Relevance: 68.9, APIs: 37, Strings: 2, Instructions: 637windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?), ref: 00DACE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00DACE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00DACED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DACF00
SendMessageW.USER32 ref: 00DACF29
_wcsncpy.LIBCMT ref: 00DACFA1
GetKeyState.USER32(00000011), ref: 00DACFC2
GetKeyState.USER32(00000009), ref: 00DACFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00DACFE5
GetKeyState.USER32(00000010), ref: 00DACFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DAD018
SendMessageW.USER32 ref: 00DAD03F
SendMessageW.USER32(?,00001030,?,00DAB602), ref: 00DAD145
SetCapture.USER32(?), ref: 00DAD177
ClientToScreen.USER32(?,?), ref: 00DAD1DC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00DAD203
ReleaseCapture.USER32 ref: 00DAD20E
GetCursorPos.USER32(?), ref: 00DAD248
ScreenToClient.USER32(?,?), ref: 00DAD255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00DAD2B1
SendMessageW.USER32 ref: 00DAD2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00DAD31C
SendMessageW.USER32 ref: 00DAD34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00DAD36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00DAD37B
GetCursorPos.USER32(?), ref: 00DAD39B
ScreenToClient.USER32(?,?), ref: 00DAD3A8
GetParent.USER32(?), ref: 00DAD3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00DAD431
SendMessageW.USER32 ref: 00DAD462
ClientToScreen.USER32(?,?), ref: 00DAD4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00DAD4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00DAD51A
SendMessageW.USER32 ref: 00DAD53D
ClientToScreen.USER32(?,?), ref: 00DAD58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00DAD5C3

Part of subcall function 00D225DB: GetWindowLongW.USER32(?,000000EB), ref: 00D225EC

GetWindowLongW.USER32(?,000000F0), ref: 00DAD65F

Strings

@GUI_DRAGID, xrefs: 00DAD1AA
F, xrefs: 00DAD543

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongWindow$State$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 302779176-4164748364
Opcode ID: d38a6c253566195b5971f2eb9f42d9f79582a33d9d2a4677ff05dc2ea8157146
Instruction ID: 4c7e8820cf365e4b3b515b63007e80df89d6cd42c1d162c8d0d0d300375be7c6
Opcode Fuzzy Hash: d38a6c253566195b5971f2eb9f42d9f79582a33d9d2a4677ff05dc2ea8157146
Instruction Fuzzy Hash: 0A429C30204341EFD725DF68C884BAABBE6FF4A364F180559F696876A0C771D950CBB2

Function 00DA804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00DA873F

Strings

%d/%02d/%02d, xrefs: 00DA8478

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 717708b19b82c08199b223924c1e78995460ceaa128f29907cc52de0f20d9bc1
Instruction ID: ad59ca1bafbd2e6fa4734e2941fc9c93669884a72555550bac7c5118d5dc704f
Opcode Fuzzy Hash: 717708b19b82c08199b223924c1e78995460ceaa128f29907cc52de0f20d9bc1
Instruction Fuzzy Hash: F212D071500348AFEB259F64CC49FAA7BB8EF4A710F284169F915EA2E1DF708941DB70

Function 00D3710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D375C2
_memset.LIBCMT ref: 00D376B1
_memmove.LIBCMT ref: 00D37C4B
_memmove.LIBCMT ref: 00D37E4F

Strings

\b(?<=\w), xrefs: 00D73C41
\b(?=\w), xrefs: 00D73C34
Q\E, xrefs: 00D381C1
[:>:]], xrefs: 00D3760A
[:<:]], xrefs: 00D375F1
DEFINE, xrefs: 00D725AF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 5670908fcff886881a9f5504346b77308e12e08b9662786a36655321a71c498c
Instruction ID: 5093d23a2560616adfcea8a706e3e3e06f942b6139a27276a165e977a62adf7f
Opcode Fuzzy Hash: 5670908fcff886881a9f5504346b77308e12e08b9662786a36655321a71c498c
Instruction Fuzzy Hash: A0939175A00215DFDB24CF58C881BADB7B1FF48710F29816AE959EB381E7709E81DB60

Function 00D24A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00D24A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D5DA8E
IsIconic.USER32(?), ref: 00D5DA97
ShowWindow.USER32(?,00000009), ref: 00D5DAA4
SetForegroundWindow.USER32(?), ref: 00D5DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D5DAC4
GetCurrentThreadId.KERNEL32 ref: 00D5DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D5DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00D5DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00D5DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00D5DAF8
SetForegroundWindow.USER32(?), ref: 00D5DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D5DB10
keybd_event.USER32(00000012,00000000), ref: 00D5DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D5DB25
keybd_event.USER32(00000012,00000000), ref: 00D5DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D5DB33
keybd_event.USER32(00000012,00000000), ref: 00D5DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D5DB42
keybd_event.USER32(00000012,00000000), ref: 00D5DB47
SetForegroundWindow.USER32(?), ref: 00D5DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00D5DB71

Strings

Shell_TrayWnd, xrefs: 00D5DA89

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 20500cf68c0946d891b66863cd557e02acb6aa645d6e23421d893762114b6105
Instruction ID: cbb2e86eeec73552ccb5575b90ce46ebefd83bf91357be4d48476e866765ecbb
Opcode Fuzzy Hash: 20500cf68c0946d891b66863cd557e02acb6aa645d6e23421d893762114b6105
Instruction Fuzzy Hash: 7F315071A80318BBEF316FA19C49F7F3E6DEB45B51F154065FE04EA2D0D6B05900AAB0

Function 00D78858 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00D78CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D78D0D
Part of subcall function 00D78CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D78D3A
Part of subcall function 00D78CC3: GetLastError.KERNEL32 ref: 00D78D47

_memset.LIBCMT ref: 00D7889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00D788ED
CloseHandle.KERNEL32(?), ref: 00D788FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00D78915
GetProcessWindowStation.USER32 ref: 00D7892E
SetProcessWindowStation.USER32(00000000), ref: 00D78938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00D78952

Part of subcall function 00D78713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D78851), ref: 00D78728
Part of subcall function 00D78713: CloseHandle.KERNEL32(?,?,00D78851), ref: 00D7873A

Strings

winsta0\default, xrefs: 00D789D3
winsta0, xrefs: 00D78910
default, xrefs: 00D7894D
, xrefs: 00D788AA

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0$winsta0\default
API String ID: 2063423040-1685893292
Opcode ID: 0f3fcb6b561566ce910e63cbeafd3ceaa8cc82f9d51a3de7ec683b46dfd56950
Instruction ID: 26a6862a54fb34fddf3cc9ad5f2abc1cb4d4c26268867106bcc533b0af3b8e2a
Opcode Fuzzy Hash: 0f3fcb6b561566ce910e63cbeafd3ceaa8cc82f9d51a3de7ec683b46dfd56950
Instruction Fuzzy Hash: EF814071940209BFDF11DFA4DC49AEE7B78EF05304F18816AF918A6261EB318E15EB70

Function 00D9425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00DAF910), ref: 00D94284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00D94292
GetClipboardData.USER32(0000000D), ref: 00D9429A
CloseClipboard.USER32 ref: 00D942A6
GlobalLock.KERNEL32(00000000), ref: 00D942C2
CloseClipboard.USER32 ref: 00D942CC
GlobalUnlock.KERNEL32(00000000), ref: 00D942E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00D942EE
GetClipboardData.USER32(00000001), ref: 00D942F6
GlobalLock.KERNEL32(00000000), ref: 00D94303
GlobalUnlock.KERNEL32(00000000), ref: 00D94337
CloseClipboard.USER32 ref: 00D94447

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 65c79e520dae9cc59c9faea245d509a02d88fb5696f47af4c7cf838fd3eeb7fc
Instruction ID: 0e2aceb16d154a6b9ecbbc1c3703ca3668f785c93c1edcc8f4a877752c8231c2
Opcode Fuzzy Hash: 65c79e520dae9cc59c9faea245d509a02d88fb5696f47af4c7cf838fd3eeb7fc
Instruction Fuzzy Hash: 4851A331204301AFDB10BFA0EC96F6E77A8EF95B00F144569F595D22A2DF70D9058B76

Function 00D8C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D8C9F8
FindClose.KERNEL32(00000000), ref: 00D8CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D8CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D8CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D8CAAF
__swprintf.LIBCMT ref: 00D8CAFB
__swprintf.LIBCMT ref: 00D8CB3E

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

__swprintf.LIBCMT ref: 00D8CB92

Part of subcall function 00D438D8: __woutput_l.LIBCMT ref: 00D43931

__swprintf.LIBCMT ref: 00D8CBE0

Part of subcall function 00D438D8: __flsbuf.LIBCMT ref: 00D43953
Part of subcall function 00D438D8: __flsbuf.LIBCMT ref: 00D4396B

__swprintf.LIBCMT ref: 00D8CC2F
__swprintf.LIBCMT ref: 00D8CC7E
__swprintf.LIBCMT ref: 00D8CCCD

Strings

%4d, xrefs: 00D8CB38
%02d, xrefs: 00D8CB86, 00D8CB90, 00D8CBDE, 00D8CC2D, 00D8CC7C, 00D8CCCB
%4d%02d%02d%02d%02d%02d, xrefs: 00D8CAF5

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 3dd62f6d7bee4d3a4af42da9587af13ae78daf65db6c293d16bc5c749d7ef7ca
Instruction ID: 8c69c4f8bdb3a6c293104c7f32bfa3a12b24ecd39935cc2c5aaffacbf9b1d2ad
Opcode Fuzzy Hash: 3dd62f6d7bee4d3a4af42da9587af13ae78daf65db6c293d16bc5c749d7ef7ca
Instruction Fuzzy Hash: B5A14EB2508314ABC710FBA4D996DAFB7ECEF94704F404919F586D6191EA34EA08CB72

Function 00D8F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00D8F221
_wcscmp.LIBCMT ref: 00D8F236
_wcscmp.LIBCMT ref: 00D8F24D
GetFileAttributesW.KERNEL32(?), ref: 00D8F25F
SetFileAttributesW.KERNEL32(?,?), ref: 00D8F279
FindNextFileW.KERNEL32(00000000,?), ref: 00D8F291
FindClose.KERNEL32(00000000), ref: 00D8F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00D8F2B8
_wcscmp.LIBCMT ref: 00D8F2DF
_wcscmp.LIBCMT ref: 00D8F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00D8F308
SetCurrentDirectoryW.KERNEL32(00DDA5A0), ref: 00D8F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D8F330
FindClose.KERNEL32(00000000), ref: 00D8F33D
FindClose.KERNEL32(00000000), ref: 00D8F34F

Strings

*.*, xrefs: 00D8F2B3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: f2e7aee218f7d939a643b36df08b841f5250414a7c25a620a61bf41848f791a6
Instruction ID: 267f35521ffe2e48b2c43dcaf9155dd05647d8b020791b8a428b0e382a224008
Opcode Fuzzy Hash: f2e7aee218f7d939a643b36df08b841f5250414a7c25a620a61bf41848f791a6
Instruction Fuzzy Hash: 8A31A0766002196FDB20EBB4EC49BDE77ACEF49361F1441B6E854D31A0EB30DA458B78

Function 00DA0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00DAF910,00000000,?,00000000,?,?), ref: 00DA0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00DA0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00DA0D1D
RegCloseKey.ADVAPI32(?), ref: 00DA103D
RegCloseKey.ADVAPI32(00000000), ref: 00DA104A

Strings

REG_MULTI_SZ, xrefs: 00DA0E05
REG_QWORD, xrefs: 00DA0F8B
REG_EXPAND_SZ, xrefs: 00DA0CBA
REG_DWORD, xrefs: 00DA0F0E
REG_SZ, xrefs: 00DA0D5B
REG_BINARY, xrefs: 00DA0FD8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: c8e18396ca7ad333048c197f6c58ec151bf42e6477bba9fdfd35ae0afc64c747
Instruction ID: ced53412d25be81f56673f7b36185dc65c19bb38c16f0435db0ab4f931013a68
Opcode Fuzzy Hash: c8e18396ca7ad333048c197f6c58ec151bf42e6477bba9fdfd35ae0afc64c747
Instruction Fuzzy Hash: C2028F756046119FDB14EF24D891E2ABBE5FF89724F04885DF8899B361CB31ED40CB61

Function 00DAC8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

DragQueryPoint.SHELL32(?,?), ref: 00DAC917

Part of subcall function 00DAADF1: ClientToScreen.USER32(?,?), ref: 00DAAE1A
Part of subcall function 00DAADF1: GetWindowRect.USER32(?,?), ref: 00DAAE90
Part of subcall function 00DAADF1: PtInRect.USER32(?,?,00DAC304), ref: 00DAAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00DAC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00DAC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00DAC9AE
_wcscat.LIBCMT ref: 00DAC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00DAC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00DACA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00DACA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00DACA47
DragFinish.SHELL32(?), ref: 00DACA4E
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 00DACB41

Strings

@GUI_DRAGID, xrefs: 00DACAB9
@GUI_DROPID, xrefs: 00DACA6E
@GUI_DRAGFILE, xrefs: 00DACAF0

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2166380349-3440237614
Opcode ID: 86ef4d0eb65330dc69dbf9869a14f5f1a2ce3c47bde64a5f3d98943fba4c37d4
Instruction ID: 52cd5a269baff401d6709058ecf86d14cb57fd7601779e53ea23fe315294d723
Opcode Fuzzy Hash: 86ef4d0eb65330dc69dbf9869a14f5f1a2ce3c47bde64a5f3d98943fba4c37d4
Instruction Fuzzy Hash: 4D617B71108310AFC711EF64DC85D9FBBE8EF99714F040A2EF591962A1DB709A09CBB2

Function 00D8F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00D8F37E
_wcscmp.LIBCMT ref: 00D8F393
_wcscmp.LIBCMT ref: 00D8F3AA

Part of subcall function 00D845C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00D845DC

FindNextFileW.KERNEL32(00000000,?), ref: 00D8F3D9
FindClose.KERNEL32(00000000), ref: 00D8F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00D8F400
_wcscmp.LIBCMT ref: 00D8F427
_wcscmp.LIBCMT ref: 00D8F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00D8F450
SetCurrentDirectoryW.KERNEL32(00DDA5A0), ref: 00D8F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D8F478
FindClose.KERNEL32(00000000), ref: 00D8F485
FindClose.KERNEL32(00000000), ref: 00D8F497

Strings

*.*, xrefs: 00D8F3FB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 42f494eecd4f31e2e9b3bf70f6068d3c9a183ef44113775532145095d75453e0
Instruction ID: aadd6c2cad6fe252e9ed8a37c879cd142dfd0c8cc3e953cd796c9f9147c11db1
Opcode Fuzzy Hash: 42f494eecd4f31e2e9b3bf70f6068d3c9a183ef44113775532145095d75453e0
Instruction Fuzzy Hash: 4C3195715012196FCF10BBA8EC88ADE77AC9F49365F1442B6E890E31A1D771DE48CB74

Function 00DAC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00DAC4EC
GetFocus.USER32 ref: 00DAC4FC
GetDlgCtrlID.USER32(00000000), ref: 00DAC507
_memset.LIBCMT ref: 00DAC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00DAC65D
GetMenuItemCount.USER32(?), ref: 00DAC67D
GetMenuItemID.USER32(?,00000000), ref: 00DAC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00DAC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00DAC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00DAC744
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 00DAC779

Strings

0, xrefs: 00DAC62A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: 99c7f0fa2d192c49e3b581df4cf65e674f7e850804ab7e712d568afd395a942d
Instruction ID: ccb4871dedb9dd75d999b5155e20d1947a1054baa20e7134b6265afa5db6cfee
Opcode Fuzzy Hash: 99c7f0fa2d192c49e3b581df4cf65e674f7e850804ab7e712d568afd395a942d
Instruction Fuzzy Hash: 9081AD70618301AFD720DF24C884A6BBBE8FB8A364F08192DF99597291D770D905CFB2

Function 00D781F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00D78766
Part of subcall function 00D7874A: GetLastError.KERNEL32(?,00D7822A,?,?,?), ref: 00D78770
Part of subcall function 00D7874A: GetProcessHeap.KERNEL32(00000008,?,?,00D7822A,?,?,?), ref: 00D7877F
Part of subcall function 00D7874A: RtlAllocateHeap.NTDLL(00000000,?,00D7822A), ref: 00D78786
Part of subcall function 00D7874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00D7879D

Part of subcall function 00D787E7: GetProcessHeap.KERNEL32(00000008,00D78240,00000000,00000000,?,00D78240,?), ref: 00D787F3
Part of subcall function 00D787E7: RtlAllocateHeap.NTDLL(00000000,?,00D78240), ref: 00D787FA
Part of subcall function 00D787E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00D78240,?), ref: 00D7880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D7825B
_memset.LIBCMT ref: 00D78270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00D7828F
GetLengthSid.ADVAPI32(?), ref: 00D782A0
GetAce.ADVAPI32(?,00000000,?), ref: 00D782DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00D782F9
GetLengthSid.ADVAPI32(?), ref: 00D78316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00D78325
RtlAllocateHeap.NTDLL(00000000), ref: 00D7832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00D7834D
CopySid.ADVAPI32(00000000), ref: 00D78354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00D78385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00D783AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00D783BF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: f13ba6aa4a0646d4c3d4e3631903edee2ac8762288c183b26dbcf0deffd4ec16
Instruction ID: fe62cbe7861f475238f9b55ed8ebcc83e4ab43d4aaf7ec20714c2992913aeea5
Opcode Fuzzy Hash: f13ba6aa4a0646d4c3d4e3631903edee2ac8762288c183b26dbcf0deffd4ec16
Instruction Fuzzy Hash: 3B613C71940209ABDF109F94DC49AAEBBB9FF05700F14816AE819E7291EB359A05DB70

Function 00D36843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

NO_START_OPT), xrefs: 00D71588
LIMIT_MATCH=, xrefs: 00D715A9
UTF), xrefs: 00D71533
UTF16), xrefs: 00D71508
BSR_ANYCRLF), xrefs: 00D71757
BSR_UNICODE), xrefs: 00D71771
LIMIT_RECURSION=, xrefs: 00D71635
ANYCRLF), xrefs: 00D71734
CR), xrefs: 00D716C0
ANY), xrefs: 00D71717
NO_AUTO_POSSESS), xrefs: 00D71567
LF), xrefs: 00D716DD
CRLF), xrefs: 00D716FA
UCP), xrefs: 00D71546

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 39a13e77a1c0cc4fe9a182298713e1abdf8cbb85cbaa2474783f55dc0c634af1
Instruction ID: 53062e43eea58f3003f1f69c14d11cf186b98e9a5e3805ade4d2c7fcfc684281
Opcode Fuzzy Hash: 39a13e77a1c0cc4fe9a182298713e1abdf8cbb85cbaa2474783f55dc0c634af1
Instruction Fuzzy Hash: F1724F75E00219DBDB24CF59D8907AEB7B5EF48710F18816AE949EB290E770D981CBB0

Function 00DA0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA0038,?,?), ref: 00DA10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA0737

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00DA07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00DA086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00DA0AAD
RegCloseKey.ADVAPI32(00000000), ref: 00DA0ABA

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: d5457ac86ffb7bf01858b35ed07314dd78a9b579e2d15f33f86d5c1ad86ac714
Instruction ID: 5609f34e3a4dd58e2317510a57a357158e3068133a4ab05fe5776ea94ef1b7ac
Opcode Fuzzy Hash: d5457ac86ffb7bf01858b35ed07314dd78a9b579e2d15f33f86d5c1ad86ac714
Instruction Fuzzy Hash: 38E13E71604310AFCB14DF24C895E6ABBE4EF89714F08896DF48ADB2A1DB31ED45CB61

Function 00D80219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00D80241
GetAsyncKeyState.USER32(000000A0), ref: 00D802C2
GetKeyState.USER32(000000A0), ref: 00D802DD
GetAsyncKeyState.USER32(000000A1), ref: 00D802F7
GetKeyState.USER32(000000A1), ref: 00D8030C
GetAsyncKeyState.USER32(00000011), ref: 00D80324
GetKeyState.USER32(00000011), ref: 00D80336
GetAsyncKeyState.USER32(00000012), ref: 00D8034E
GetKeyState.USER32(00000012), ref: 00D80360
GetAsyncKeyState.USER32(0000005B), ref: 00D80378
GetKeyState.USER32(0000005B), ref: 00D8038A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 51522491420ed2b0867bb1c85b6697a7ac84c12cf62a6f5cd1e859c4e635ec95
Instruction ID: c8a793292691fe3975851fc986d411724a0bc3fbdb5e2ba9152b02b10b88e14e
Opcode Fuzzy Hash: 51522491420ed2b0867bb1c85b6697a7ac84c12cf62a6f5cd1e859c4e635ec95
Instruction Fuzzy Hash: D0417524904BC96EFFB1BBA488087B5BEA06B16344F0C409DD5C6566C2EBD49DCC87B6

Function 00D986D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

CoInitialize.OLE32 ref: 00D98718
CoUninitialize.COMBASE ref: 00D98723
CoCreateInstance.COMBASE(?,00000000,00000017,00DB2BEC,?), ref: 00D98783
IIDFromString.COMBASE(?,?), ref: 00D987F6
VariantInit.OLEAUT32(?), ref: 00D98890
VariantClear.OLEAUT32(?), ref: 00D988F1

Strings

NULL Pointer assignment, xrefs: 00D987C8
Failed to create object, xrefs: 00D9878E, 00D98844
Invalid parameter, xrefs: 00D9880F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 8d68f36870544e5fdf11c8464728f2169f9a9773607d092787cc03fdd7b8b588
Instruction ID: 5820c5379b853d2034b5701ad847e51f8717ca5703479d2896b8c8b214076955
Opcode Fuzzy Hash: 8d68f36870544e5fdf11c8464728f2169f9a9773607d092787cc03fdd7b8b588
Instruction Fuzzy Hash: 2661E0706083119FDB10DF64D848B6ABBE8EF4AB14F14495DF8859B291CB70ED48DBB2

Function 00D94458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00D9447F
EmptyClipboard.USER32 ref: 00D94485
GlobalAlloc.KERNEL32(00000002,?), ref: 00D9449A
CloseClipboard.USER32 ref: 00D94539

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 7329561377c95823f7770493949e0540e8773115813c7506321d78617f1ef924
Instruction ID: ddf9cde8c2908754227370fa6f2896e8309e32ac0a3c26ffc1d17169d8a9cab3
Opcode Fuzzy Hash: 7329561377c95823f7770493949e0540e8773115813c7506321d78617f1ef924
Instruction Fuzzy Hash: 27217E356007209FDB10AFA0EC59F697BA8EF15715F148056F946DB362DB70E801CB74

Function 00D83A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D248A1,?,?,00D237C0,?), ref: 00D248CE

Part of subcall function 00D84CD3: GetFileAttributesW.KERNEL32(?,00D83947), ref: 00D84CD4

FindFirstFileW.KERNEL32(?,?), ref: 00D83ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00D83B87
MoveFileW.KERNEL32(?,?), ref: 00D83B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00D83BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D83BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00D83BF5

Strings

\*.*, xrefs: 00D83A8A, 00D83A93, 00D83AA8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 0689a0bd836ff352e623a0e4cedbe6b73461e09867633047728d9682ca27b8a6
Instruction ID: 322a878a61d88f17e6b95a2e629eba191f2f84892c072119143fd5a717ff14f9
Opcode Fuzzy Hash: 0689a0bd836ff352e623a0e4cedbe6b73461e09867633047728d9682ca27b8a6
Instruction Fuzzy Hash: F8516D31805259AACF15FBA0ED929EDB778EF24304F6441A9E446B7191EF306F09CBB0

Function 00D8F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00D8F6AB
Sleep.KERNEL32(0000000A), ref: 00D8F6DB
_wcscmp.LIBCMT ref: 00D8F6EF
_wcscmp.LIBCMT ref: 00D8F70A
FindNextFileW.KERNEL32(?,?), ref: 00D8F7A8
FindClose.KERNEL32(00000000), ref: 00D8F7BE

Strings

*.*, xrefs: 00D8F690

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 8b455d1f8d4a3edaa683fafbe6f0645179e28d5b226c8f9108c4dfd1a00e4424
Instruction ID: 655a72bf92d443b753cca06de56b628967a3111f8ba030941a06d81cb24dee7a
Opcode Fuzzy Hash: 8b455d1f8d4a3edaa683fafbe6f0645179e28d5b226c8f9108c4dfd1a00e4424
Instruction Fuzzy Hash: 3741727190021A9FDF15EFA4DC45AEEBBB4FF15310F144566E855A3290EB309E54CBB0

Function 00DAD74C Relevance: 12.3, APIs: 8, Instructions: 257windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

GetSystemMetrics.USER32(0000000F), ref: 00DAD78A
GetSystemMetrics.USER32(0000000F), ref: 00DAD7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00DAD9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00DADA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00DADA24
ShowWindow.USER32(00000003,00000000), ref: 00DADA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00DADA68
NtdllDialogWndProc_W.NTDLL(?,00000005,?,?), ref: 00DADA8B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$DialogInvalidateLongMoveNtdllProc_RectShow
String ID:
API String ID: 830902736-0
Opcode ID: 3a2e3c22df3209aa668e1c8e852cf9a814d473d177be1324eed3e8380cef8949
Instruction ID: 67c5876525694f14df09e18f5b963b57152cb3c5b74656a500f70df0ea8b3aa5
Opcode Fuzzy Hash: 3a2e3c22df3209aa668e1c8e852cf9a814d473d177be1324eed3e8380cef8949
Instruction Fuzzy Hash: 8BB17A71600215EFDF18CF68C9C57BE7BB2FF46701F088169EC8A9A695D734A950CBA0

Function 00D34140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00D344ED
VUUU, xrefs: 00D67B0C
ERCP, xrefs: 00D3421F
VUUU, xrefs: 00D344DB
VUUU, xrefs: 00D34520

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: efcfc483b9572ead1d6a9e21120b1b957e8dbed2ad8f9d2394bcdc7e1e3de204
Instruction ID: 48b98a47701e48a0506fb64ca4f04c424c9c2db39388a5c594e76418159ce12e
Opcode Fuzzy Hash: efcfc483b9572ead1d6a9e21120b1b957e8dbed2ad8f9d2394bcdc7e1e3de204
Instruction Fuzzy Hash: 40A2B170E0421ACBDF24CF58C9407ADB7B1FF55314F1885AAD856A7280E778AE85DFA0

Function 00D7EB07 Relevance: 11.1, APIs: 1, Strings: 6, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00D7EB19

Strings

|, xrefs: 00D7EB49
(, xrefs: 00D7EB5F
QueryInterface, xrefs: 00D7ED62
AddRef, xrefs: 00D7EDEF
Release, xrefs: 00D7EE37
InterfaceDispatch, xrefs: 00D7ECCF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: lstrlen
String ID: ($AddRef$InterfaceDispatch$QueryInterface$Release$|
API String ID: 1659193697-2318614619
Opcode ID: db819e157bee6df91231d62c76014a812cbc1a0a3c20353b87d64e77e4a764fb
Instruction ID: 6d3d8e6d6c60e3d50d6cee0a6e2e4f8bc34c753a769a3aa8d7e4a06b21669a73
Opcode Fuzzy Hash: db819e157bee6df91231d62c76014a812cbc1a0a3c20353b87d64e77e4a764fb
Instruction Fuzzy Hash: 12322575A006059FD728CF29C481A6AF7F1FF48320B15C5AEE89ADB7A1E770E941CB50

Function 00D358C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D35A05
_memmove.LIBCMT ref: 00D35A55
_memmove.LIBCMT ref: 00D35ABB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: dee2db05ef050dba81937b1ddc15b62c50e7655bdb21a675dd7883bffb60deb3
Instruction ID: 47dc313359445b782df54190cd797116f166c82195e1b42232b5352a95402af2
Opcode Fuzzy Hash: dee2db05ef050dba81937b1ddc15b62c50e7655bdb21a675dd7883bffb60deb3
Instruction Fuzzy Hash: 30128970A00609DBDF14DFA4E981AAEB7F5FF48300F148569E446E7295EB35AA11CB70

Function 00DAC27C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

Part of subcall function 00D22344: GetCursorPos.USER32(?), ref: 00D22357
Part of subcall function 00D22344: ScreenToClient.USER32(00DE67B0,?), ref: 00D22374
Part of subcall function 00D22344: GetAsyncKeyState.USER32(00000001), ref: 00D22399
Part of subcall function 00D22344: GetAsyncKeyState.USER32(00000002), ref: 00D223A7

ReleaseCapture.USER32 ref: 00DAC2F0
SetWindowTextW.USER32(?,00000000), ref: 00DAC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00DAC3AD
NtdllDialogWndProc_W.NTDLL(?,00000202,?,?,00000000,00000001,?,?), ref: 00DAC48F

Strings

@GUI_DROPID, xrefs: 00DAC3E1
@GUI_DRAGFILE, xrefs: 00DAC424

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AsyncStateWindow$CaptureClientCursorDialogLongMessageNtdllProc_ReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 973565025-2107944366
Opcode ID: 5a437ca7f0316cb35bc5ef1903e6cf58afaeefdbce3f1292fe1641f9a9ceedc1
Instruction ID: bfdae7814b7d50439553cb8c8f7ffba9a161c2d14c5f48aef8e8f60b9eb8f0ad
Opcode Fuzzy Hash: 5a437ca7f0316cb35bc5ef1903e6cf58afaeefdbce3f1292fe1641f9a9ceedc1
Instruction Fuzzy Hash: BF51AB71204304AFDB10EF24D896F6A7BE5EB99314F04492DF9918B2E1DB70E948DB72

Function 00D8545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00D78CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D78D0D
Part of subcall function 00D78CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D78D3A
Part of subcall function 00D78CC3: GetLastError.KERNEL32 ref: 00D78D47

ExitWindowsEx.USER32(?,00000000), ref: 00D8549B

Strings

@, xrefs: 00D8548E
, xrefs: 00D85489
SeShutdownPrivilege, xrefs: 00D8546B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: d5285c1ef765a9f7a034f576c333fde6bae6ad54705920e36d2e5afa5a47620e
Instruction ID: 905355c06ee96007c7a97f0881b2260631056e0c4bc3b61f4532917bc189ad49
Opcode Fuzzy Hash: d5285c1ef765a9f7a034f576c333fde6bae6ad54705920e36d2e5afa5a47620e
Instruction Fuzzy Hash: 39014731694B016AE72873BCFC4ABBA7258EB01743F280021FC4BD21C6DA608C8083B0

Function 00D96596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00D965EF
WSAGetLastError.WS2_32(00000000), ref: 00D965FE
bind.WS2_32(00000000,?,00000010), ref: 00D9661A
listen.WS2_32(00000000,00000005), ref: 00D96629
WSAGetLastError.WS2_32(00000000), ref: 00D96643
closesocket.WS2_32(00000000), ref: 00D96657

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 6ebf82baac39004f699f43f9091f0b83e8c98cfd1e6411bf9ad200667a7f74c2
Instruction ID: bfc9efba99fc639ad8ced96d7cdea418ed0123f34872d86a589f2135bf1eed09
Opcode Fuzzy Hash: 6ebf82baac39004f699f43f9091f0b83e8c98cfd1e6411bf9ad200667a7f74c2
Instruction Fuzzy Hash: 41218B30600210AFDB10AF64D889B6EB7A9EF49724F1481A9E95AE7391DB70ED01CB71

Function 00D35680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00D40FF6: std::exception::exception.LIBCMT ref: 00D4102C
Part of subcall function 00D40FF6: __CxxThrowException@8.LIBCMT ref: 00D41041

_memmove.LIBCMT ref: 00D7062F
_memmove.LIBCMT ref: 00D70744
_memmove.LIBCMT ref: 00D707EB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 44d2e75c0f17a7b763b400b51907865e676c3ebda6c10fdb4c46f918d328bec6
Instruction ID: 52062b1f84556354f14b9c83c5841d5ade0e4cadd46424372e1515a02140e65a
Opcode Fuzzy Hash: 44d2e75c0f17a7b763b400b51907865e676c3ebda6c10fdb4c46f918d328bec6
Instruction Fuzzy Hash: 2B0280B0A00205DBDF14DF64E981AAEBBB5FF44304F148069E84ADB395EB31DA55CBB1

Function 00D21287 Relevance: 7.9, APIs: 5, Instructions: 379nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 00D219FA
GetSysColor.USER32(0000000F), ref: 00D21A4E
SetBkColor.GDI32(?,00000000), ref: 00D21A61

Part of subcall function 00D21290: NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 00D212D8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ColorDialogNtdllProc_$LongWindow
String ID:
API String ID: 591255283-0
Opcode ID: ba3d7158312a3155a0fcf4e745463104a25e04d19cee426078d13ce7a93ce0cf
Instruction ID: 8dcb7b6950ae3fbf0ca230652b812e111d3175902bfedf14f1c5a635c82fb587
Opcode Fuzzy Hash: ba3d7158312a3155a0fcf4e745463104a25e04d19cee426078d13ce7a93ce0cf
Instruction Fuzzy Hash: 27A18C781015A5BEDB38AB387C85E7F355DDB723AEB18810AFC42D6191CA22CD0292B5

Function 00D96A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D980A0: inet_addr.WS2_32(00000000), ref: 00D980CB

socket.WS2_32(00000002,00000002,00000011), ref: 00D96AB1
WSAGetLastError.WS2_32(00000000), ref: 00D96ADA
bind.WS2_32(00000000,?,00000010), ref: 00D96B13
WSAGetLastError.WS2_32(00000000), ref: 00D96B20
closesocket.WS2_32(00000000), ref: 00D96B34

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 3d5f944650c435ef944b3da83b9d359aeb6127154152b421103253605c6d508a
Instruction ID: 77c8fe45cfa7da7d90dcaf00cca575453cc50f7f8e334dcdbf77e0dda279de9b
Opcode Fuzzy Hash: 3d5f944650c435ef944b3da83b9d359aeb6127154152b421103253605c6d508a
Instruction Fuzzy Hash: F941C875B00320AFEB10AF64EC96F6EB7A5DF19714F048058F95AAB3C2DA709D0087B1

Function 00DA55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00DA564C
IsWindowEnabled.USER32 ref: 00DA565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00DA5667
IsIconic.USER32 ref: 00DA5675
IsZoomed.USER32 ref: 00DA5683

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: ce31d77673e7166ef7baebda97a99dada17b19a2343c08d4263c426ba649f7fa
Instruction ID: b63c28380ff94be163c54b044a3da0de7cca890336f40b30cbea9db65de159a6
Opcode Fuzzy Hash: ce31d77673e7166ef7baebda97a99dada17b19a2343c08d4263c426ba649f7fa
Instruction Fuzzy Hash: 8711C132B00A216FE7215F66EC44B6FBB99EF56721B8C4029F846D7241CB70D9018AB5

Function 00D33190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 74f146e93657e3602e60ff249a49ed5f2d78cf82fb6c04be50ad30dc5a096fea
Instruction ID: 394dcbcde7f58bd4ef3185140537ae8ce2ea2b9dc24d5d664aaee04227c10a84
Opcode Fuzzy Hash: 74f146e93657e3602e60ff249a49ed5f2d78cf82fb6c04be50ad30dc5a096fea
Instruction Fuzzy Hash: 4C228A716083119FC724DF24C991B6BB7E4EF98718F14491DF89A97291EB30EA44CBB2

Function 00D9F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00D9F151
Process32FirstW.KERNEL32(00000000,?), ref: 00D9F15F

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Process32NextW.KERNEL32(00000000,?), ref: 00D9F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00D9F22E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 091119775f19e34fcd6522030b98eb6ea3ce42736f8b8877b82659aa1a874625
Instruction ID: b0f2f91797aac9acb493c155c058295635c983b3e8d2039995dc4b8f6d9b86f5
Opcode Fuzzy Hash: 091119775f19e34fcd6522030b98eb6ea3ce42736f8b8877b82659aa1a874625
Instruction Fuzzy Hash: A2514A71508311ABD720EF24EC86A6BB7E8EF98714F14482DF595D7291EB70A904CBB2

Function 00DAC788 Relevance: 6.1, APIs: 4, Instructions: 83nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

GetCursorPos.USER32(?), ref: 00DAC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00D5BBFB,?,?,?,?,?), ref: 00DAC7D7
GetCursorPos.USER32(?), ref: 00DAC824
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,00D5BBFB,?,?,?), ref: 00DAC85E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: 2ea74e5f07d93f233494e5989399166947b6e66ce054fdd404d8e7056b1bdeb1
Instruction ID: af28c25ffa8a7a5778a3d61b5a7aa4bd8cac3e451dd5676b70f33383aba3d40e
Opcode Fuzzy Hash: 2ea74e5f07d93f233494e5989399166947b6e66ce054fdd404d8e7056b1bdeb1
Instruction Fuzzy Hash: 70319439600158EFCB15DFA8C898EEA7BB6FB4A720F0440A9F9458B261D7359D50DFB0

Function 00D840B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00D840D1
_memset.LIBCMT ref: 00D840F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00D84144
CloseHandle.KERNEL32(00000000), ref: 00D8414D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 5dd7b1c8d5ea812f0be3a93ea7f0fee565ee01d993b1dabbdadf2db88a62579f
Instruction ID: 0973faa838961ab993de04b532778fd813cace091c441d772f8673ad89f7644d
Opcode Fuzzy Hash: 5dd7b1c8d5ea812f0be3a93ea7f0fee565ee01d993b1dabbdadf2db88a62579f
Instruction Fuzzy Hash: EF11A7759013287AD7309BA5AC4DFABBB7CEF45760F1042EAF908D7280D6744E808BB4

Function 00D21290 Relevance: 6.1, APIs: 4, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 00D212D8
GetClientRect.USER32(?,?), ref: 00D5B84B
GetCursorPos.USER32(?), ref: 00D5B855
ScreenToClient.USER32(?,?), ref: 00D5B860

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Client$CursorDialogLongNtdllProc_RectScreenWindow
String ID:
API String ID: 1010295502-0
Opcode ID: d0812a03c64cf065bb1866f2754dcc9cf507c3ec3d30e8c72c42f59b5263f892
Instruction ID: 1a800e8e8853c9c1ffdd275079ceb8dfa5dffacc5ed24c7aae3c1caf3e60726d
Opcode Fuzzy Hash: d0812a03c64cf065bb1866f2754dcc9cf507c3ec3d30e8c72c42f59b5263f892
Instruction Fuzzy Hash: CD112B39900129EFCB10EF94E8869AE77B8FF26305F104495F951E7251C730BA518BB9

Function 00D925E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00D91AFE,00000000), ref: 00D926D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00D9270C

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: a0ab6db153901d26737f3f09c737ae904328c9b3cf5550b6999037ed73f489b3
Instruction ID: 1dd000d5e3dbb9343712ae1c3dd2a293cd90c312c5e95117b6d2f7e75d6ddebb
Opcode Fuzzy Hash: a0ab6db153901d26737f3f09c737ae904328c9b3cf5550b6999037ed73f489b3
Instruction Fuzzy Hash: E241E375A00309BFEF20DF94DC85EBBB7BCEB40724F14406AF645A6640EAB1EE419670

Function 00D8B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D8B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00D8B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00D8B655

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 4437677c1aa741797e77d0fceb9d8ba08c780c794ec11d22cb86462a2a180dbc
Instruction ID: 6afcfaaf6a01dbf1d84fbc42719bb33bcad051edfd66d2047514beee205991fb
Opcode Fuzzy Hash: 4437677c1aa741797e77d0fceb9d8ba08c780c794ec11d22cb86462a2a180dbc
Instruction Fuzzy Hash: AF216235A00618EFCB00EFA5D885EADFBB8FF49314F1480AAE845EB351DB319955CB61

Function 00D78CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00D40FF6: std::exception::exception.LIBCMT ref: 00D4102C
Part of subcall function 00D40FF6: __CxxThrowException@8.LIBCMT ref: 00D41041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D78D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D78D3A
GetLastError.KERNEL32 ref: 00D78D47

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 5fff03f5b5dfeabcb68712b86c5c5a4bd0e99ba65d4daeef3bc19bcbbfcfa6c0
Instruction ID: 2150d2c27540a31edd1d43366aa5c5119d03722b28b395de2d51537cea0a02d6
Opcode Fuzzy Hash: 5fff03f5b5dfeabcb68712b86c5c5a4bd0e99ba65d4daeef3bc19bcbbfcfa6c0
Instruction Fuzzy Hash: 7A118FB1414309AFD7289F64DC89D6BBBBCEB48711B24856EF45A93241EB30AC408A70

Function 00D84C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D84C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00D84C43
FreeSid.ADVAPI32(?), ref: 00D84C53

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 0324bc6885327f2646a40ed36a5ed572529afa987c0023e4eb287caf2b9874eb
Instruction ID: bcb7ddc20fe9876a360ceeee020e3e08ce35fdbc2f93a52021a5ef5aa1bac574
Opcode Fuzzy Hash: 0324bc6885327f2646a40ed36a5ed572529afa987c0023e4eb287caf2b9874eb
Instruction Fuzzy Hash: 3FF04975A1130DBFDF04DFF0DC89AAEBBBCEF08201F0044A9A901E2281E6706A048B64

Function 00D2E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70793663d0820a6b6aa07baf54fc0f2341bf8f5d504525afb75e80dbfc8a2486
Instruction ID: af6c476c43812a79f8f0dabfcec677a0740af7b82f84d8b789e9233fbbf10ec4
Opcode Fuzzy Hash: 70793663d0820a6b6aa07baf54fc0f2341bf8f5d504525afb75e80dbfc8a2486
Instruction Fuzzy Hash: 7822B174A04225DFDB24DF58D481AAEB7F0FF28304F188569E8969B341E734E985CBB1

Function 00D216DE Relevance: 3.1, APIs: 2, Instructions: 83nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

Part of subcall function 00D225DB: GetWindowLongW.USER32(?,000000EB), ref: 00D225EC

GetParent.USER32(?), ref: 00D5BA0A
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,00D219B3,?,?,?,00000006,?), ref: 00D5BA84

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: eea6536c5acae36c2373f66acefb01d9ea287c318825bb00e67f7a1509f447d5
Instruction ID: c4dd295f451c94c14138a760d9fafa72ae576371d0c1e91a284acf8bbbd0a094
Opcode Fuzzy Hash: eea6536c5acae36c2373f66acefb01d9ea287c318825bb00e67f7a1509f447d5
Instruction Fuzzy Hash: C521A238200164EFCB209F28D884DA93B96EB6A378F688251F9155B3E1C7719D11DB70

Function 00D8C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D8C966
FindClose.KERNEL32(00000000), ref: 00D8C996

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3e72cae43db34703d15b42942b8a8012945037f1417754e3564c7be17a697348
Instruction ID: 707f4f67b2398120a5a83f10cddec6cd29bb4028936562b50807e8fef1d19dfa
Opcode Fuzzy Hash: 3e72cae43db34703d15b42942b8a8012945037f1417754e3564c7be17a697348
Instruction Fuzzy Hash: F4118E326106109FDB10EF29D845A2AF7E9EF95324F00895EF8A9D7291DB30AC00CBA1

Function 00DAC86D Relevance: 3.0, APIs: 2, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,00D5BB8A,?,?,?), ref: 00DAC8E1

Part of subcall function 00D225DB: GetWindowLongW.USER32(?,000000EB), ref: 00D225EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00DAC8C7

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID:
API String ID: 1273190321-0
Opcode ID: e2ebc343a82f31418576a4e20fe96a8e91c0c10ae83a359420dadab9c056d375
Instruction ID: 78434201d0261749571be2d5e08e940ff614c6f48e7176bd7bc1fe2a40b39cf7
Opcode Fuzzy Hash: e2ebc343a82f31418576a4e20fe96a8e91c0c10ae83a359420dadab9c056d375
Instruction Fuzzy Hash: ED01D831200214EBCB216F24DC84E663BA6FF96374F184564F9514B3E0C776D801EBB1

Function 00DACC2E Relevance: 3.0, APIs: 2, Instructions: 33nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00DACC51
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,00D5BC66,?,?,?,?,?), ref: 00DACC7A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: e02a25986e4c579cb3fd617ff73418b60d8cebbd0d14b0a7735221af2839ceb7
Instruction ID: af25d4f94cd4c584c29a46dfadd1624ee4613ca3367d2ae08edbc696c0b11e16
Opcode Fuzzy Hash: e02a25986e4c579cb3fd617ff73418b60d8cebbd0d14b0a7735221af2839ceb7
Instruction Fuzzy Hash: ADF0307241021CFFDF049F85DC499AE7FB9FB49321F04415AF90592261D3716A50EBB4

Function 00D8A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00D9977D,?,00DAFB84,?), ref: 00D8A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00D9977D,?,00DAFB84,?), ref: 00D8A314

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5558fc956f1e285b688894ff56a32bb219d68c9acb23f8c317f7ebdeb306d908
Instruction ID: a840fd9f91baf27f36207521555ffcfba7472394436dfc784c27f02cac75d11a
Opcode Fuzzy Hash: 5558fc956f1e285b688894ff56a32bb219d68c9acb23f8c317f7ebdeb306d908
Instruction Fuzzy Hash: 36F05E3554422DABEB20AFA4CC48FEA776DEF09762F0041A6B908D6281D6309944CBB1

Function 00DACD6C Relevance: 3.0, APIs: 2, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00DACD74
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,00D5BBE5,?,?,?,?), ref: 00DACDA2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: f5e9de3ba3e2e25c260dbb6a1c22a736730ba44b61e739b834ee652405862f6d
Instruction ID: b0349c0a8f257530316c34ff03a5f1c52806bdd78e24622fd0b00d3e4e96a763
Opcode Fuzzy Hash: f5e9de3ba3e2e25c260dbb6a1c22a736730ba44b61e739b834ee652405862f6d
Instruction Fuzzy Hash: B5E08670100254BFEF245F29DC09FBA3B54EB06760F408625F996DA1E1C770D850D770

Function 00D78713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D78851), ref: 00D78728
CloseHandle.KERNEL32(?,?,00D78851), ref: 00D7873A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 5dbccebc7992691e0495bb4b858b6afae43603797aec2bde3833a61dc9a8098b
Instruction ID: aeb366d79e1b1af646572124b4c9b230d0e00dc6cec3deec892d8a3f893bb749
Opcode Fuzzy Hash: 5dbccebc7992691e0495bb4b858b6afae43603797aec2bde3833a61dc9a8098b
Instruction Fuzzy Hash: 5DE0B676010650EFEB252B60EC09E777BA9EB05350B288969F496C0470DB62ACD0DB30

Function 00D4A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00DB4178,00D48F97,t of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.,?,?,00000001), ref: 00D4A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00D4A3A3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cceeda5d9d73261a47ae10cbaab7e9e40afbcabbaf74a4e3358a9718ab2b6488
Instruction ID: fbbe53277cf45ee606142f7d0c13da0c5eb0f7c7f7aaf1741eaa81c748ab4ec7
Opcode Fuzzy Hash: cceeda5d9d73261a47ae10cbaab7e9e40afbcabbaf74a4e3358a9718ab2b6488
Instruction Fuzzy Hash: 41B09231054308ABCF002BD1EC59B883F68EB46AA2F4040A0F60DC4260CBA294508AA1

Function 00D4F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbd266ea5eb2e998eebbf272262ee96ff05029ef2770e27eadc0a22982b21a9
Instruction ID: 8dddc57558da8ae45a436f10e4421effc64e78bd9139a5662be5b6f4c3ed91f5
Opcode Fuzzy Hash: ccbd266ea5eb2e998eebbf272262ee96ff05029ef2770e27eadc0a22982b21a9
Instruction Fuzzy Hash: 68320622D69F418EDB239634D872335A289AFB73C4F15D737F819B5AB6EB28C4834110

Function 00D5267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5dba7a5a2444cbf09854956f55e4ed39908a79be1904e68c0366f71574294b2
Instruction ID: 13c66e6608eddfe2bcbdbec6b58141f03c19c20dc0e4bc68f7473575a3c64c4f
Opcode Fuzzy Hash: a5dba7a5a2444cbf09854956f55e4ed39908a79be1904e68c0366f71574294b2
Instruction Fuzzy Hash: 85B10320D2AF418DD72396398831336BB8CAFBB2D5F51D71BFC1AB4E22EB2185834141

Function 00D88B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00D88B25

Part of subcall function 00D4543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00D891F8,00000000,?,?,?,?,00D893A9,00000000,?), ref: 00D45443
Part of subcall function 00D4543A: __aulldiv.LIBCMT ref: 00D45463

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 3e8084385c03a58ba62a3bc8395cd9619f902c97a0515ebf0a73ebc7183b4332
Instruction ID: 6f8ad3f0d385edc46e181874c774dc75af681bcb5622b1fc211a02b1718f4e24
Opcode Fuzzy Hash: 3e8084385c03a58ba62a3bc8395cd9619f902c97a0515ebf0a73ebc7183b4332
Instruction Fuzzy Hash: 9321E4726356108BC729DF25D441A52B3E1EFA4311B688E6CE0E9CF2D0CA34BD05DBA4

Function 00DADA9A Relevance: 1.6, APIs: 1, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

NtdllDialogWndProc_W.NTDLL(?,00000112,?,00000000), ref: 00DADB46

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 1cc14681150337db77007b0426b8559568f90e20ebc30afef5991ea0f605290b
Instruction ID: 2457566b447a3256c1d365e08c25afb1f55ccea79db5426739efda2b4595871a
Opcode Fuzzy Hash: 1cc14681150337db77007b0426b8559568f90e20ebc30afef5991ea0f605290b
Instruction Fuzzy Hash: B0110D72204265BFEB245E2CCC45F7A3726EB47B20F284314F9639BAD1CA61DD009375

Function 00DAD6C6 Relevance: 1.5, APIs: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D225DB: GetWindowLongW.USER32(?,000000EB), ref: 00D225EC

NtdllDialogWndProc_W.NTDLL(?,00000115,?,?,?,?,?,?,00D5BBA2,?,?,?,?,00000000,?), ref: 00DAD740

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 02d3ec324945b8e0ef3020034fde1fc5284162cf37d74e0216469ab99a2c8a62
Instruction ID: 62ca8e504395fe3a598b16bf29346615003c8df6cdb30521ef09b809fbac5d80
Opcode Fuzzy Hash: 02d3ec324945b8e0ef3020034fde1fc5284162cf37d74e0216469ab99a2c8a62
Instruction Fuzzy Hash: 4101F135600158ABDB189F29D889BFA3BA3EB57324F0C4125F9575B6A2C331AC2197B0

Function 00DAC220 Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

Part of subcall function 00D22344: GetCursorPos.USER32(?), ref: 00D22357
Part of subcall function 00D22344: ScreenToClient.USER32(00DE67B0,?), ref: 00D22374
Part of subcall function 00D22344: GetAsyncKeyState.USER32(00000001), ref: 00D22399
Part of subcall function 00D22344: GetAsyncKeyState.USER32(00000002), ref: 00D223A7

NtdllDialogWndProc_W.NTDLL(?,00000204,?,?,00000001,?,?,?,00D5BC4F,?,?,?,?,?,00000001,?), ref: 00DAC272

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AsyncState$ClientCursorDialogLongNtdllProc_ScreenWindow
String ID:
API String ID: 2356834413-0
Opcode ID: ce79fe248ea490c1e58862356ef9857884fa58cff76149cecde0053d367929a5
Instruction ID: 1eb866bfaaa6fa1bd719c464eee3aee1e5fae5f3864bad3ad4a6927968affe9f
Opcode Fuzzy Hash: ce79fe248ea490c1e58862356ef9857884fa58cff76149cecde0053d367929a5
Instruction Fuzzy Hash: 60F08230200228ABDF14AF49DC46EBA3B91EB15765F004455F9465B291CB75E860EFF0

Function 00D2189B Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

NtdllDialogWndProc_W.NTDLL(?,00000006,00000000,?,?,?,00D21B04,?,?,?,?,?), ref: 00D218E2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: de55ad8590490e072f8401eacdeaa93c78419ce6905d24b80dbd6f041bdf059e
Instruction ID: 6ec4bfe78cfef031846055b9e03e9882f18f6cb1b18e7e567d2addd93832140f
Opcode Fuzzy Hash: de55ad8590490e072f8401eacdeaa93c78419ce6905d24b80dbd6f041bdf059e
Instruction Fuzzy Hash: CAF0BE34600268AFCB18EF14E89093637A2FB703A4F008529F9528B3A0CB31DC50EB70

Function 00D941FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00D94218

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: eb5deda4b77d31a5c78b5a66f230b4baedb3a774c1dd396bf00e68bbe2109393
Instruction ID: 435024e032ec23360057c040fb1f1eb1804c0b7a386ccc74c66def35f5d5e5af
Opcode Fuzzy Hash: eb5deda4b77d31a5c78b5a66f230b4baedb3a774c1dd396bf00e68bbe2109393
Instruction Fuzzy Hash: 75E04F322402149FDB10EF69E845E9AF7E8EFA8760F048026FC49C7352DA70E8418BB0

Function 00DACBAE Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 00DACBEE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 21fd6655e64f95e5e78b92cef4530bfc4318d1f2a815821b0ad9dde519d0a5bb
Instruction ID: 7461253d0a8d991331f99912518d9b9cfece7f6a6d274024035692ceb9bdb714
Opcode Fuzzy Hash: 21fd6655e64f95e5e78b92cef4530bfc4318d1f2a815821b0ad9dde519d0a5bb
Instruction Fuzzy Hash: F5F06D32640394AFDB21EF58DC45FC63B95EB1A760F084458BA21672E1CB71B820E7B0

Function 00D84EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00D84EEC

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 59116c56f44b142bbc4847a906b74646a663eb40e8d6ebcc4892633856890f7c
Instruction ID: b4047ca018075c929d3dc1cd5b8212ce45ea7be3ecde7fc13521a6860bbdf842
Opcode Fuzzy Hash: 59116c56f44b142bbc4847a906b74646a663eb40e8d6ebcc4892633856890f7c
Instruction Fuzzy Hash: A6D05E9816070739EC2A6B24DC5FF772108F300782FD8418AB542C94C1E8D0AC505230

Function 00D78C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00D788D1), ref: 00D78CB3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: ac5f5e5fb9aa680c5ea0b229b33554b233cc3b41b7f453bce0a51bd5e441f460
Instruction ID: 00c23477e121755e19b7fe9445bce12e62b884638ca8572618190cb2d9330802
Opcode Fuzzy Hash: ac5f5e5fb9aa680c5ea0b229b33554b233cc3b41b7f453bce0a51bd5e441f460
Instruction Fuzzy Hash: 6FD05E322A060EABEF018FA4DC01EAE3B69EB04B01F408111FE15C51A1C775D835AB60

Function 00DACBF9 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,00D5BC0C,?,?,?,?,?,?), ref: 00DACC24

Part of subcall function 00DAB8EF: _memset.LIBCMT ref: 00DAB8FE
Part of subcall function 00DAB8EF: _memset.LIBCMT ref: 00DAB90D
Part of subcall function 00DAB8EF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00DE7F20,00DE7F64), ref: 00DAB93C
Part of subcall function 00DAB8EF: CloseHandle.KERNEL32 ref: 00DAB94E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: e4c471e84a2706693bae0fc4a68891ddb3d18725a8f8e88557fb7883a4a2d01b
Instruction ID: 95b4f2fcce01591597369bf0d4df57bdd963c9bbc10592f540b849e1d49d1fd8
Opcode Fuzzy Hash: e4c471e84a2706693bae0fc4a68891ddb3d18725a8f8e88557fb7883a4a2d01b
Instruction Fuzzy Hash: 10E04631110208DFCB01AF58DD40E8537A5FB1D360F004051FA055B2B2CB31E960EF60

Function 00D2167D Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?,?,00D21AEE,?,?,?), ref: 00D216AB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 004017109c11dd0326775f84e2aa2839334aec86694979609889f10108e6f674
Instruction ID: c5fe8736fafba416bec769caa05ae1f9f305c80404643900174b3e353e7e1666
Opcode Fuzzy Hash: 004017109c11dd0326775f84e2aa2839334aec86694979609889f10108e6f674
Instruction Fuzzy Hash: 56E0EC35500218BBCF15BF90DC51E643B26FB69358F108458FA454A3A1CA72A921EB70

Function 00DACB50 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 00DACB75

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 548aa65c443549c52587ea4a6a154f78536085c524e2ad94a19e1c4f657bf528
Instruction ID: 94b678367a4e0a97b309e8ab81f6001252cae341a585317b449da8e21dbe406e
Opcode Fuzzy Hash: 548aa65c443549c52587ea4a6a154f78536085c524e2ad94a19e1c4f657bf528
Instruction Fuzzy Hash: 3AE04275244349AFDB01EF98D885E963BA5AB1D740F014494FA159B362CB71A820EBB1

Function 00DACB7F Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 00DACBA4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 7ebb1c2c89c1ed28c9b5618f6e4b2327a6c305efbd5a23ccef4e96f8982cb47d
Instruction ID: d702421a189cd46471bbbb93a63dbfc80fd24ff4160ebfbfa5ecf443780e41c0
Opcode Fuzzy Hash: 7ebb1c2c89c1ed28c9b5618f6e4b2327a6c305efbd5a23ccef4e96f8982cb47d
Instruction Fuzzy Hash: 11E0E235200348EFCB01EF88D884D863BA5AB1D300F004094FA058B362CB71A820EBB1

Function 00D216B5 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

Part of subcall function 00D2201B: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00D220D3
Part of subcall function 00D2201B: KillTimer.USER32(-00000001,?,?,?,?,00D216CB,00000000,?,?,00D21AE2,?,?), ref: 00D2216E

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,00D21AE2,?,?), ref: 00D216D4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: 3d1add9596a2b552d79c671f0b24b03480cb6943f431c1cf4a3b3399728ac1fa
Instruction ID: 09698c01c271983a32b46f3c4988e02c6cf330b83e5636afe98e231e6c965dd9
Opcode Fuzzy Hash: 3d1add9596a2b552d79c671f0b24b03480cb6943f431c1cf4a3b3399728ac1fa
Instruction Fuzzy Hash: 10D0123114031877DA203FA1ED17F593A19DB64754F408420BA04692D3CAB1A810A5B8

Function 00D62230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00D62242

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1fe3753f640f0665452bee71d0575bbe590fbe1a42a6033012ce9e9cdeba0bac
Instruction ID: e60957577e341a266399bab9994be55d4ebf334b3d8c2ce5411a37aa1d68f03d
Opcode Fuzzy Hash: 1fe3753f640f0665452bee71d0575bbe590fbe1a42a6033012ce9e9cdeba0bac
Instruction Fuzzy Hash: 2CC04CF5800109DBDB05DB90D988DEE77BCAB05304F144095A181F2100D7749B448A75

Function 00D4A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00D4A36A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 61c3a458785d94335d7bde876e710902488014fcaed0c0aa1b50e81e206ee79c
Instruction ID: c8b5948205fc17f8240b9df6f4454d1d263cee02e931ca26e30601f04f7b24f4
Opcode Fuzzy Hash: 61c3a458785d94335d7bde876e710902488014fcaed0c0aa1b50e81e206ee79c
Instruction Fuzzy Hash: 8FA0113000020CAB8F002B82EC08888BFACEA022A0B0080A0F80C80222CB32A8208AA0

Function 00D38A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829094c5f2d61e9c71c09e9c6f174e55cff2a633f226ba3e9480a4fc05baa827
Instruction ID: 4727469d1883cae31858b1e89b17a520817a0acb20a2d3423a2241a4bbd6b05d
Opcode Fuzzy Hash: 829094c5f2d61e9c71c09e9c6f174e55cff2a633f226ba3e9480a4fc05baa827
Instruction Fuzzy Hash: 20221930905716CBDF288B28D49467DB7B1FB41344F6C846AF4868B295EB70DD82EB72

Function 00D42405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 9692d0fd8a84226b0e04e43b2af52755d7206e542da88010bae92278c59d0881
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 0EC170362050930BEB2D8639947413EBAE16EA27B139E075DF4B2CB5C5FF20D569DA30

Function 00D4283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 71c3a11f688b33a8a39e4c47ab7f0ae0840be9e6cfc618072fc371b74d8c1a82
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: C7C172372451930BEB2D463A847403EBAE16EA27B139E075DE4B2DB5C4FF20D5699A30

Function 00D41BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 7a2b0ebc5b1e14473125bc71a5eecb8a16903664fe5622888d5b56170281cc18
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 88C1933B2451930BEF2D463A947403EBAE16EA27B135E076DE4B2CB5C4FF10D5A99630

Function 0122B4A8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: e8c95aaf951c312196b94e30a4f3a3662afdce5037ecf7c5f83a57bd6e003544
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: C541D371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80

Function 0122B338 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 817454ed95edc7cb7bd4ccff728785ab5cee3d8e21e31538508b97c60e7cbfc9
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 10018078A10219EFCB44DF98C5909AEF7F5FB48210F208699DD09A7701D730AE41DB80

Function 0122B398 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 3f33bce4ec53cd938cd661acec7a71a23230c41250a4e54e8b31fbc1dcbbb825
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: CD018C78A1021AEFCB44DF98C5909AEF7B5FF48210F208699ED09A7301D730AE42DB80

Function 01229CD8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1284029492.0000000001227000.00000040.00000020.00020000.00000000.sdmp, Offset: 01227000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1227000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00DA37F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00DAF910), ref: 00DA38AF
IsWindowVisible.USER32(?), ref: 00DA38D3

Strings

CHECK, xrefs: 00DA3AF5
TABLEFT, xrefs: 00DA390F
GETSELECTED, xrefs: 00DA3B2B
SENDCOMMANDID, xrefs: 00DA3C62
ISVISIBLE, xrefs: 00DA38BF
GETCURRENTLINE, xrefs: 00DA3B75
ISCHECKED, xrefs: 00DA3AC1
TABRIGHT, xrefs: 00DA3925
FINDSTRING, xrefs: 00DA39FE
HIDEDROPDOWN, xrefs: 00DA3988
GETCURRENTSELECTION, xrefs: 00DA3A6B
UNCHECK, xrefs: 00DA3B0B
SELECTSTRING, xrefs: 00DA3A8E
SETCURRENTSELECTION, xrefs: 00DA3A3E
EDITPASTE, xrefs: 00DA3BE7
GETLINECOUNT, xrefs: 00DA3B4E
ISENABLED, xrefs: 00DA38F3
ADDSTRING, xrefs: 00DA399E
GETLINE, xrefs: 00DA3C23
GETCURRENTCOL, xrefs: 00DA3BB0
CURRENTTAB, xrefs: 00DA3945
DELSTRING, xrefs: 00DA39D1
SHOWDROPDOWN, xrefs: 00DA3968

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 5dc5210e73a34e0a14e156e3709b62b5114791d21f812664d321aff9b7f38934
Instruction ID: 41d70ee19e65cd8deaeb65ab4573f870c4baa9d8e5076524f85dd60cf1dedd0f
Opcode Fuzzy Hash: 5dc5210e73a34e0a14e156e3709b62b5114791d21f812664d321aff9b7f38934
Instruction Fuzzy Hash: 61D18130204315DBCB14EF20C851E6ABBA6EF55358F15885DB8C65B3A6DB31EE0ACB71

Function 00DAA849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00DAA89F
GetSysColorBrush.USER32(0000000F), ref: 00DAA8D0
GetSysColor.USER32(0000000F), ref: 00DAA8DC
SetBkColor.GDI32(?,000000FF), ref: 00DAA8F6
SelectObject.GDI32(?,?), ref: 00DAA905
InflateRect.USER32(?,000000FF,000000FF), ref: 00DAA930
GetSysColor.USER32(00000010), ref: 00DAA938
CreateSolidBrush.GDI32(00000000), ref: 00DAA93F
FrameRect.USER32(?,?,00000000), ref: 00DAA94E
DeleteObject.GDI32(00000000), ref: 00DAA955
InflateRect.USER32(?,000000FE,000000FE), ref: 00DAA9A0
FillRect.USER32(?,?,?), ref: 00DAA9D2
GetWindowLongW.USER32(?,000000F0), ref: 00DAA9FD

Part of subcall function 00DAAB60: GetSysColor.USER32(00000012), ref: 00DAAB99
Part of subcall function 00DAAB60: SetTextColor.GDI32(?,?), ref: 00DAAB9D
Part of subcall function 00DAAB60: GetSysColorBrush.USER32(0000000F), ref: 00DAABB3
Part of subcall function 00DAAB60: GetSysColor.USER32(0000000F), ref: 00DAABBE
Part of subcall function 00DAAB60: GetSysColor.USER32(00000011), ref: 00DAABDB
Part of subcall function 00DAAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00DAABE9
Part of subcall function 00DAAB60: SelectObject.GDI32(?,00000000), ref: 00DAABFA
Part of subcall function 00DAAB60: SetBkColor.GDI32(?,00000000), ref: 00DAAC03
Part of subcall function 00DAAB60: SelectObject.GDI32(?,?), ref: 00DAAC10
Part of subcall function 00DAAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00DAAC2F
Part of subcall function 00DAAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00DAAC46
Part of subcall function 00DAAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00DAAC5B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 02ea9d0bea8d3f30e0e23f032e3f11198041005567a0ae7b20fb03927657496c
Instruction ID: 83b47facd714676ca3ea17708931bb8d8bf1d8ce3589301015f9ae21c6869035
Opcode Fuzzy Hash: 02ea9d0bea8d3f30e0e23f032e3f11198041005567a0ae7b20fb03927657496c
Instruction Fuzzy Hash: 0DA18371408301AFD7109FA4DC08A5B7BE9FF8A321F144B29F5A2D62E0D735D945CB62

Function 00D977BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00D977F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00D978B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00D978EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00D97900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00D97946
GetClientRect.USER32(00000000,?), ref: 00D97952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00D97996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00D979A5
GetStockObject.GDI32(00000011), ref: 00D979B5
SelectObject.GDI32(00000000,00000000), ref: 00D979B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00D979C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D979D2
DeleteDC.GDI32(00000000), ref: 00D979DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00D97A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00D97A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00D97A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00D97A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00D97A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00D97AAE
GetStockObject.GDI32(00000011), ref: 00D97AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00D97AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00D97ACE

Strings

DISPLAY, xrefs: 00D9799B
msctls_progress32, xrefs: 00D97A4F
AutoIt v3, xrefs: 00D9793E
static, xrefs: 00D97990, 00D97AA8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 977dec9a0ec5627ded9bfa512053deb3a9ff96131907b98dc9b86cf751acc24d
Instruction ID: 06ef5716302f36f46fc390ba1de08bb66d4fa30128fe00fc7ada4d5d3aec4a25
Opcode Fuzzy Hash: 977dec9a0ec5627ded9bfa512053deb3a9ff96131907b98dc9b86cf751acc24d
Instruction Fuzzy Hash: 68A16E71A40215BFEB149BA4DC8AFAEBBB9EB49714F044154FA15EB2E0D770AD00CB74

Function 00D8AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D8AF89
GetDriveTypeW.KERNEL32(?,00DAFAC0,?,\\.\,00DAF910), ref: 00D8B066
SetErrorMode.KERNEL32(00000000,00DAFAC0,?,\\.\,00DAF910), ref: 00D8B1C4

Strings

RAID, xrefs: 00D8B162
SATA, xrefs: 00D8B177
Network, xrefs: 00D8B0A4
RAMDisk, xrefs: 00D8B090
ATAPI, xrefs: 00D8B138
SAS, xrefs: 00D8B170
iSCSI, xrefs: 00D8B169
SSA, xrefs: 00D8B14D
SCSI, xrefs: 00D8B131
MMC, xrefs: 00D8B185
SSD, xrefs: 00D8B0F1
1394, xrefs: 00D8B146
Fixed, xrefs: 00D8B0AE
Removable, xrefs: 00D8B0B8
\\.\, xrefs: 00D8AFDB
USB, xrefs: 00D8B15B
PhysicalDrive, xrefs: 00D8B012
ATA, xrefs: 00D8B13F
Unknown, xrefs: 00D8B086, 00D8B12A
CDROM, xrefs: 00D8B09A
Virtual, xrefs: 00D8B18C
Fibre, xrefs: 00D8B154
FileBackedVirtual, xrefs: 00D8B193

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f6c84208a1239b2450dee63802827a8723f7b33b88013e025cf9f9256edd4030
Instruction ID: 942288bb0e0b3ae33c457fa3ccc587fa5607783fe9e60c60468356cfc8a3f425
Opcode Fuzzy Hash: f6c84208a1239b2450dee63802827a8723f7b33b88013e025cf9f9256edd4030
Instruction Fuzzy Hash: AD51C030684305AF8B10FF68C9A69BDB3B0EB15361B648017E40AAB391C735DD49DB72

Function 00D26A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D26A91
__wcsnicmp.LIBCMT ref: 00D26AA9
__wcsnicmp.LIBCMT ref: 00D26AC1
__wcsnicmp.LIBCMT ref: 00D26AD9
__wcsnicmp.LIBCMT ref: 00D26AF1
__wcsnicmp.LIBCMT ref: 00D26B09
__wcsnicmp.LIBCMT ref: 00D26B21
__wcsnicmp.LIBCMT ref: 00D26B35
__wcsnicmp.LIBCMT ref: 00D26B76
__wcsnicmp.LIBCMT ref: 00D26B8A
__wcsnicmp.LIBCMT ref: 00D26B9E
__wcsnicmp.LIBCMT ref: 00D26BB2

Strings

#notrayicon, xrefs: 00D26AA3
#include, xrefs: 00D26B03
#ce, xrefs: 00D26BAC
#comments-start, xrefs: 00D26B1B, 00D26B70
#pragma compile, xrefs: 00D26A8B
#cs, xrefs: 00D26B2F, 00D26B84
#include-once, xrefs: 00D26AEB
#OnAutoItStartRegister, xrefs: 00D26AD3
Cannot parse #include, xrefs: 00D5E819
#comments-end, xrefs: 00D26B98
#requireadmin, xrefs: 00D26ABB
Unterminated group of comments, xrefs: 00D5E82C
Bad directive syntax error, xrefs: 00D5E743

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 461b895c64d6517537a7029e62b9592ff747ac6aa7b8d0fef54699d3d3eab78a
Instruction ID: 432832673a55a6a660a9c5a8f589c26094d93193177c28571ba837e909f5c975
Opcode Fuzzy Hash: 461b895c64d6517537a7029e62b9592ff747ac6aa7b8d0fef54699d3d3eab78a
Instruction Fuzzy Hash: ED810671640325ABCF25BF64ED83FAA7768EF25704F084025FD45AA182EB70DB59C2B1

Function 00D22C18 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00D22CA2
DeleteObject.GDI32(00000000), ref: 00D22CE8
DeleteObject.GDI32(00000000), ref: 00D22CF3
DestroyCursor.USER32(00000000), ref: 00D22CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00D22D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00D5C68B
6FDA0200.COMCTL32(?,000000FF,?), ref: 00D5C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00D5CAED

Part of subcall function 00D21B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D22036,?,00000000,?,?,?,?,00D216CB,00000000,?), ref: 00D21B9A

SendMessageW.USER32(?,00001053), ref: 00D5CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00D5CB41

Strings

0, xrefs: 00D5C981

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: DestroyMessageSendWindow$DeleteObject$A0200CursorInvalidateMoveRect
String ID: 0
API String ID: 377055139-4108050209
Opcode ID: c3c1768f8cfbf877d2f30b65c739f8cd43855aaf94c7820e4793fd2ca4a130bf
Instruction ID: 13cec5f3ab92d534de4ad22670cd35fcf9f0d038ad930495c99cea31a9548d31
Opcode Fuzzy Hash: c3c1768f8cfbf877d2f30b65c739f8cd43855aaf94c7820e4793fd2ca4a130bf
Instruction Fuzzy Hash: 0F129A30614311AFCB20CF24C884BA9BBA1FF19316F5855A9FC95DB662C731E846DBB0

Function 00DAAB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00DAAB99
SetTextColor.GDI32(?,?), ref: 00DAAB9D
GetSysColorBrush.USER32(0000000F), ref: 00DAABB3
GetSysColor.USER32(0000000F), ref: 00DAABBE
CreateSolidBrush.GDI32(?), ref: 00DAABC3
GetSysColor.USER32(00000011), ref: 00DAABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00DAABE9
SelectObject.GDI32(?,00000000), ref: 00DAABFA
SetBkColor.GDI32(?,00000000), ref: 00DAAC03
SelectObject.GDI32(?,?), ref: 00DAAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00DAAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00DAAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00DAAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00DAACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00DAACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00DAACEC
DrawFocusRect.USER32(?,?), ref: 00DAACF7
GetSysColor.USER32(00000011), ref: 00DAAD05
SetTextColor.GDI32(?,00000000), ref: 00DAAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00DAAD21
SelectObject.GDI32(?,00DAA869), ref: 00DAAD38
DeleteObject.GDI32(?), ref: 00DAAD43
SelectObject.GDI32(?,?), ref: 00DAAD49
DeleteObject.GDI32(?), ref: 00DAAD4E
SetTextColor.GDI32(?,?), ref: 00DAAD54
SetBkColor.GDI32(?,?), ref: 00DAAD5E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 3682b9ffc13eef0138d7c47590358af95ce6325fc20e3422bda4d7865b6dda54
Instruction ID: fd1c235b3503fa5478a668719337f02206100952f0abe49ea40368bfa63ba3e1
Opcode Fuzzy Hash: 3682b9ffc13eef0138d7c47590358af95ce6325fc20e3422bda4d7865b6dda54
Instruction Fuzzy Hash: 63616D71900218EFDF119FA8DC48EAE7B79EB0A320F144265F911EB2A1D7759D40DBA0

Function 00DA8C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00DA8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DA8D45
CharNextW.USER32(0000014E), ref: 00DA8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00DA8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00DA8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DA8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00DA8DF9
SetWindowTextW.USER32(?,0000014E), ref: 00DA8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00DA8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00DA8E8C
_memset.LIBCMT ref: 00DA8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00DA8EFA
_memset.LIBCMT ref: 00DA8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00DA8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00DA8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00DA9088
InvalidateRect.USER32(?,00000000,00000001), ref: 00DA90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00DA90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00DA9121
DrawMenuBar.USER32(?), ref: 00DA9130
SetWindowTextW.USER32(?,0000014E), ref: 00DA9158

Strings

0, xrefs: 00DA90C2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: b6cab4cbc39075828d95713f6dceed03539902f70751b6c2c1b5e394e76c6d78
Instruction ID: 19bfb286e9f33d42b67b9259d4319962e69a57d8394611c5cc9d3296224d4b48
Opcode Fuzzy Hash: b6cab4cbc39075828d95713f6dceed03539902f70751b6c2c1b5e394e76c6d78
Instruction Fuzzy Hash: 36E18070900219AFDF209F64CC88EEEBBB9EF16710F188155FD55AA291DB708A85DF70

Function 00DA4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00DA4C51
GetDesktopWindow.USER32 ref: 00DA4C66
GetWindowRect.USER32(00000000), ref: 00DA4C6D
GetWindowLongW.USER32(?,000000F0), ref: 00DA4CCF
DestroyWindow.USER32(?), ref: 00DA4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00DA4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DA4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00DA4D68
SendMessageW.USER32(?,00000421,?,?), ref: 00DA4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00DA4D90
IsWindowVisible.USER32(?), ref: 00DA4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00DA4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00DA4DDF
GetWindowRect.USER32(?,?), ref: 00DA4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00DA4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00DA4E37
CopyRect.USER32(?,?), ref: 00DA4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00DA4EB9

Strings

(, xrefs: 00DA4E2A
0, xrefs: 00DA4BFC
tooltips_class32, xrefs: 00DA4D1D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: c5b3a31feff2e94672b07ddca75635652f3d66dacab1ad9c55524fd3aaf5f4c3
Instruction ID: f9174ce8b8132845823fa9ab7adc3df1a825576b8d5747c3a65636e060a23be1
Opcode Fuzzy Hash: c5b3a31feff2e94672b07ddca75635652f3d66dacab1ad9c55524fd3aaf5f4c3
Instruction Fuzzy Hash: 34B18B71608350AFDB04DF64D845B6ABBE4FF8A314F04891CF5999B2A1D7B1EC04CBA2

Function 00D227D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D228BC
GetSystemMetrics.USER32(00000007), ref: 00D228C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D228EF
GetSystemMetrics.USER32(00000008), ref: 00D228F7
GetSystemMetrics.USER32(00000004), ref: 00D2291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00D22939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00D22949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00D2297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00D22990
GetClientRect.USER32(00000000,000000FF), ref: 00D229AE
GetStockObject.GDI32(00000011), ref: 00D229CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D229D5

Part of subcall function 00D22344: GetCursorPos.USER32(?), ref: 00D22357
Part of subcall function 00D22344: ScreenToClient.USER32(00DE67B0,?), ref: 00D22374
Part of subcall function 00D22344: GetAsyncKeyState.USER32(00000001), ref: 00D22399
Part of subcall function 00D22344: GetAsyncKeyState.USER32(00000002), ref: 00D223A7

SetTimer.USER32(00000000,00000000,00000028,00D21256), ref: 00D229FC

Strings

AutoIt v3 GUI, xrefs: 00D22974

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5cc94f53aeac6133f2ec952cec78b074eeb39f6c26c528602a8ea60369fc3e51
Instruction ID: f04ca801f426a9a57984962bfc381f749138f4c6e0b8afd472062ce20e19e174
Opcode Fuzzy Hash: 5cc94f53aeac6133f2ec952cec78b074eeb39f6c26c528602a8ea60369fc3e51
Instruction Fuzzy Hash: BFB15D71A0031AAFDB14DFA8DC85BAE7BB4FB18315F148229FA15E6290DB74D841CB70

Function 00D846D6 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00D8473C
_wcscmp.LIBCMT ref: 00D84747
_wcscat.LIBCMT ref: 00D8475D
_wcsstr.LIBCMT ref: 00D84768
755A1560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00D84784
_wcscat.LIBCMT ref: 00D847CD
_wcscat.LIBCMT ref: 00D847D4
_wcsncpy.LIBCMT ref: 00D847FF

Strings

04090000, xrefs: 00D847BA
%u.%u.%u.%u, xrefs: 00D84862
StringFileInfo\, xrefs: 00D84757
\VarFileInfo\Translation, xrefs: 00D8477C
DefaultLangCodepage, xrefs: 00D847E7

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _wcscat$A1560_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 3483108802-1459072770
Opcode ID: 07ce55c5236b463cc2b4e22df0c52c51cf874fcebc80f22037e84b03710e50e7
Instruction ID: dabc95e2e7d6df98d66bf73971efaa47190996220dbd339a361016a9aba86929
Opcode Fuzzy Hash: 07ce55c5236b463cc2b4e22df0c52c51cf874fcebc80f22037e84b03710e50e7
Instruction Fuzzy Hash: C3411775A002057BEB10BBB58C43EBF7BBCEF46710F04406AF944E6182EB749A0597B5

Function 00DA4069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DA40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00DA41B6

Strings

SELECTALL, xrefs: 00DA421D
GETSELECTED, xrefs: 00DA42E4
SELECTINVERT, xrefs: 00DA4286
DESELECT, xrefs: 00DA42A4
VIEWCHANGE, xrefs: 00DA4375
SELECTCLEAR, xrefs: 00DA4235
GETSELECTEDCOUNT, xrefs: 00DA4199
GETTEXT, xrefs: 00DA415F
GETSUBITEMCOUNT, xrefs: 00DA4141
FINDITEM, xrefs: 00DA4329
GETITEMCOUNT, xrefs: 00DA4128
SELECT, xrefs: 00DA4250
ISSELECTED, xrefs: 00DA41C1

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 8b2be3147be57d951b870b06c993987e116faac757e4147c75c881efd81fcb5f
Instruction ID: 6012be670d3892c412d3a3f4e241a003195ebad11d09a407941b26fb1bff0ccf
Opcode Fuzzy Hash: 8b2be3147be57d951b870b06c993987e116faac757e4147c75c881efd81fcb5f
Instruction Fuzzy Hash: 86A1BE30214311DFCB14EF20C952A6AB7A5EF95318F14896DB8969B7D2DB70EC09CB71

Function 00D952F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00D95309
LoadCursorW.USER32(00000000,00007F8A), ref: 00D95314
LoadCursorW.USER32(00000000,00007F00), ref: 00D9531F
LoadCursorW.USER32(00000000,00007F03), ref: 00D9532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00D95335
LoadCursorW.USER32(00000000,00007F01), ref: 00D95340
LoadCursorW.USER32(00000000,00007F81), ref: 00D9534B
LoadCursorW.USER32(00000000,00007F88), ref: 00D95356
LoadCursorW.USER32(00000000,00007F80), ref: 00D95361
LoadCursorW.USER32(00000000,00007F86), ref: 00D9536C
LoadCursorW.USER32(00000000,00007F83), ref: 00D95377
LoadCursorW.USER32(00000000,00007F85), ref: 00D95382
LoadCursorW.USER32(00000000,00007F82), ref: 00D9538D
LoadCursorW.USER32(00000000,00007F84), ref: 00D95398
LoadCursorW.USER32(00000000,00007F04), ref: 00D953A3
LoadCursorW.USER32(00000000,00007F02), ref: 00D953AE
GetCursorInfo.USER32(?), ref: 00D953BE
GetLastError.KERNEL32(00000001,00000000), ref: 00D953E9

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: fb7c5466945d1aa284bae6ff81104986c96a6973add328931432bb02a05b6900
Instruction ID: 56eee26fc200d29d71774bbce7506f71de9eb6585c1f16439bc0e3ee2dbaf2ab
Opcode Fuzzy Hash: fb7c5466945d1aa284bae6ff81104986c96a6973add328931432bb02a05b6900
Instruction Fuzzy Hash: EF415F70E483196ADF109FBA9C4996EFFB8EF51B50B10453FE509E7290DAB8A4018F61

Function 00D7AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00D7AAA5
__swprintf.LIBCMT ref: 00D7AB46
_wcscmp.LIBCMT ref: 00D7AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00D7ABAE
_wcscmp.LIBCMT ref: 00D7ABEA
GetClassNameW.USER32(?,?,00000400), ref: 00D7AC21
GetDlgCtrlID.USER32(?), ref: 00D7AC73
GetWindowRect.USER32(?,?), ref: 00D7ACA9
GetParent.USER32(?), ref: 00D7ACC7
ScreenToClient.USER32(00000000), ref: 00D7ACCE
GetClassNameW.USER32(?,?,00000100), ref: 00D7AD48
_wcscmp.LIBCMT ref: 00D7AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00D7AD82
_wcscmp.LIBCMT ref: 00D7AD96

Part of subcall function 00D4386C: _iswctype.LIBCMT ref: 00D43874

Strings

%s%u, xrefs: 00D7AB40

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 043ff76f3fb49643c1a5dd0b8c7185987b4babac228cf17da68caf8f5d3f9ae1
Instruction ID: 5f07f322b04ac9b906a1face9a152c0d31fe92f7967ace18603124876eba3d7a
Opcode Fuzzy Hash: 043ff76f3fb49643c1a5dd0b8c7185987b4babac228cf17da68caf8f5d3f9ae1
Instruction Fuzzy Hash: 82A1A071204306ABD725DF68C884BAEB7A8FF84315F048529F99DD2150F730E945CBB2

Function 00D7B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00D7B3DB
_wcscmp.LIBCMT ref: 00D7B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00D7B414
CharUpperBuffW.USER32(?,00000000), ref: 00D7B431
_wcscmp.LIBCMT ref: 00D7B44F
_wcsstr.LIBCMT ref: 00D7B460
GetClassNameW.USER32(00000018,?,00000400), ref: 00D7B498
_wcscmp.LIBCMT ref: 00D7B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00D7B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00D7B518
_wcscmp.LIBCMT ref: 00D7B528
GetClassNameW.USER32(00000010,?,00000400), ref: 00D7B550
GetWindowRect.USER32(00000004,?), ref: 00D7B5B9

Strings

@, xrefs: 00D7B3BC
ThumbnailClass, xrefs: 00D7B4A3, 00D7B523

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 21ab0b6445cff16c602d906347a035a152e4e109d1d318a9f96d1c01af48e570
Instruction ID: 7f6783b4e7a62d14890d7e4b1af979dd4354d856bf0d183903644ac0d646c115
Opcode Fuzzy Hash: 21ab0b6445cff16c602d906347a035a152e4e109d1d318a9f96d1c01af48e570
Instruction Fuzzy Hash: EC818E710083059FDB14DF14D885FAA7BE8EF44328F08856AFD899A196EB34DD49CB71

Function 00D7B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D7B23F

Strings

CLASSNAME=, xrefs: 00D7B27C
REGEXP=, xrefs: 00D7B254
[ALL, xrefs: 00D7B2E5
[CLASS:, xrefs: 00D7B28F
ALL, xrefs: 00D7B2D3
[HANDLE:, xrefs: 00D7B24B
HANDLE=, xrefs: 00D7B238
[ACTIVE, xrefs: 00D7B22C
LAST, xrefs: 00D7B204
ACTIVE, xrefs: 00D7B21A
[REGEXPTITLE:, xrefs: 00D7B267
[LAST, xrefs: 00D7B2EC

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 10d86dc1f85982a925a6b47c26f0910521e29d2c72b911289a51a152c6bac919
Instruction ID: 6dd1c98c812916d46a7f1e4f12e7080637099e99cfb9da9587fa8e4cdfc10acb
Opcode Fuzzy Hash: 10d86dc1f85982a925a6b47c26f0910521e29d2c72b911289a51a152c6bac919
Instruction Fuzzy Hash: 3B31E030A45215AADB14FA60DD53FEEB7B4DF20764F60402AF445B21E6FF22AE08C674

Function 00D7C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00D7C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00D7C4E6
SetWindowTextW.USER32(?,?), ref: 00D7C4FD
GetDlgItem.USER32(?,000003EA), ref: 00D7C512
SetWindowTextW.USER32(00000000,?), ref: 00D7C518
GetDlgItem.USER32(?,000003E9), ref: 00D7C528
SetWindowTextW.USER32(00000000,?), ref: 00D7C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00D7C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00D7C569
GetWindowRect.USER32(?,?), ref: 00D7C572
SetWindowTextW.USER32(?,?), ref: 00D7C5DD
GetDesktopWindow.USER32 ref: 00D7C5E3
GetWindowRect.USER32(00000000), ref: 00D7C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00D7C636
GetClientRect.USER32(?,?), ref: 00D7C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00D7C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00D7C693

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 3ac06e4aa02932fde294fe170470cc89681e8ae0eed5b71eca93ede88e4611a1
Instruction ID: f785e8f899d8c84fee6a6b55bc1bd63bedbe8517aef6f9c6cc0e639383a6c7b2
Opcode Fuzzy Hash: 3ac06e4aa02932fde294fe170470cc89681e8ae0eed5b71eca93ede88e4611a1
Instruction Fuzzy Hash: AE515C70900709AFDB209FA8DD89B6EBBF5FF04705F04492CE686A26A0D775F904CB60

Function 00DAA428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DAA4C8
DestroyWindow.USER32(?,?), ref: 00DAA542

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00DAA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00DAA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DAA5F1
DestroyWindow.USER32(00000000), ref: 00DAA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00D20000,00000000), ref: 00DAA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DAA663
GetDesktopWindow.USER32 ref: 00DAA67C
GetWindowRect.USER32(00000000), ref: 00DAA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00DAA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00DAA6B3

Part of subcall function 00D225DB: GetWindowLongW.USER32(?,000000EB), ref: 00D225EC

Strings

0, xrefs: 00DAA4DE
tooltips_class32, xrefs: 00DAA5B5, 00DAA643

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: bdd2898db1baf497f0e3d3e7ea1b35a8204e2c2b346066757b06e9f6e65c2f00
Instruction ID: ae432c9f89f54c76adadebbe101ba6a6fcf2548fbc8bbfadce82e7adfe69e7bb
Opcode Fuzzy Hash: bdd2898db1baf497f0e3d3e7ea1b35a8204e2c2b346066757b06e9f6e65c2f00
Instruction Fuzzy Hash: EE716871140745AFD720DF28CC49F6A7BE5EB9A304F0C4A29F9858B2A1D770E906CF66

Function 00DA4619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DA46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00DA46F6

Strings

CHECK, xrefs: 00DA4716
UNCHECK, xrefs: 00DA48D2
GETTEXT, xrefs: 00DA4849
COLLAPSE, xrefs: 00DA473C
GETSELECTED, xrefs: 00DA4806
EXISTS, xrefs: 00DA475F
GETITEMCOUNT, xrefs: 00DA47D8
SELECT, xrefs: 00DA48A7
EXPAND, xrefs: 00DA47A8
ISCHECKED, xrefs: 00DA4879
GETTOTALCOUNT, xrefs: 00DA46DD

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: baa340f150381ba8c2841c826a895caa3d59cdcde0f04cea81a90a552363b888
Instruction ID: 7ff2e01f9558772f094802c8c7f2c861fd96db5bb147af7525f11635e3084b8a
Opcode Fuzzy Hash: baa340f150381ba8c2841c826a895caa3d59cdcde0f04cea81a90a552363b888
Instruction Fuzzy Hash: A591AD346043118FCB14EF20D451A6EBBA1EF95318F04886DF8965B7A2DB71ED4ACBB1

Function 00DABAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00DABB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00DA9431), ref: 00DABBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00DABC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00DABC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00DABC7D
FreeLibrary.KERNEL32(?), ref: 00DABC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00DABC99
DestroyCursor.USER32(?), ref: 00DABCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00DABCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00DABCD1

Part of subcall function 00D4313D: __wcsicmp_l.LIBCMT ref: 00D431C6

Strings

.dll, xrefs: 00DABB27
.exe, xrefs: 00DABB04
.icl, xrefs: 00DABAE4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 3907162815-1154884017
Opcode ID: d7ae89c306197baa2b197598940e11b52220a3a0a39b78949664256376a85831
Instruction ID: 21918664c70c52d098930d343f126063b4ef697b7bf14943d15b58ac9c1e815a
Opcode Fuzzy Hash: d7ae89c306197baa2b197598940e11b52220a3a0a39b78949664256376a85831
Instruction Fuzzy Hash: 2661DE71500719BBEB14DF74CC81FBA77A8EB09721F10461AF815D61C2DB74AA91DBB0

Function 00D8A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

CharLowerBuffW.USER32(?,?), ref: 00D8A636
GetDriveTypeW.KERNEL32 ref: 00D8A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D8A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D8A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D8A730

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

Strings

close cd wait, xrefs: 00D8A71B
set cd door , xrefs: 00D8A6D1
wait, xrefs: 00D8A6ED
close, xrefs: 00D8A63C
open, xrefs: 00D8A65D
type cdaudio alias cd wait, xrefs: 00D8A6AE
closed, xrefs: 00D8A64A, 00D8A653
open , xrefs: 00D8A692

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 895a28fa60c69b7c4a5aaac442b6197314cf8339018e334452c36a28b4ecac19
Instruction ID: 89934f418737196900df53df120dfd085935458c2ba6dd5f7c7c39199c4246b5
Opcode Fuzzy Hash: 895a28fa60c69b7c4a5aaac442b6197314cf8339018e334452c36a28b4ecac19
Instruction Fuzzy Hash: 2B5167711087159FC710EF24D89196AB7F8EF94718F04896DF886972A1DB31EE0ACB72

Function 00D8A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00D8A47A
__swprintf.LIBCMT ref: 00D8A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00D8A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00D8A4FE
_memset.LIBCMT ref: 00D8A51D
_wcsncpy.LIBCMT ref: 00D8A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00D8A58E
CloseHandle.KERNEL32(00000000), ref: 00D8A599
RemoveDirectoryW.KERNEL32(?), ref: 00D8A5A2
CloseHandle.KERNEL32(00000000), ref: 00D8A5AC

Strings

:, xrefs: 00D8A4BD
\, xrefs: 00D8A4B2
\??\%s, xrefs: 00D8A496

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 4b4a1f1f8f391e89190ed4cb6bb83274f4fbbdb476def905e518aca0d8819232
Instruction ID: bea827d5ed3ed619a7ee75a5f2c72979a22b6c3d62869f51aabc6cd9b03d0613
Opcode Fuzzy Hash: 4b4a1f1f8f391e89190ed4cb6bb83274f4fbbdb476def905e518aca0d8819232
Instruction Fuzzy Hash: 903190B6500209ABEB219FA4DC49FEB73BCEF89701F1441B6FA08D2160E77497858B35

Function 00D783F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00D78766
Part of subcall function 00D7874A: GetLastError.KERNEL32(?,00D7822A,?,?,?), ref: 00D78770
Part of subcall function 00D7874A: GetProcessHeap.KERNEL32(00000008,?,?,00D7822A,?,?,?), ref: 00D7877F
Part of subcall function 00D7874A: RtlAllocateHeap.NTDLL(00000000,?,00D7822A), ref: 00D78786
Part of subcall function 00D7874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00D7879D

Part of subcall function 00D787E7: GetProcessHeap.KERNEL32(00000008,00D78240,00000000,00000000,?,00D78240,?), ref: 00D787F3
Part of subcall function 00D787E7: RtlAllocateHeap.NTDLL(00000000,?,00D78240), ref: 00D787FA
Part of subcall function 00D787E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00D78240,?), ref: 00D7880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D78458
_memset.LIBCMT ref: 00D7846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00D7848C
GetLengthSid.ADVAPI32(?), ref: 00D7849D
GetAce.ADVAPI32(?,00000000,?), ref: 00D784DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00D784F6
GetLengthSid.ADVAPI32(?), ref: 00D78513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00D78522
RtlAllocateHeap.NTDLL(00000000), ref: 00D78529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00D7854A
CopySid.ADVAPI32(00000000), ref: 00D78551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00D78582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00D785A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00D785BC

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: 5f2ed6967d21fec6abac160f5cf559c91b56c70e3b6f68d5be52132051447c8a
Instruction ID: daf4e9c758d167d9ceb87ebb0addb3b991a12c0ee8986b74ea9b4d098cd571f5
Opcode Fuzzy Hash: 5f2ed6967d21fec6abac160f5cf559c91b56c70e3b6f68d5be52132051447c8a
Instruction Fuzzy Hash: 5A613C7194020AABDF10DF94DC49AAEBBB9FF05300F14816AE919E7291EB319A05DF70

Function 00D9762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D976A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00D976AE
CreateCompatibleDC.GDI32(?), ref: 00D976BA
SelectObject.GDI32(00000000,?), ref: 00D976C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00D9771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00D97757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00D9777B
SelectObject.GDI32(00000006,?), ref: 00D97783
DeleteObject.GDI32(?), ref: 00D9778C
DeleteDC.GDI32(00000006), ref: 00D97793
ReleaseDC.USER32(00000000,?), ref: 00D9779E

Strings

(, xrefs: 00D97723

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 5b3661eada9748eedf3cc5bde2c7754673a667c4f5a8ed7da28ea2385b3465db
Instruction ID: 10889f6421919d238a0439cfc2318690f05acc0bab3f51e8635f9a38ec722364
Opcode Fuzzy Hash: 5b3661eada9748eedf3cc5bde2c7754673a667c4f5a8ed7da28ea2385b3465db
Instruction Fuzzy Hash: 23512875904309EFCB15CFA8CC85EAEBBB9EF49710F14856DF99997310D731A9408B60

Function 00D8A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00DAFB78), ref: 00D8A0FC

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00D8A11E
__swprintf.LIBCMT ref: 00D8A177
__swprintf.LIBCMT ref: 00D8A190
_wprintf.LIBCMT ref: 00D8A246
_wprintf.LIBCMT ref: 00D8A264

Strings

"%s" (%d) : ==> %s:, xrefs: 00D8A25F
Line %d (File "%s"):, xrefs: 00D8A171, 00D8A18A
"%s" (%d) : ==> %s:%s%s, xrefs: 00D8A241
^ ERROR, xrefs: 00D8A1E8
Error: , xrefs: 00D8A20E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 50d8d514aa3aa3218fb566d2319ad82c4b167760d8006b98e52f7fc52d7a58d7
Instruction ID: 44588a5a4af84e4636cf587d97c0136ae3aa4cd70500b666de97da534784a728
Opcode Fuzzy Hash: 50d8d514aa3aa3218fb566d2319ad82c4b167760d8006b98e52f7fc52d7a58d7
Instruction Fuzzy Hash: 6E517D7190021AAADF25FBA4DD86EEEB778EF24304F140165F505721A1EB316F48DB71

Function 00D26BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00D40B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00D26C6C,?,00008000), ref: 00D40BB7

Part of subcall function 00D248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D248A1,?,?,00D237C0,?), ref: 00D248CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00D26D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00D26E5A

Part of subcall function 00D259CD: _wcscpy.LIBCMT ref: 00D25A05

Part of subcall function 00D4387D: _iswctype.LIBCMT ref: 00D43885

Strings

Error opening the file, xrefs: 00D5E866, 00D5E8E1
>>>AUTOIT SCRIPT<<<, xrefs: 00D5E8BF
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00D5E84A
EA06, xrefs: 00D5E87B
Unterminated string, xrefs: 00D5EC0D
AU3!, xrefs: 00D26CC1
Bad directive syntax error, xrefs: 00D5EBC6

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 1a6bd549369789218a4ce05e93d362569491e0609ef04c87bce4d9e9801bbf88
Instruction ID: 1f1990cc1937ad9c4d7a8056ba4eb508331660426b4c7a8ec15533d296ff309e
Opcode Fuzzy Hash: 1a6bd549369789218a4ce05e93d362569491e0609ef04c87bce4d9e9801bbf88
Instruction Fuzzy Hash: ED027E311083519FCB24EF24D891AAFBBE5EFA5318F04491DF895972A1DB30DA49CB72

Function 00D245DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D245F9
GetMenuItemCount.USER32(00DE6890), ref: 00D5D7CD
GetMenuItemCount.USER32(00DE6890), ref: 00D5D87D
GetCursorPos.USER32(?), ref: 00D5D8C1
SetForegroundWindow.USER32(00000000), ref: 00D5D8CA
TrackPopupMenuEx.USER32(00DE6890,00000000,?,00000000,00000000,00000000), ref: 00D5D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00D5D8E9

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: e1a7c0a5887850f9d12077757d7008ec0a3b34c5b381799bbd2384bd244ac2ca
Instruction ID: a3feab52d99a0f0157a44800da3df9fd8cc1d2e7b792e959fab252c3d99a71a4
Opcode Fuzzy Hash: e1a7c0a5887850f9d12077757d7008ec0a3b34c5b381799bbd2384bd244ac2ca
Instruction Fuzzy Hash: 3E71E270601215BAEF309F54DC85FAABF65FB0536AF240216FD15A61E1CBB19814DBB0

Function 00DA10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA0038,?,?), ref: 00DA10BC

Strings

HKLM, xrefs: 00DA113A
HKCU, xrefs: 00DA11AC
HKEY_CLASSES_ROOT, xrefs: 00DA114F
HKEY_CURRENT_CONFIG, xrefs: 00DA1179
HKCC, xrefs: 00DA118A
HKCR, xrefs: 00DA1164
HKEY_USERS, xrefs: 00DA11BD
HKEY_CURRENT_USER, xrefs: 00DA119B
HKU, xrefs: 00DA11CE
HKEY_LOCAL_MACHINE, xrefs: 00DA1125

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 4bc3e3a014359e9d02f9b3c41d8a70c596d070efee3f447b64cc2d7238cdb105
Instruction ID: 7a525526132ff6c2d1fcf4ffab417681f4fbfa4302850514657da7945a77264f
Opcode Fuzzy Hash: 4bc3e3a014359e9d02f9b3c41d8a70c596d070efee3f447b64cc2d7238cdb105
Instruction Fuzzy Hash: 2B41273455035ACBCF10EF90E892AEA3724EF22354F55445AED915B792DB30E91ACB70

Function 00D85569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

Part of subcall function 00D27A84: _memmove.LIBCMT ref: 00D27B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00D855D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00D855E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D855F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00D8560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00D8561C

Strings

play PlayMe wait, xrefs: 00D85606
close PlayMe, xrefs: 00D855E3, 00D85610
play PlayMe, xrefs: 00D85617
status PlayMe mode, xrefs: 00D855CD
alias PlayMe, xrefs: 00D855AB
open , xrefs: 00D85581

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: f34f4a6b78d04e8a7bd68b2f6c513628b9ec85fd71967984f370c840a4a24fb1
Instruction ID: 0a2faf0a5fb8742d4c156f8b233996ed032c75cd1047d1644879098a8300f6fd
Opcode Fuzzy Hash: f34f4a6b78d04e8a7bd68b2f6c513628b9ec85fd71967984f370c840a4a24fb1
Instruction Fuzzy Hash: 3911C4209901697DD730F7A5EC4ADFF7B7DEFA1B04F44046AB401A21D5EE605D09C6B1

Function 00D848F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00D8490E
gethostname.WS2_32(?,00000100), ref: 00D84928
gethostbyname.WS2_32(?), ref: 00D84935
_wcscpy.LIBCMT ref: 00D8495D
_memmove.LIBCMT ref: 00D84970
inet_ntoa.WS2_32(?), ref: 00D8497B
_strcat.LIBCMT ref: 00D84989
_wcscpy.LIBCMT ref: 00D849A0
WSACleanup.WS2_32 ref: 00D849AE
_wcscpy.LIBCMT ref: 00D849BC

Strings

0.0.0.0, xrefs: 00D84957

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 0942d71c86b12031e0b603fb45b3b2134bdba5d486f28902899a51fcf8c9021e
Instruction ID: ac86f2f975526f097387310c5ce2a535718abb525754373b62d55063e206403b
Opcode Fuzzy Hash: 0942d71c86b12031e0b603fb45b3b2134bdba5d486f28902899a51fcf8c9021e
Instruction Fuzzy Hash: FC11C031904216ABCB30BBA4AC4AEEB77ACDF01720F4541BAF449D6191EF749A858B71

Function 00D85217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00D8521C

Part of subcall function 00D40719: timeGetTime.WINMM(?,75A4B400,00D30FF9), ref: 00D4071D

Sleep.KERNEL32(0000000A), ref: 00D85248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00D8526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00D8528E
SetActiveWindow.USER32 ref: 00D852AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00D852BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00D852DA
Sleep.KERNEL32(000000FA), ref: 00D852E5
IsWindow.USER32 ref: 00D852F1
EndDialog.USER32(00000000), ref: 00D85302

Strings

BUTTON, xrefs: 00D85280

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 27b1edba71a1bd42b882b81cabde618b9922881d9a25d799ef010c6e5f2dc172
Instruction ID: 9f3d11523b55fd3beca1af773334d605b23847edee4ec2d025164cb17efd4c73
Opcode Fuzzy Hash: 27b1edba71a1bd42b882b81cabde618b9922881d9a25d799ef010c6e5f2dc172
Instruction Fuzzy Hash: 9E21A170204B44AFE7007BA0FDC8B3A3BA9EB56386F081464F101C93B1CBA19C019B75

Function 00D8D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

CoInitialize.OLE32(00000000), ref: 00D8D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00D8D8E8
SHGetDesktopFolder.SHELL32(?), ref: 00D8D8FC
CoCreateInstance.COMBASE(00DB2D7C,00000000,00000001,00DDA89C,?), ref: 00D8D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00D8D9B7
CoTaskMemFree.COMBASE(?), ref: 00D8DA0F
_memset.LIBCMT ref: 00D8DA4C
SHBrowseForFolderW.SHELL32(?), ref: 00D8DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00D8DAAB
CoTaskMemFree.COMBASE(00000000), ref: 00D8DAB2
CoTaskMemFree.COMBASE(00000000), ref: 00D8DAE9
CoUninitialize.COMBASE ref: 00D8DAEB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: f69247cd4de838ff3dd4e337d0566f2f86655a512aae370180de04ef57b63315
Instruction ID: 9b0a0346a4fdebf690fb5c4ea56e79002fb390365b5aa29e3ac7bcf4e013546d
Opcode Fuzzy Hash: f69247cd4de838ff3dd4e337d0566f2f86655a512aae370180de04ef57b63315
Instruction Fuzzy Hash: 88B1ED75A00119AFDB04EFA4D884DAEBBF9EF49314F1484A9F509EB291DB30ED45CB60

Function 00D8052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00D805A7
SetKeyboardState.USER32(?), ref: 00D80612
GetAsyncKeyState.USER32(000000A0), ref: 00D80632
GetKeyState.USER32(000000A0), ref: 00D80649
GetAsyncKeyState.USER32(000000A1), ref: 00D80678
GetKeyState.USER32(000000A1), ref: 00D80689
GetAsyncKeyState.USER32(00000011), ref: 00D806B5
GetKeyState.USER32(00000011), ref: 00D806C3
GetAsyncKeyState.USER32(00000012), ref: 00D806EC
GetKeyState.USER32(00000012), ref: 00D806FA
GetAsyncKeyState.USER32(0000005B), ref: 00D80723
GetKeyState.USER32(0000005B), ref: 00D80731

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 42823b12d987daa6f2759724bf66f03a81bd65d44ad9fba6e137a600e6572651
Instruction ID: 1b17cb43ecee7a6c8639d3431fe0a6187761b2b36734d109d7abe1066dadaff2
Opcode Fuzzy Hash: 42823b12d987daa6f2759724bf66f03a81bd65d44ad9fba6e137a600e6572651
Instruction Fuzzy Hash: C951DA74A047882AFB75FBB088557EABFB89F01380F0C45D9D5C2565C2EA649B4CCB71

Function 00D7C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00D7C746
GetWindowRect.USER32(00000000,?), ref: 00D7C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00D7C7B6
GetDlgItem.USER32(?,00000002), ref: 00D7C7C1
GetWindowRect.USER32(00000000,?), ref: 00D7C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00D7C827
GetDlgItem.USER32(?,000003E9), ref: 00D7C835
GetWindowRect.USER32(00000000,?), ref: 00D7C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00D7C889
GetDlgItem.USER32(?,000003EA), ref: 00D7C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00D7C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00D7C8C1

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 7f14fca1c53aa5e53d29f0960a637eacb20cdb48fea6eb17418216384366b10f
Instruction ID: 8e537abf0bcb7a2fd75d7f99f7a556f411a63e0ea0b1dfad373ff11d4aa578fa
Opcode Fuzzy Hash: 7f14fca1c53aa5e53d29f0960a637eacb20cdb48fea6eb17418216384366b10f
Instruction Fuzzy Hash: F0514471B10305AFDB18CFA9DD85AAEBBB6EB89311F18816DF51AD7290D7709D00CB60

Function 00D221A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00D225DB: GetWindowLongW.USER32(?,000000EB), ref: 00D225EC

GetSysColor.USER32(0000000F), ref: 00D221D3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 3adb11b8897382bbf6da1c5cf5059ec75374743023274bad82a2d0cef77d44c6
Instruction ID: b6558102ce8aadef6af03811123676e8c957641a6a7a8bb62515baf0c5a68175
Opcode Fuzzy Hash: 3adb11b8897382bbf6da1c5cf5059ec75374743023274bad82a2d0cef77d44c6
Instruction Fuzzy Hash: E8419F31000750EEDB255F68EC88BB93B65EF16325F1843A5FDA59A2E2C7328C42DB35

Function 00D8AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00DAF910), ref: 00D8AB76
GetDriveTypeW.KERNEL32(00000061,00DDA620,00000061), ref: 00D8AC40
_wcscpy.LIBCMT ref: 00D8AC6A

Strings

removable, xrefs: 00D8ABA8
fixed, xrefs: 00D8ABBE
ramdisk, xrefs: 00D8ABEA
network, xrefs: 00D8ABD4
cdrom, xrefs: 00D8AB92
all, xrefs: 00D8AB7C
unknown, xrefs: 00D8AC01

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 080a503b1b27150ba25fae1d6a3e71634348ac444399abd8ff389a9a66bdc1b3
Instruction ID: ccfeb12ee59127b9550e5abf539b4cba7282110e2a5c74dbca8392b08587316c
Opcode Fuzzy Hash: 080a503b1b27150ba25fae1d6a3e71634348ac444399abd8ff389a9a66bdc1b3
Instruction Fuzzy Hash: 91518D305083119BD710EF18D891EAAB7A5EF94304F54882EF596972A2EB31ED49CB73

Function 00D29997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00D299C2
__swprintf.LIBCMT ref: 00D29A0C
__i64tow.LIBCMT ref: 00D5FA0F

Strings

True, xrefs: 00D5F9D0
%.15g, xrefs: 00D29A06
False, xrefs: 00D5F9D7
0x%p, xrefs: 00D5F9F1

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 0fa5c3b1ccb9a9a315bf88f938af4689acaa13d9819271efe262143ac7a73146
Instruction ID: 45a508c1656e027ddbdde78daa286f2b35d3c43f894a7a4b603b5d3adae154f3
Opcode Fuzzy Hash: 0fa5c3b1ccb9a9a315bf88f938af4689acaa13d9819271efe262143ac7a73146
Instruction Fuzzy Hash: 2C410771504615AFDF24DB38E842E7AB3E8EF48314F24446FE989DB281EA31D9458F31

Function 00DA73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA73D9
CreateMenu.USER32 ref: 00DA73F4
SetMenu.USER32(?,00000000), ref: 00DA7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DA7490
IsMenu.USER32(?), ref: 00DA74A6
CreatePopupMenu.USER32 ref: 00DA74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00DA74DD
DrawMenuBar.USER32 ref: 00DA74E5

Strings

F, xrefs: 00DA74D1
0, xrefs: 00DA73CF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 17dba65fde358b821d7d0c9dbae547a1523c50ae3e32f183d238abd4a3c20448
Instruction ID: f2dc89d0971ad92b4105a88528e7f61f648b7647dcb6e09b679181e0a8a6681e
Opcode Fuzzy Hash: 17dba65fde358b821d7d0c9dbae547a1523c50ae3e32f183d238abd4a3c20448
Instruction Fuzzy Hash: 13415675A01309EFDB20DFA4DD84AAABBF9FF4A340F184068F955973A0D771A910CB60

Function 00DA772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00DA77CD
CreateCompatibleDC.GDI32(00000000), ref: 00DA77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00DA77E7
SelectObject.GDI32(00000000,00000000), ref: 00DA77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00DA77FA
DeleteDC.GDI32(00000000), ref: 00DA7803
GetWindowLongW.USER32(?,000000EC), ref: 00DA780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00DA7821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00DA782D

Strings

static, xrefs: 00DA7765

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 145ad52d917376bd6de3b225ece32e21ae50925b5982f83f5fe307b34cf20512
Instruction ID: 1bb14f35ab50f2b8b111e7ba677b4da31929e91a6ccd0f50afb527c018082021
Opcode Fuzzy Hash: 145ad52d917376bd6de3b225ece32e21ae50925b5982f83f5fe307b34cf20512
Instruction Fuzzy Hash: 7E318832104215ABDF129FB4DC08FEB3B69EF0A361F150225FA55E62A0C735D821DBB4

Function 00D47040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D4707B

Part of subcall function 00D48D68: __getptd_noexit.LIBCMT ref: 00D48D68

__gmtime64_s.LIBCMT ref: 00D47114
__gmtime64_s.LIBCMT ref: 00D4714A
__gmtime64_s.LIBCMT ref: 00D47167
__allrem.LIBCMT ref: 00D471BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D471D9
__allrem.LIBCMT ref: 00D471F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D4720E
__allrem.LIBCMT ref: 00D47225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D47243
__invoke_watson.LIBCMT ref: 00D472B4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: ff85a4f54db2dbad9db759c58dd13cff8a64dcb36804dc7eff4251d2ccd23de5
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 8871D771A05716ABDB149E79CC82B6AB3B8FF14364F18423AF914E7281E770D94487F4

Function 00D82A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D82A31
GetMenuItemInfoW.USER32(00DE6890,000000FF,00000000,00000030), ref: 00D82A92
SetMenuItemInfoW.USER32(00DE6890,00000004,00000000,00000030), ref: 00D82AC8
Sleep.KERNEL32(000001F4), ref: 00D82ADA
GetMenuItemCount.USER32(?), ref: 00D82B1E
GetMenuItemID.USER32(?,00000000), ref: 00D82B3A
GetMenuItemID.USER32(?,-00000001), ref: 00D82B64
GetMenuItemID.USER32(?,?), ref: 00D82BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D82BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D82C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D82C24

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: deff456a9387a128e63ed4fea374b8f4c12b8c52af7f4ab1f85663eb354505cf
Instruction ID: 9aac90392797968d88979d8cece2049caae47f77406e3751b77bea0a036abfc7
Opcode Fuzzy Hash: deff456a9387a128e63ed4fea374b8f4c12b8c52af7f4ab1f85663eb354505cf
Instruction Fuzzy Hash: 37617DB0901349AFDB21EFA4D888EBEBBB9EF41348F180559E88197251D731AE45DB31

Function 00DA7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00DA7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00DA7217
GetWindowLongW.USER32(?,000000F0), ref: 00DA723B
_memset.LIBCMT ref: 00DA724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00DA725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00DA72D6

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 06b5d96153972ac501c59ab270e8477564e4b599287d494e7e40c4dcd4104f46
Instruction ID: 8b7128ecdaf69b54a62362360e097c346db59bde21e8123f732298adc59e3a95
Opcode Fuzzy Hash: 06b5d96153972ac501c59ab270e8477564e4b599287d494e7e40c4dcd4104f46
Instruction Fuzzy Hash: CE613875A00248AFDB10DFA4CC81EEE77F8EB0A710F144159FA15EB2A1D770AA45DBA0

Function 00D7710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00D77135
SafeArrayAllocData.OLEAUT32(?), ref: 00D7718E
VariantInit.OLEAUT32(?), ref: 00D771A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00D771C0
VariantCopy.OLEAUT32(?,?), ref: 00D77213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00D77227
VariantClear.OLEAUT32(?), ref: 00D7723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00D77249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D77252
VariantClear.OLEAUT32(?), ref: 00D77264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D7726F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 934cb41bc1d907805334fd211d3220c01be77bb8c5d251bf15a7ea44223bd746
Instruction ID: 98eccbec0a11972e422c2c255910d94972e11add9d65b67106b62d60419bb4f9
Opcode Fuzzy Hash: 934cb41bc1d907805334fd211d3220c01be77bb8c5d251bf15a7ea44223bd746
Instruction Fuzzy Hash: 09413D35A04219AFCB00DFA8D8449AEBBB9FF49354F00C469F959E7361DB70A945CBB0

Function 00D99428 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D9947C
VariantInit.OLEAUT32(?), ref: 00D9954D
VariantInit.OLEAUT32(?), ref: 00D9964E
VariantClear.OLEAUT32(?), ref: 00D99658
VariantClear.OLEAUT32(?), ref: 00D996B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00D99631
_NewEnum, xrefs: 00D99436
get__NewEnum, xrefs: 00D99454
Null Object assignment in FOR..IN loop, xrefs: 00D994DD, 00D9960B, 00D996C3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 2862541840-1765764032
Opcode ID: 626086c40956905a2c40d7ae19cf45fde921c8834291a8dcd69409004278c4d9
Instruction ID: 6d1f1a28e3178b616041ef163bb2216f8337a348d3ccc243bd6c2ede04e4db85
Opcode Fuzzy Hash: 626086c40956905a2c40d7ae19cf45fde921c8834291a8dcd69409004278c4d9
Instruction Fuzzy Hash: 8B919D71A00219ABDF24DFA9C854FAEBBB8EF45314F14855EF515AB280D7709905CFB0

Function 00D95A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00D95AA6
inet_addr.WS2_32(?), ref: 00D95AEB
gethostbyname.WS2_32(?), ref: 00D95AF7
IcmpCreateFile.IPHLPAPI ref: 00D95B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00D95B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00D95B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00D95C00
WSACleanup.WS2_32 ref: 00D95C06

Strings

Ping, xrefs: 00D95B29

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 5ebc68a16029de97776b05fc0a8503081bbde09c92c1120c38d07f016239cf93
Instruction ID: d6448574854cbbb9911fe0bdff9aee484ca4f7b0ddff1109e5bae3023d3de01a
Opcode Fuzzy Hash: 5ebc68a16029de97776b05fc0a8503081bbde09c92c1120c38d07f016239cf93
Instruction Fuzzy Hash: 0651AF316047009FDB11EF24EC45B2AB7E0EF48314F08896AF999DB2A5DB70E800CB75

Function 00D362F2 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D363A8
_memmove.LIBCMT ref: 00D36446
_memset.LIBCMT ref: 00D3646A

Strings

failed to get memory, xrefs: 00D36488
internal error: missing capturing bracket, xrefs: 00D71158
ERCP, xrefs: 00D36313
argument not compiled in 16 bit mode, xrefs: 00D71150
argument is not a compiled regular expression, xrefs: 00D71160
internal error: opcode not recognized, xrefs: 00D3647D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP$argument is not a compiled regular expression$argument not compiled in 16 bit mode$failed to get memory$internal error: missing capturing bracket$internal error: opcode not recognized
API String ID: 2532777613-264027815
Opcode ID: 4d1f92301beb08807a57882b591bbdb8eb4a8c5f9121ab527f241bfc0f46b85f
Instruction ID: 7ef3c4df03a1e0ddd83307f0d2678263830fd19b688462ee14cb4306cd1ff80a
Opcode Fuzzy Hash: 4d1f92301beb08807a57882b591bbdb8eb4a8c5f9121ab527f241bfc0f46b85f
Instruction Fuzzy Hash: 6B518171904709EBDB24CF65C881BAABBF4EF04714F24C56EEA8ACB241E771D584CB60

Function 00D8B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D8B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00D8B7B1
GetLastError.KERNEL32 ref: 00D8B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00D8B828

Strings

READY, xrefs: 00D8B801
UNKNOWN, xrefs: 00D8B7E0
READONLY, xrefs: 00D8B7F3
INVALID, xrefs: 00D8B7FA
NOTREADY, xrefs: 00D8B7E7

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 9b12cd22957c2cfcf4a1ebb6a0e39ebf86360471346200c22bf50e1246a5be80
Instruction ID: 80101cdc893c5c557a77877d67b39c2f129627fec72df333a6f1073e4ea83172
Opcode Fuzzy Hash: 9b12cd22957c2cfcf4a1ebb6a0e39ebf86360471346200c22bf50e1246a5be80
Instruction Fuzzy Hash: 21318035A00305AFDB10FF68DC85ABEBBB8EF55724F14806AE801D7291DB719946CB71

Function 00D79471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00D7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00D7B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00D794F6
GetDlgCtrlID.USER32 ref: 00D79501
GetParent.USER32 ref: 00D7951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D79520
GetDlgCtrlID.USER32(?), ref: 00D79529
GetParent.USER32(?), ref: 00D79545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00D79548

Strings

ComboBox, xrefs: 00D7947E
ListBox, xrefs: 00D794B3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 29b987963741dfc3c2b3a292527fc0a035c85e3c8c32889e2735449eda8dd4e0
Instruction ID: b56f574a8e1b187fd97005f3b540205a5c921443709465e46d7d45600438a8ae
Opcode Fuzzy Hash: 29b987963741dfc3c2b3a292527fc0a035c85e3c8c32889e2735449eda8dd4e0
Instruction Fuzzy Hash: C1212470A00204BBCF00ABA0DC95EFEBB75EF45310F14416AB561932E1EB359818CB30

Function 00D7955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00D7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00D7B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00D795DF
GetDlgCtrlID.USER32 ref: 00D795EA
GetParent.USER32 ref: 00D79606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D79609
GetDlgCtrlID.USER32(?), ref: 00D79612
GetParent.USER32(?), ref: 00D7962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00D79631

Strings

ComboBox, xrefs: 00D79569
ListBox, xrefs: 00D7959E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: e5f636a0a4d143406c45ad1b22184c86e8b55b370f06e84b6b7b390e654aa7f6
Instruction ID: f06e3a1902c3c870d18bcb83a8eca4dc0f729a394114235b1d86551ca0595263
Opcode Fuzzy Hash: e5f636a0a4d143406c45ad1b22184c86e8b55b370f06e84b6b7b390e654aa7f6
Instruction Fuzzy Hash: E621D071A00204BBDF00ABA0DC95EFEBB78EF59300F144166F961972A5EB7599199B30

Function 00D79645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00D79651
GetClassNameW.USER32(00000000,?,00000100), ref: 00D79666
_wcscmp.LIBCMT ref: 00D79678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00D796F3

Strings

SHELLDLL_DefView, xrefs: 00D79672
smallicons, xrefs: 00D796BB
largeicons, xrefs: 00D79687
details, xrefs: 00D796A1
list, xrefs: 00D796D5

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 6a5479f5d5596f5d32a4bd048ad8d2e6f3534f0c21a9ac92c360c7a2ba7cbfb0
Instruction ID: 3ef9a066839bd195436337209cb8a0d89b4b5c3f2fbea7f93b727100b5569cb2
Opcode Fuzzy Hash: 6a5479f5d5596f5d32a4bd048ad8d2e6f3534f0c21a9ac92c360c7a2ba7cbfb0
Instruction Fuzzy Hash: EB112C77248307BFFA052624EC27DAAF79CDB05360F244267FA04E51D1FE62A9154678

Function 00D98BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D98BEC
CoInitialize.OLE32(00000000), ref: 00D98C19
CoUninitialize.COMBASE ref: 00D98C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00D98D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00D98E50
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002,?,00000001,00DB2C0C), ref: 00D98E84
CoGetObject.OLE32(?,00000000,00DB2C0C,?), ref: 00D98EA7
SetErrorMode.KERNEL32(00000000), ref: 00D98EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00D98F3A
VariantClear.OLEAUT32(?), ref: 00D98F4A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 0b21488004d3c3130effff8b9a928c9cb8065ef3ce26bfce20256d3d725eae5a
Instruction ID: f29e019cb38da64aa7149f2b5cf583c96a394961f40cc606f6097087d67eae9f
Opcode Fuzzy Hash: 0b21488004d3c3130effff8b9a928c9cb8065ef3ce26bfce20256d3d725eae5a
Instruction Fuzzy Hash: 84C102B1208305AFDB00DF64C89492AB7E9FF8A748F04496DF58ADB251DB71ED05CB62

Function 00D84189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00D8419D
__swprintf.LIBCMT ref: 00D841AA

Part of subcall function 00D438D8: __woutput_l.LIBCMT ref: 00D43931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00D841D4
LoadResource.KERNEL32(?,00000000), ref: 00D841E0
LockResource.KERNEL32(00000000), ref: 00D841ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00D8420D
LoadResource.KERNEL32(?,00000000), ref: 00D8421F
SizeofResource.KERNEL32(?,00000000), ref: 00D8422E
LockResource.KERNEL32(?), ref: 00D8423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00D8429B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 7b32c847a8d50d7dc72a0e4b0cbdf54d4c87bbac6e1aee6447e0724a181b9afe
Instruction ID: a0e71d3d76187caadaabea4f669eb1417ba8c290b44eb015d2b5a60b7b73381a
Opcode Fuzzy Hash: 7b32c847a8d50d7dc72a0e4b0cbdf54d4c87bbac6e1aee6447e0724a181b9afe
Instruction Fuzzy Hash: A331AEB160531AABDB11AFA0EC88BBF7BACEF09301F044565F801D6250D734DA518BB8

Function 00D816DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D81700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00D80778,?,00000001), ref: 00D81714
GetWindowThreadProcessId.USER32(00000000), ref: 00D8171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D80778,?,00000001), ref: 00D8172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D8173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D80778,?,00000001), ref: 00D81755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D80778,?,00000001), ref: 00D81767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00D80778,?,00000001), ref: 00D817AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00D80778,?,00000001), ref: 00D817C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00D80778,?,00000001), ref: 00D817CC

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 3156e7ec54583df8a1238d604ac09c993c4bf8e80ec0e41fafbee5fa87ea52d2
Instruction ID: db846a63e7dd4eb754cfd15ad9df7dd5c26b3515e58012c8140ef26e3836102e
Opcode Fuzzy Hash: 3156e7ec54583df8a1238d604ac09c993c4bf8e80ec0e41fafbee5fa87ea52d2
Instruction Fuzzy Hash: 40318979604304FBEB61BF64EC88F697BADAF56711F184069F804CA3A0D7B49D468B70

Function 00D7A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00D7AA64), ref: 00D7A9A2

Strings

NAME, xrefs: 00D7A7D4
CLASSNN, xrefs: 00D7A744
CLASS, xrefs: 00D7A721
TEXT, xrefs: 00D7A8D9
REGEXPCLASS, xrefs: 00D7A767
INSTANCE, xrefs: 00D7A8B0

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: e415c9e6cd7403ff3f31606fb8d617352c0048077a4492ae1d845dbb42a957b4
Instruction ID: c00110d39c08fe285074c5b534b79957d71d331a5a19055db06167d246881c23
Opcode Fuzzy Hash: e415c9e6cd7403ff3f31606fb8d617352c0048077a4492ae1d845dbb42a957b4
Instruction Fuzzy Hash: 49916F30A00606ABDB18DF68C481BEDFB64FF44314F54C119E99EA7651EB30AA59CFB1

Function 00D22E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00D22EAE

Part of subcall function 00D21DB3: GetClientRect.USER32(?,?), ref: 00D21DDC
Part of subcall function 00D21DB3: GetWindowRect.USER32(?,?), ref: 00D21E1D
Part of subcall function 00D21DB3: ScreenToClient.USER32(?,?), ref: 00D21E45

GetDC.USER32 ref: 00D5CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00D5CF95
SelectObject.GDI32(00000000,00000000), ref: 00D5CFA3
SelectObject.GDI32(00000000,00000000), ref: 00D5CFB8
ReleaseDC.USER32(?,00000000), ref: 00D5CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00D5D04B

Strings

U, xrefs: 00D5CF20

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 0cc3ccc99c4d5d1c6930d8af7a7ab2a642d5a99e1d3e405cc25987364f9b1353
Instruction ID: 22ab7b97ec287ef022afd3f190d82bad568f5acf9a7983b15a3973a16dfb31e1
Opcode Fuzzy Hash: 0cc3ccc99c4d5d1c6930d8af7a7ab2a642d5a99e1d3e405cc25987364f9b1353
Instruction Fuzzy Hash: B571BF30400205EFCF219F68D880ABA7BB6FF59356F184269FD959A2A5C731CC45DB70

Function 00DA6FEF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00DA7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00DA70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00DA70C1
_wcscat.LIBCMT ref: 00DA711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00DA7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00DA7161

Strings

SysListView32, xrefs: 00DA7065
-----, xrefs: 00DA7114

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: -----$SysListView32
API String ID: 307300125-3975388722
Opcode ID: 1bd86a8a978cd56979d6b12b40b6f8de96c572b84b661daa71e83a32de1064c0
Instruction ID: 6e0fb31ebc227f463bb1adeddefba4f37ef6ca6897613f0679874aa6ef07bf08
Opcode Fuzzy Hash: 1bd86a8a978cd56979d6b12b40b6f8de96c572b84b661daa71e83a32de1064c0
Instruction Fuzzy Hash: 4141A071A04308AFDB219FA4CC85BEE77F8EF09354F14086AF984E7292D6719D848B74

Function 00D98F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00DAF910), ref: 00D9903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00DAF910), ref: 00D99071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00D991EB
SysFreeString.OLEAUT32(?), ref: 00D99215

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 589ba37dea988972215f602e2b97d4506df8df61c278aca5e370b426a043bebc
Instruction ID: 207964d12c82ef87a831b0d3a454010bde9fa3797d27a31d10b7b62f6965c4f0
Opcode Fuzzy Hash: 589ba37dea988972215f602e2b97d4506df8df61c278aca5e370b426a043bebc
Instruction Fuzzy Hash: 19F14C71A00209EFDF04DF98C898EAEB7B9FF49315F148099F515AB290DB31AE45CB60

Function 00D9F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D9F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D9FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D9FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D9FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D9FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D9FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00D9FD90
CloseHandle.KERNEL32(?), ref: 00D9FDBF
CloseHandle.KERNEL32(?), ref: 00D9FE36

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: e6a4efaaa600118607b4cc5edfc3d2921e61fd13d05f1f6e53074ba6834d3e7c
Instruction ID: a5fb5556fbc710781d30cc662bd9f823df07132199c7137d3c65dea6e9083b25
Opcode Fuzzy Hash: e6a4efaaa600118607b4cc5edfc3d2921e61fd13d05f1f6e53074ba6834d3e7c
Instruction Fuzzy Hash: 0CE1A031604341DFCB14EF24D891A6ABBE1EF85354F18896DF8999B2A2DB31DC44CB72

Function 00D2201B Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D21B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D22036,?,00000000,?,?,?,?,00D216CB,00000000,?), ref: 00D21B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00D220D3
KillTimer.USER32(-00000001,?,?,?,?,00D216CB,00000000,?,?,00D21AE2,?,?), ref: 00D2216E
DestroyAcceleratorTable.USER32(00000000), ref: 00D5BEF6
DeleteObject.GDI32(00000000), ref: 00D5BF6C

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: 31df378df6df0fb0263dc3db1d5868e0d6bce698d327e6e566a5aad297111177
Instruction ID: fc2a8dca3ffbd5605436611d41405a01620e79c3bb91736ee42d924f240c2acd
Opcode Fuzzy Hash: 31df378df6df0fb0263dc3db1d5868e0d6bce698d327e6e566a5aad297111177
Instruction Fuzzy Hash: 02616C31100760EFCB25AF14ED88B3577B1FF6131AF184569E9828AAA0C775E895DFB0

Function 00D84F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D848AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D838D3,?), ref: 00D848C7

Part of subcall function 00D848AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00D838D3,?), ref: 00D848E0

Part of subcall function 00D84CD3: GetFileAttributesW.KERNEL32(?,00D83947), ref: 00D84CD4

lstrcmpiW.KERNEL32(?,?), ref: 00D84FE2
_wcscmp.LIBCMT ref: 00D84FFC
MoveFileW.KERNEL32(?,?), ref: 00D85017

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 8ee44a4ca615d6943eea6b84f5c909d84851f32a5ac52e8b32c8f1b97536eb6a
Instruction ID: 05a8edd53877fceeb3a5af2f62a048c13ca1436be7bf60542b7433a3bce8eb7b
Opcode Fuzzy Hash: 8ee44a4ca615d6943eea6b84f5c909d84851f32a5ac52e8b32c8f1b97536eb6a
Instruction Fuzzy Hash: A05152B20087859BC724EBA0D8819DFB3ECEF85341F44492EB289D3151EF74A68C8776

Function 00DA88B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00DA896E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: b8610e27ab2a5a5b21c1c488e34f191d395f4212706c75ba694462ba2fb05199
Instruction ID: 0e0b004761860296ac387c60f14c846c01733784413f9049487211b25feed092
Opcode Fuzzy Hash: b8610e27ab2a5a5b21c1c488e34f191d395f4212706c75ba694462ba2fb05199
Instruction Fuzzy Hash: B051B330A00204BFDF209F24DC89B6A7B65FB06354F644512FD51E62A1DF75E980ABB1

Function 00D22B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00D5C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D5C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00D5C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00D5C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00D5C5C0
DestroyCursor.USER32(00000000), ref: 00D5C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00D5C5EC
DestroyCursor.USER32(?), ref: 00D5C5FB

Part of subcall function 00DAA71E: DeleteObject.GDI32(00000000), ref: 00DAA757

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2975913752-0
Opcode ID: ec13dd1296582352942999b9dfc161a0e900d0984bca44b18d5dbd22a6b6412e
Instruction ID: 02eaf3c87ededa60079ad2a2b67b9c24dde5cedf3a3ef1ce080aebc60c80ff2b
Opcode Fuzzy Hash: ec13dd1296582352942999b9dfc161a0e900d0984bca44b18d5dbd22a6b6412e
Instruction Fuzzy Hash: 02514670610309AFDB20DF64DC85BAA3BB5EB69355F140528F942E72A0EB70ED90DB70

Function 00D78E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00D78A84,00000B00,?,?), ref: 00D78E0C
RtlAllocateHeap.NTDLL(00000000,?,00D78A84), ref: 00D78E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00D78A84,00000B00,?,?), ref: 00D78E28
GetCurrentProcess.KERNEL32(?,00000000,?,00D78A84,00000B00,?,?), ref: 00D78E30
DuplicateHandle.KERNEL32(00000000,?,00D78A84,00000B00,?,?), ref: 00D78E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00D78A84,00000B00,?,?), ref: 00D78E43
GetCurrentProcess.KERNEL32(00D78A84,00000000,?,00D78A84,00000B00,?,?), ref: 00D78E4B
DuplicateHandle.KERNEL32(00000000,?,00D78A84,00000B00,?,?), ref: 00D78E4E
CreateThread.KERNEL32(00000000,00000000,00D78E74,00000000,00000000,00000000), ref: 00D78E68

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
String ID:
API String ID: 1422014791-0
Opcode ID: 0803fdc6f9cfe9f8d44565bac8a86138613e3b359c06d311d5fea2d3a1aae570
Instruction ID: b573cbceeae3ed12a85e97dfdb5174a2fbb61ab6addbf3cdb8e2c01d242ef835
Opcode Fuzzy Hash: 0803fdc6f9cfe9f8d44565bac8a86138613e3b359c06d311d5fea2d3a1aae570
Instruction Fuzzy Hash: 8801BBB5640308FFE760ABA5DC4DF6B3BACEB89711F004461FA05DB2A1DA719800CB30

Function 00D99A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00D77652: CLSIDFromProgID.COMBASE ref: 00D7766F
Part of subcall function 00D77652: ProgIDFromCLSID.COMBASE(?,00000000), ref: 00D7768A
Part of subcall function 00D77652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D7758C,80070057,?,?), ref: 00D77698
Part of subcall function 00D77652: CoTaskMemFree.COMBASE(00000000), ref: 00D776A8

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00D99B1B
_memset.LIBCMT ref: 00D99B28
_memset.LIBCMT ref: 00D99C6B
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000000), ref: 00D99C97
CoTaskMemFree.COMBASE(?), ref: 00D99CA2

Strings

NULL Pointer assignment, xrefs: 00D99CF0

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: d5565263b08ad8e9eb9a72adeba4b768ccf4abf76b2ec85af58f52eb0f2f88b4
Instruction ID: 3c38de6dab17e801e3503a683e5c607056bd9369ab0d43d77a34b14c8b7a2732
Opcode Fuzzy Hash: d5565263b08ad8e9eb9a72adeba4b768ccf4abf76b2ec85af58f52eb0f2f88b4
Instruction Fuzzy Hash: 62910871D00229ABDF20DFA5DC95ADEBBB9EF08710F20415AF519A7281DB719A44CFB0

Function 00D9EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00D83E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00D83EB6
Part of subcall function 00D83E91: Process32FirstW.KERNEL32(00000000,?), ref: 00D83EC4
Part of subcall function 00D83E91: CloseHandle.KERNEL32(00000000), ref: 00D83F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D9ECB8
GetLastError.KERNEL32 ref: 00D9ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D9ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00D9ED77
GetLastError.KERNEL32(00000000), ref: 00D9ED82
CloseHandle.KERNEL32(00000000), ref: 00D9EDB7

Strings

SeDebugPrivilege, xrefs: 00D9ECD6

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4835e53b0559d54566c67afa3a60487f41e02efcde8d40a9a0ba13bfad21e534
Instruction ID: 6ff9ea33c9fdcf866844ef16f1366e902c91d2616f008fb4875e1c9b64881e6a
Opcode Fuzzy Hash: 4835e53b0559d54566c67afa3a60487f41e02efcde8d40a9a0ba13bfad21e534
Instruction Fuzzy Hash: 764189716002109FDB24EF24C896F6EB7A1EF85714F088459F8869B3C2DB75E804CBB2

Function 00D83226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00D832C5

Strings

question, xrefs: 00D8327E
warning, xrefs: 00D832AE
stop, xrefs: 00D83296
info, xrefs: 00D83266
blank, xrefs: 00D83247

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: c63da078d43d659f01f751518c483f5d0035df5609f34df678f10d97ee7703a5
Instruction ID: 175eac66dd3ede0a79019211bf1e0a845902164b09c079d482bd2823602148d1
Opcode Fuzzy Hash: c63da078d43d659f01f751518c483f5d0035df5609f34df678f10d97ee7703a5
Instruction Fuzzy Hash: 02112731248346BFA7056B59DC42E6AB79CDF19B70F20006AF908A62C2E6A59B4147BD

Function 00D84534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00D8454E
LoadStringW.USER32(00000000), ref: 00D84555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00D8456B
LoadStringW.USER32(00000000), ref: 00D84572
_wprintf.LIBCMT ref: 00D84598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D845B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00D84593

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 553948b8c38bfe295b694eba523e2325aa3b4ee5af5fb56c401864450db1be48
Instruction ID: 4f27c23869bd19365d3d02c731bc94d159d55d7875d275d9deaaf07d245a0ef6
Opcode Fuzzy Hash: 553948b8c38bfe295b694eba523e2325aa3b4ee5af5fb56c401864450db1be48
Instruction Fuzzy Hash: 2D014FF2900308BFE750A7E49D89EEB776CD709301F0005E5BB45D2151EA749E858B74

Function 00D22A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00D5C417,00000004,00000000,00000000,00000000), ref: 00D22ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00D5C417,00000004,00000000,00000000,00000000,000000FF), ref: 00D22B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00D5C417,00000004,00000000,00000000,00000000), ref: 00D5C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00D5C417,00000004,00000000,00000000,00000000), ref: 00D5C4D6

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 014ceceecd46c9ee7e418aa0df771477a812597b3b9622276d0b4ecf29781a64
Instruction ID: 5b20efc5a1dcedbe871bfa389446bfa7edb3ccb081bf9e5f44c7320d65f0d40d
Opcode Fuzzy Hash: 014ceceecd46c9ee7e418aa0df771477a812597b3b9622276d0b4ecf29781a64
Instruction Fuzzy Hash: 77410E31218790BECB354B28ECD8B7A7BD2AB76318F1C842DF49786A60C675E845D730

Function 00D87368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00D8737F

Part of subcall function 00D40FF6: std::exception::exception.LIBCMT ref: 00D4102C
Part of subcall function 00D40FF6: __CxxThrowException@8.LIBCMT ref: 00D41041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00D873B6
RtlEnterCriticalSection.NTDLL(?), ref: 00D873D2
_memmove.LIBCMT ref: 00D87420
_memmove.LIBCMT ref: 00D8743D
RtlLeaveCriticalSection.NTDLL(?), ref: 00D8744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00D87461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00D87480

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 36735a7c0fb863e300f965a72fb7888471212110661300714ff0244679b3cfab
Instruction ID: 52a50d96038a08b545a8700675704663aae175420334382eb5843cc23b1c756f
Opcode Fuzzy Hash: 36735a7c0fb863e300f965a72fb7888471212110661300714ff0244679b3cfab
Instruction Fuzzy Hash: 70316F75904205EBDF10EFA8DC85AAE7BB8EF45710B2441B6F904EB246DB30DA54CBB4

Function 00DA6442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00DA645A
GetDC.USER32(00000000), ref: 00DA6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DA646D
ReleaseDC.USER32(00000000,00000000), ref: 00DA6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00DA64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00DA64C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00DA9299,?,?,000000FF,00000000,?,000000FF,?), ref: 00DA6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00DA6520

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 2b0e5b0032db1f4f71e096dfacc9263d8e5088e71e882a52cfc62038899ca181
Instruction ID: b25b32f616718cc0eaefd802d2d949b4660b26b7efa30cfa5bf65596777ecf49
Opcode Fuzzy Hash: 2b0e5b0032db1f4f71e096dfacc9263d8e5088e71e882a52cfc62038899ca181
Instruction Fuzzy Hash: 99316D72601214BFEB118F50CC4AFEA3FA9EF0A761F0840A5FE08DA295D6759C41CB74

Function 00D7C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00D7C087
_memcmp.LIBCMT ref: 00D7C0A9
_memcmp.LIBCMT ref: 00D7C0C1
_memcmp.LIBCMT ref: 00D7C0D4
_memcmp.LIBCMT ref: 00D7C0EE
_memcmp.LIBCMT ref: 00D7C101
_memcmp.LIBCMT ref: 00D7C119
_memcmp.LIBCMT ref: 00D7C134

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b3d51acc6cee2a59149122f578a475efe99b2d694abd55055a529c2384246772
Instruction ID: 6a4a797d668f513f4b85b31b652eb0a854fc7afd9bbfa537ffe257226a2191b2
Opcode Fuzzy Hash: b3d51acc6cee2a59149122f578a475efe99b2d694abd55055a529c2384246772
Instruction Fuzzy Hash: 4C21A166610205FFD614BA21DD42FBF279CEF203A4B489028FD0E96287FB51DE1586F5

Function 00D21424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4ebff8c21d8988badb44b6c808d277625fd109150d2483f5520d9dd57ab62e
Instruction ID: c88bf4b26484f18a34f46548167a1e8e95c2668ed6f92ae305b1e899cb1fbdfa
Opcode Fuzzy Hash: 7b4ebff8c21d8988badb44b6c808d277625fd109150d2483f5520d9dd57ab62e
Instruction Fuzzy Hash: 32717A34900119EFCB049F98D849ABEBB79FFA5324F14C189F915AA251C734AA12CFB4

Function 00DAB60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(010A1F20), ref: 00DAB6A5
IsWindowEnabled.USER32(010A1F20), ref: 00DAB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00DAB795
SendMessageW.USER32(010A1F20,000000B0,?,?), ref: 00DAB7CC
IsDlgButtonChecked.USER32(?,?), ref: 00DAB809
GetWindowLongW.USER32(010A1F20,000000EC), ref: 00DAB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00DAB843

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 7198d2d04e7a8ee4de4611eb75a9bc5a8a73664edfa5fbf26ec0a76e92b9614a
Instruction ID: 33067f23c5525da19e2f0fb25d4754c8cf5d2b3da3bbba8d37b70f9c867d527c
Opcode Fuzzy Hash: 7198d2d04e7a8ee4de4611eb75a9bc5a8a73664edfa5fbf26ec0a76e92b9614a
Instruction Fuzzy Hash: 30717F34600304AFDB249F64C8D4FAA7BA9FF5A360F1C445AE9459B3A2C771A952CB70

Function 00D9F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D9F75C
_memset.LIBCMT ref: 00D9F825
ShellExecuteExW.SHELL32(?), ref: 00D9F86A

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

Part of subcall function 00D3FEC6: _wcscpy.LIBCMT ref: 00D3FEE9

GetProcessId.KERNEL32(00000000), ref: 00D9F8E1
CloseHandle.KERNEL32(00000000), ref: 00D9F910

Strings

@, xrefs: 00D9F839

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 8ecb3d73480f987bfaab517a41a4377be468c504ca5d453f31f6caffbe089265
Instruction ID: 07e1fbb09d2356ae9480f7e6973c2837432fba52331c343fe2e0b564e420da09
Opcode Fuzzy Hash: 8ecb3d73480f987bfaab517a41a4377be468c504ca5d453f31f6caffbe089265
Instruction Fuzzy Hash: D9618BB5A006299FCF14EFA4D4919AEBBF5FF48314F148469E846AB351CB31AD40CBB0

Function 00D8145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00D8149C
GetKeyboardState.USER32(?), ref: 00D814B1
SetKeyboardState.USER32(?), ref: 00D81512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00D81540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00D8155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00D815A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00D815C8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: bbf72af183cdce712ea910b17092d346670250f8b3ace1ce1d094ac9538c5c5e
Instruction ID: df17bf40cb4750b17c954f23e339aad5960c8c09fbafaa1799a325a36ae1f292
Opcode Fuzzy Hash: bbf72af183cdce712ea910b17092d346670250f8b3ace1ce1d094ac9538c5c5e
Instruction Fuzzy Hash: 0751E2A4A047D53EFB3663788C45BBA7FAD6B46304F0C8489E1D5868C2D294EC8ED770

Function 00D81276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00D812B5
GetKeyboardState.USER32(?), ref: 00D812CA
SetKeyboardState.USER32(?), ref: 00D8132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00D81357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00D81374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00D813B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00D813D9

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: ffcf90e1fe2111f1d7eb1c7029aca2be75a26b0399ea5bcd7c3d596c444ecfb8
Instruction ID: 370b35b041a8f960c48461a12ba8279613bbe6201da33ece52548206b392c3e9
Opcode Fuzzy Hash: ffcf90e1fe2111f1d7eb1c7029aca2be75a26b0399ea5bcd7c3d596c444ecfb8
Instruction Fuzzy Hash: 9951E3A49047D57DFB32A7248C45BBABFADAB06300F0C8589E1D4968C2D395EC9ED770

Function 00D8589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00D858AC
_wcsncpy.LIBCMT ref: 00D858E1
_wcsncpy.LIBCMT ref: 00D85913
_wcsncpy.LIBCMT ref: 00D85946
_wcsncpy.LIBCMT ref: 00D85988
_wcsncpy.LIBCMT ref: 00D859C2
_wcsncpy.LIBCMT ref: 00D859F1

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 4969e34ea56289f8dd70a454c29973d104a9d2f2efd38e782443603a322ce22f
Instruction ID: 16c0b3a1ed6adddac35d838892adaa07f87492122d909a0ee525efaca3eba823
Opcode Fuzzy Hash: 4969e34ea56289f8dd70a454c29973d104a9d2f2efd38e782443603a322ce22f
Instruction Fuzzy Hash: 47418FA5C2061876CB10FBB88886ACFB3A8DF04310F508562F518E3121F734E754C7B9

Function 00D838AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D848AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D838D3,?), ref: 00D848C7

Part of subcall function 00D848AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00D838D3,?), ref: 00D848E0

lstrcmpiW.KERNEL32(?,?), ref: 00D838F3
_wcscmp.LIBCMT ref: 00D8390F
MoveFileW.KERNEL32(?,?), ref: 00D83927
_wcscat.LIBCMT ref: 00D8396F
SHFileOperationW.SHELL32(?), ref: 00D839DB

Strings

\*.*, xrefs: 00D83969

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 468873c196bbfd58c4e25b2bf77c3e27dfbb80ee28a3e42aeb25218f5007e558
Instruction ID: 9d5ed3877fcdc3bbc4fc60338412d150e97b850e5ad1889b29d0cd4dfc1e57e4
Opcode Fuzzy Hash: 468873c196bbfd58c4e25b2bf77c3e27dfbb80ee28a3e42aeb25218f5007e558
Instruction Fuzzy Hash: C3416BB25083459AC755FF64C481AEBB7ECEF89740F44192EF48AC3161EA74D688CB72

Function 00DA7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DA75C0
IsMenu.USER32(?), ref: 00DA75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00DA7620
DrawMenuBar.USER32 ref: 00DA7633

Strings

0, xrefs: 00DA750D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 29fa1aaead7bc5be45709ef56e5276330549b446efd464939a462dbcf6ea11ee
Instruction ID: a4072440281fe107fa9b27fd1293f88b1821f10c2fe0065d936cb61f2de01cbe
Opcode Fuzzy Hash: 29fa1aaead7bc5be45709ef56e5276330549b446efd464939a462dbcf6ea11ee
Instruction Fuzzy Hash: F0414975A04608EFDB20DF54D884E9ABBF8FB0A354F088169E9559B390D734ED50CFA0

Function 00DA122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00DA125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DA1286
FreeLibrary.KERNEL32(00000000), ref: 00DA133D

Part of subcall function 00DA122D: RegCloseKey.ADVAPI32(?), ref: 00DA12A3
Part of subcall function 00DA122D: FreeLibrary.KERNEL32(?), ref: 00DA12F5
Part of subcall function 00DA122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00DA1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00DA12E0

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 4263ef0f6b6d9ca7d3795de6c3d997fb08ae08bf8070846069bec1159a26adea
Instruction ID: b62043776324cb5faaf1eabe0841c18f3e45732bf439b1d7effd2c0907f9888d
Opcode Fuzzy Hash: 4263ef0f6b6d9ca7d3795de6c3d997fb08ae08bf8070846069bec1159a26adea
Instruction Fuzzy Hash: 48311AB5901219BFDB149FD0DC89AFEB7BCEF0A300F0401A9E541E2251EB749E459AB8

Function 00DA653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00DA655B
GetWindowLongW.USER32(010A1F20,000000F0), ref: 00DA658E
GetWindowLongW.USER32(010A1F20,000000F0), ref: 00DA65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00DA65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00DA661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00DA6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00DA664A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 213acf5d9187e76db746889513be694898d31cfd4cfcd314d236b789e215b9ba
Instruction ID: 2669d8af14196b002232270c6bb5581a013065f173f54e846bbecb8cd4485f12
Opcode Fuzzy Hash: 213acf5d9187e76db746889513be694898d31cfd4cfcd314d236b789e215b9ba
Instruction Fuzzy Hash: B631DD31A44290EFDB21DF68DC89F553BE1AB5A750F1D01A8F511CB2B6CB61E8409BA1

Function 00D96486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D980A0: inet_addr.WS2_32(00000000), ref: 00D980CB

socket.WS2_32(00000002,00000001,00000006), ref: 00D964D9
WSAGetLastError.WS2_32(00000000), ref: 00D964E8
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00D96521
connect.WSOCK32(00000000,?,00000010), ref: 00D9652A
WSAGetLastError.WS2_32 ref: 00D96534
closesocket.WS2_32(00000000), ref: 00D9655D
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00D96576

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 6550646acc86b1ff7c9377cd414271641e0b6323fe94ae0a89d666bc59785e1e
Instruction ID: fccf4a8c4991f0705b2c106b76a2f21a2027d7a306f1b60c8593eddb823a2691
Opcode Fuzzy Hash: 6550646acc86b1ff7c9377cd414271641e0b6323fe94ae0a89d666bc59785e1e
Instruction Fuzzy Hash: 3231AD71600218ABDF10AFA4DC85BBE7BA9EF45724F048069F949E7291DB74ED04CBB1

Function 00D7E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D7E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D7E120
SysAllocString.OLEAUT32(00000000), ref: 00D7E123
SysAllocString.OLEAUT32 ref: 00D7E144
SysFreeString.OLEAUT32 ref: 00D7E14D
StringFromGUID2.COMBASE(?,?,00000028), ref: 00D7E167
SysAllocString.OLEAUT32(?), ref: 00D7E175

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: be9f662f31b71bf538c6b0d8e4f02a5515fe024d3f87945aa4521d9ac48cd4da
Instruction ID: 8bb10af02dd57468f15edb8ada57a24fa4113b56ff4548d7ff5b9564e6caed77
Opcode Fuzzy Hash: be9f662f31b71bf538c6b0d8e4f02a5515fe024d3f87945aa4521d9ac48cd4da
Instruction Fuzzy Hash: 42216035604218AF9B109FA8DC89CAB77ACEB0D760B5481A5FD59CB2A0EA70DC418B74

Function 00DA783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D21D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D21D73
Part of subcall function 00D21D35: GetStockObject.GDI32(00000011), ref: 00D21D87
Part of subcall function 00D21D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D21D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00DA78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00DA78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00DA78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00DA78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00DA78D4

Strings

Msctls_Progress32, xrefs: 00DA7872

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 669a00ae9cfedcd52e9d338440405c1b6bdda95afc2bab20df41d134aeb9b3b2
Instruction ID: 507056dfda9ed6138f282323f4f70a5b59a655d11b00c885d7ce2c78a96367a3
Opcode Fuzzy Hash: 669a00ae9cfedcd52e9d338440405c1b6bdda95afc2bab20df41d134aeb9b3b2
Instruction Fuzzy Hash: D61190B2110219BFEF159F60CC85EE77F6DEF097A8F014115BA04A6190C7729C21DBB0

Function 00D441C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize), ref: 00D441E3
GetProcAddress.KERNEL32(00000000), ref: 00D441EA
RtlEncodePointer.NTDLL(00000000), ref: 00D441F6
RtlDecodePointer.NTDLL(00000001), ref: 00D44213

Strings

RoInitialize, xrefs: 00D441D2
combase.dll, xrefs: 00D441DE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 7f625168f8dda4131a5ee11f1e3a3e8914ce8eb72c66f74d5409e918f4ac3e87
Instruction ID: 332ce06593e335e55bc7a89019078db1c7ac2079a3f104868f045bfc0f56593d
Opcode Fuzzy Hash: 7f625168f8dda4131a5ee11f1e3a3e8914ce8eb72c66f74d5409e918f4ac3e87
Instruction Fuzzy Hash: 41E01AB1A90340AFEF207BB1EC89B543AA4BB62703F504864F552D92A0DBB540D59F34

Function 00D4429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00D441B8), ref: 00D442B8
GetProcAddress.KERNEL32(00000000), ref: 00D442BF
RtlEncodePointer.NTDLL(00000000), ref: 00D442CA
RtlDecodePointer.NTDLL(00D441B8), ref: 00D442E5

Strings

RoUninitialize, xrefs: 00D442A7
combase.dll, xrefs: 00D442B3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: da64ad9d5b8081a97fa8a3f3b8fe1279e63052f2b319d308db93d255e1c348e0
Instruction ID: 49e24c1f5c36300c9f025d3b0d23dd8293ae63081911c98ab5ac17e09ba4954d
Opcode Fuzzy Hash: da64ad9d5b8081a97fa8a3f3b8fe1279e63052f2b319d308db93d255e1c348e0
Instruction Fuzzy Hash: 40E0B679681340EFEF10ABA1EC8DB5A3AA4B725742F144468F041E92A0DBB44584DA38

Function 00D96E17 Relevance: 9.2, APIs: 6, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32(00000000,?), ref: 00D96F14
WSAGetLastError.WS2_32(00000000), ref: 00D96F48
htons.WS2_32(?), ref: 00D96FFE
inet_ntoa.WS2_32(?), ref: 00D96FBB

Part of subcall function 00D7AE14: _strlen.LIBCMT ref: 00D7AE1E
Part of subcall function 00D7AE14: _memmove.LIBCMT ref: 00D7AE40

_strlen.LIBCMT ref: 00D97058
_memmove.LIBCMT ref: 00D970C1

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 9282545d82dfc66ef78ad721e7be349bf700a4d6c8342e7048d9591502fa9b00
Instruction ID: bc1ea3a3dca12f0452a8184ba0845481f55bd43be96dd62f144bca4dcb767583
Opcode Fuzzy Hash: 9282545d82dfc66ef78ad721e7be349bf700a4d6c8342e7048d9591502fa9b00
Instruction Fuzzy Hash: 9F81F171508310ABDB10EF24DC92E6BB3E9EF94718F14891CF5599B292DA71ED04CBB2

Function 00D8675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D868AD
_memmove.LIBCMT ref: 00D867E8

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

_memmove.LIBCMT ref: 00D8685B
_memmove.LIBCMT ref: 00D86942
_memmove.LIBCMT ref: 00D8695B
_memmove.LIBCMT ref: 00D86977

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 040ed3faa825fe65c3412c21568763521d903e3cfb72be60eb4e581b301f4f82
Instruction ID: a87c1322df31ae575373350daa4bc906dfd4cc52c6e79d8b56647376f589d2d0
Opcode Fuzzy Hash: 040ed3faa825fe65c3412c21568763521d903e3cfb72be60eb4e581b301f4f82
Instruction Fuzzy Hash: 80619A3050466AABDF11FF20DC92EFE77A4EF14718F044559F8995B292DA30E945CBB0

Function 00DA046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00DA10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA0038,?,?), ref: 00DA10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DA0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00DA05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00DA05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00DA0617
RegCloseKey.ADVAPI32(00000000), ref: 00DA0624

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 04e1939b73cd8023855ad1c3626053090e6970744a6d65d859adc12cb6f7a30c
Instruction ID: a85f1e6fc3c372f82a08b737848a752cbab0378ac4c43b08cd66a7e5d67dc404
Opcode Fuzzy Hash: 04e1939b73cd8023855ad1c3626053090e6970744a6d65d859adc12cb6f7a30c
Instruction Fuzzy Hash: BA513831508200AFCB14EF64D885E6BBBE8FF8A318F08495DF585972A1DB31E904CB72

Function 00DA5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00DA5A82
GetMenuItemCount.USER32(00000000), ref: 00DA5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00DA5AE1
GetMenuItemID.USER32(?,?), ref: 00DA5B50
GetSubMenu.USER32(?,?), ref: 00DA5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00DA5BAF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 88fcef0981f8310e3988d7357636778365080acbd2baaaa87a6843bdac01a6cb
Instruction ID: 6443fc6b3d62be3c8c2bec0ae75f744a38bf3cdead17b6b757d192e79a1418ab
Opcode Fuzzy Hash: 88fcef0981f8310e3988d7357636778365080acbd2baaaa87a6843bdac01a6cb
Instruction Fuzzy Hash: 5C516D35A00625EFCB11EFA4D845AAEB7B4EF49320F1444A9F846B7351CB70AE418BB0

Function 00D7F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D7F3F7
VariantClear.OLEAUT32(00000013), ref: 00D7F469
VariantClear.OLEAUT32(00000000), ref: 00D7F4C4
_memmove.LIBCMT ref: 00D7F4EE
VariantClear.OLEAUT32(?), ref: 00D7F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00D7F569

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 42b75745756871426a306800fbdb7476b865e952d6c7ec92344f1c13ba9dee09
Instruction ID: c01c38fecf415f020ff6736363a21a85ba854c9730f0bb8317c70ee75f439138
Opcode Fuzzy Hash: 42b75745756871426a306800fbdb7476b865e952d6c7ec92344f1c13ba9dee09
Instruction Fuzzy Hash: DF5148B5A00209EFCB24CF58D884AAAB7F8FF4D354B158569E959DB310E730E951CBA0

Function 00D826F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D82747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D82792
IsMenu.USER32(00000000), ref: 00D827B2
CreatePopupMenu.USER32 ref: 00D827E6
GetMenuItemCount.USER32(000000FF), ref: 00D82844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00D82875

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 8339427485c217eb507c9854a3cd8a2bfa8417e9e61de3e39503ac247a843d82
Instruction ID: 4cf5806b5248fbe5b2b5aa74d90906b3d2a87dad05ab9a4b7a48f1f3265cb8e8
Opcode Fuzzy Hash: 8339427485c217eb507c9854a3cd8a2bfa8417e9e61de3e39503ac247a843d82
Instruction Fuzzy Hash: 6F519E70A0030AEFDF24EFA9D888ABEBBF5EF45314F184169E8519B291D7709944CB71

Function 00D21765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00D2179A
GetWindowRect.USER32(?,?), ref: 00D217FE
ScreenToClient.USER32(?,?), ref: 00D2181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D2182C
EndPaint.USER32(?,?), ref: 00D21876

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 4b06a938dc532fcfb8ebca299ad06493611ee54d9f32427a55529555a9740be1
Instruction ID: ebedeebb120bb1f88d39c3e1ddc4b53250a3212191ed005ea4aaa21750b0628e
Opcode Fuzzy Hash: 4b06a938dc532fcfb8ebca299ad06493611ee54d9f32427a55529555a9740be1
Instruction Fuzzy Hash: 7641BD34100350AFC710EF24D8C4BBA7BE8EB6A728F184669F994CB2A1C770D805DB72

Function 00DAB958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00DE67B0,00000000,010A1F20,?,?,00DE67B0,?,00DAB862,?,?), ref: 00DAB9CC
EnableWindow.USER32(00000000,00000000), ref: 00DAB9F0
ShowWindow.USER32(00DE67B0,00000000,010A1F20,?,?,00DE67B0,?,00DAB862,?,?), ref: 00DABA50
ShowWindow.USER32(00000000,00000004,?,00DAB862,?,?), ref: 00DABA62
EnableWindow.USER32(00000000,00000001), ref: 00DABA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00DABAA9

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 0e988441b8546908ca17b294df61313e41cfcf5122e5246b4dd30f3084e49c95
Instruction ID: 9bea112141d0ef9dc950c0c9990cdbd93e2476ed48514e8a3d52e87d4db79179
Opcode Fuzzy Hash: 0e988441b8546908ca17b294df61313e41cfcf5122e5246b4dd30f3084e49c95
Instruction Fuzzy Hash: C4414F31601641AFDB21CF64C489B957FE0FB06320F1C42BAEA488F6A3C771A846CF61

Function 00D973B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00D95134,?,?,00000000,00000001), ref: 00D973BF

Part of subcall function 00D93C94: GetWindowRect.USER32(?,?), ref: 00D93CA7

GetDesktopWindow.USER32 ref: 00D973E9
GetWindowRect.USER32(00000000), ref: 00D973F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00D97422

Part of subcall function 00D854E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D8555E

GetCursorPos.USER32(?), ref: 00D9744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00D974AC

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 02f26998dfe5962d181f71e6c57dbed3e744126b78b3c247bb2561fe2f5b96a9
Instruction ID: 4cd33e1dfaa684bcb729bfedb0e8e1fcc8d23f1bce7766c2f0b34866c44e663e
Opcode Fuzzy Hash: 02f26998dfe5962d181f71e6c57dbed3e744126b78b3c247bb2561fe2f5b96a9
Instruction Fuzzy Hash: 3831C472508305ABDB24DF54D849F9BBBE9FF89314F040929F589D7192D730E908CBA2

Function 00D8ED8E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

Part of subcall function 00D3FEC6: _wcscpy.LIBCMT ref: 00D3FEE9

_wcstok.LIBCMT ref: 00D8EEFF
_wcscpy.LIBCMT ref: 00D8EF8E
_memset.LIBCMT ref: 00D8EFC1

Strings

X, xrefs: 00D8EFFE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 6df3dffc6cbd8a40726d777f6fee67b376e79231e85fae34c7e915a4668a0a51
Instruction ID: 00cc41fd6ed2dac7965254a8ec892392d91e02f24d7190a8280e9d235a858422
Opcode Fuzzy Hash: 6df3dffc6cbd8a40726d777f6fee67b376e79231e85fae34c7e915a4668a0a51
Instruction Fuzzy Hash: 18C18B716083109FC724EF24D895A6AB7E4FF94314F04496DF8999B2A2DB30ED45CBB2

Function 00D78D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D785F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D78608
Part of subcall function 00D785F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D78612
Part of subcall function 00D785F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D78621
Part of subcall function 00D785F1: RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00D78628
Part of subcall function 00D785F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D7863E

GetLengthSid.ADVAPI32(?,00000000,00D78977), ref: 00D78DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00D78DB8
RtlAllocateHeap.NTDLL(00000000), ref: 00D78DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00D78DD8
GetProcessHeap.KERNEL32(00000000,00000000,00D78977), ref: 00D78DEC
HeapFree.KERNEL32(00000000), ref: 00D78DF3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Heap$Process$AllocateInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 169236558-0
Opcode ID: 6cb12e164d1210f0124f763cca24698613d34b589844b310bec23359af178b41
Instruction ID: bb0c80bc614588b0579191fed2248de672873974044f63fb0c192f5909dec602
Opcode Fuzzy Hash: 6cb12e164d1210f0124f763cca24698613d34b589844b310bec23359af178b41
Instruction Fuzzy Hash: F911AC31640705FFDB209FA4CC0DBAE7BA9EF56315F148069E889D7250EB369900EB70

Function 00DAC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00D212F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D2134D
Part of subcall function 00D212F3: SelectObject.GDI32(?,00000000), ref: 00D2135C
Part of subcall function 00D212F3: BeginPath.GDI32(?), ref: 00D21373
Part of subcall function 00D212F3: SelectObject.GDI32(?,00000000), ref: 00D2139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00DAC1C4
LineTo.GDI32(00000000,00000003,?), ref: 00DAC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00DAC1E6
LineTo.GDI32(00000000,00000000,?), ref: 00DAC1F6
EndPath.GDI32(00000000), ref: 00DAC206
StrokePath.GDI32(00000000), ref: 00DAC216

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: e098cf0bbc8c70e4d334aa92d20e4494079ebe1f5d255cb6cb9329d76e953930
Instruction ID: 56edcd2a6b635c3a576d75fa2c86a4fba855c3a4c5ad6bc52cdcc88bfdd5a9df
Opcode Fuzzy Hash: e098cf0bbc8c70e4d334aa92d20e4494079ebe1f5d255cb6cb9329d76e953930
Instruction Fuzzy Hash: 8911097640024CBFDB119F94DC88FAA7FADEB093A4F048061BA198A2A1C7719D55DBB0

Function 00D403A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D403D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00D403DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D403E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D403F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00D403F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D40401

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 0ae152cf117d9384b28e2a32d20b28472f1807a10a0a6998a49ac117d7444470
Instruction ID: 0f3a2c67717ba622afdb966ac4901a5276f8ebb658f914ddcaf3da0f488d2df5
Opcode Fuzzy Hash: 0ae152cf117d9384b28e2a32d20b28472f1807a10a0a6998a49ac117d7444470
Instruction Fuzzy Hash: 18016CB09017597DE3008F5A8C85B52FFA8FF19354F04415BA15C87A41C7F5A864CBE5

Function 00D8568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00D8569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00D856B1
GetWindowThreadProcessId.USER32(?,?), ref: 00D856C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D856CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D856D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D856E0

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 0a41655990aebf6c005fbe5f64c5b8dd3cf2e304ddac4c4a97693f93f5ce288a
Instruction ID: af2951f4b2a52c8176b8ee011cc73c1cdb076273ed85b7a1ce863fe001ee267c
Opcode Fuzzy Hash: 0a41655990aebf6c005fbe5f64c5b8dd3cf2e304ddac4c4a97693f93f5ce288a
Instruction Fuzzy Hash: 59F01D32241258BBE7215BE2EC0EEAB7A7CEBC7B11F0401A9FA04D1150D7A15A0186B5

Function 00D874D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00D874E5
RtlEnterCriticalSection.NTDLL(?), ref: 00D874F6
TerminateThread.KERNEL32(00000000,000001F6,?,00D31044,?,?), ref: 00D87503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00D31044,?,?), ref: 00D87510

Part of subcall function 00D86ED7: CloseHandle.KERNEL32(00000000,?,00D8751D,?,00D31044,?,?), ref: 00D86EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00D87523
RtlLeaveCriticalSection.NTDLL(?), ref: 00D8752A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 59554e7f3ff162caa3222777951a1ba3685df9844a17450b61fd9f408489d28f
Instruction ID: c34cf37ea45f089f14bccf060479053c54859c2704a0abdb82a2ee76708c8569
Opcode Fuzzy Hash: 59554e7f3ff162caa3222777951a1ba3685df9844a17450b61fd9f408489d28f
Instruction Fuzzy Hash: A9F05E3A140712EBDB622BA4FC8CAEB772AEF46712B1405B1F242D11B0DB755801CB74

Function 00D98902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D98928
CharUpperBuffW.USER32(?,?), ref: 00D98A37
VariantClear.OLEAUT32(?), ref: 00D98BAF

Part of subcall function 00D87804: VariantInit.OLEAUT32(00000000), ref: 00D87844
Part of subcall function 00D87804: VariantCopy.OLEAUT32(00000000,?), ref: 00D8784D
Part of subcall function 00D87804: VariantClear.OLEAUT32(00000000), ref: 00D87859

Strings

AUTOIT.ERROR, xrefs: 00D98A3D
Incorrect Parameter format, xrefs: 00D98960, 00D98B22

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: e80450158a16fec130a8c0749c4b72029de4bf8a1704d118451f871904e54fea
Instruction ID: adc660399f69de75ebc9b90267765393a7575eacf885fd005468b82550d883af
Opcode Fuzzy Hash: e80450158a16fec130a8c0749c4b72029de4bf8a1704d118451f871904e54fea
Instruction Fuzzy Hash: 679170716083019FCB10DF28C48595BBBE4EF99714F18896EF89A8B361DB31E945CB72

Function 00D82F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3FEC6: _wcscpy.LIBCMT ref: 00D3FEE9

_memset.LIBCMT ref: 00D83077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D830A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D83159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00D83187

Strings

0, xrefs: 00D83063

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d7636c25a600e532e451e8758c2f09228effe031b3636a532867e2180c5b8a83
Instruction ID: eb5224921179e27713ae89cc1420bdb91765fa0ff4d3747c0ed45fc2cb5bd8e3
Opcode Fuzzy Hash: d7636c25a600e532e451e8758c2f09228effe031b3636a532867e2180c5b8a83
Instruction Fuzzy Hash: 2A519F316083409BD725BF28D849A6BB7E8EF55F60F080A2DF899D62D1DB70CE448772

Function 00D7DA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 00D7DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00D7DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00D7DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00D7DB8E

Strings

DllGetClassObject, xrefs: 00D7DB01

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 2159896ded673a01d1db56ce1c66b07d41968828dae9efa025de70bdaac41b56
Instruction ID: d80aab01e2647e5ddaea3e46740683416d1ccfa41931bcdc3f3d5b4859dbe1cc
Opcode Fuzzy Hash: 2159896ded673a01d1db56ce1c66b07d41968828dae9efa025de70bdaac41b56
Instruction Fuzzy Hash: 714151B1600304DFDB15CF54C884A9A7BBAEF48350F19C1AAAD09DF205E7B1D944CBB0

Function 00D82C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D82CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00D82CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00D82D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00DE6890,00000000), ref: 00D82D5A

Strings

0, xrefs: 00D82CA4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 118eb22b6463321a013dc8ec84952acafd942a903f793c319ec66785053553df
Instruction ID: 7260da865569521caa9f6c56b1ffe3c873b5637949c46fc8c7a39915f295ebcf
Opcode Fuzzy Hash: 118eb22b6463321a013dc8ec84952acafd942a903f793c319ec66785053553df
Instruction Fuzzy Hash: E14180302053029FD720EF25D845B6ABBE8FF85320F184A5DF9A5972A1D770E905CBB2

Function 00D9DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00D9DAD9

Part of subcall function 00D279AB: _memmove.LIBCMT ref: 00D279F9

Strings

none, xrefs: 00D9DBB4
cdecl, xrefs: 00D9DB30
winapi, xrefs: 00D9DB4A
stdcall, xrefs: 00D9DB5B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 276d9204cf7ad891a786f9859183e8eaaeb73bc4e3e89f7a8fc92bda4c876cb0
Instruction ID: 2356d0bd5778879101aafb7d4aa2a49b1f1133fb340ad24a2853235dcb404a58
Opcode Fuzzy Hash: 276d9204cf7ad891a786f9859183e8eaaeb73bc4e3e89f7a8fc92bda4c876cb0
Instruction Fuzzy Hash: 7931A17190021AAFCF10EF94C8819AEB7B5FF15318B10866AE865A7795DB31A905CBB0

Function 00D79372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00D7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00D7B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00D793F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00D79409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00D79439

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

Strings

ComboBox, xrefs: 00D79380
ListBox, xrefs: 00D793B5

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 9ac97a00e7898ab0d52b15b97a4239ff99cd60c9e30146aab2dc571110bd4052
Instruction ID: dd0e97c40d878ce2e876c6357965afbf8dbbc6c7acb5c5cc1ab5a231b1cfb430
Opcode Fuzzy Hash: 9ac97a00e7898ab0d52b15b97a4239ff99cd60c9e30146aab2dc571110bd4052
Instruction Fuzzy Hash: A121F672904104BFDB14ABB0EC96DFFB778DF05364B18852AF929972E1EB35490A9630

Function 00DA6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D21D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D21D73
Part of subcall function 00D21D35: GetStockObject.GDI32(00000011), ref: 00D21D87
Part of subcall function 00D21D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D21D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00DA66D0
LoadLibraryW.KERNEL32(?), ref: 00DA66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00DA66EC
DestroyWindow.USER32(?), ref: 00DA66F4

Strings

SysAnimate32, xrefs: 00DA66AB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 8781e54e64cc6245b247079ae4709868b332af5061364e4ebffc3cfae42cee9d
Instruction ID: f21ce6c7993903105d2179460b19afe15c1cd177b03d73f2b64e8a726bd8bd98
Opcode Fuzzy Hash: 8781e54e64cc6245b247079ae4709868b332af5061364e4ebffc3cfae42cee9d
Instruction Fuzzy Hash: 8A218B71200206EBEF104FA4EC80EAB77ADEB6A368F1C4669FA50D21A0DB71CC519770

Function 00D8703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00D8705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D87091
GetStdHandle.KERNEL32(0000000C), ref: 00D870A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00D870DD

Strings

nul, xrefs: 00D870D8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 6bd1cbbcab7cdb36c9951390a70809c940bc9b2a22850ccaf50f4cd4da89d7b6
Instruction ID: 892d1add7884068894136759f643e46700f301cabbb4f2048a4d11add5f963b2
Opcode Fuzzy Hash: 6bd1cbbcab7cdb36c9951390a70809c940bc9b2a22850ccaf50f4cd4da89d7b6
Instruction Fuzzy Hash: 37217A75604309ABDB20AF68D805A9A77F8BF95760F348A29F9A0D72D0E771D840CB70

Function 00D8710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00D8712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D8715D
GetStdHandle.KERNEL32(000000F6), ref: 00D8716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00D871A8

Strings

nul, xrefs: 00D871A3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: bb05dba1c6cd3240bedf9589ca50fb7f5045d1a3beae867317c7c1133bf6a3f6
Instruction ID: 7df58da2a6ca7911998b52226dc6d37d0dce806a6bf4de4594341ceb276d7234
Opcode Fuzzy Hash: bb05dba1c6cd3240bedf9589ca50fb7f5045d1a3beae867317c7c1133bf6a3f6
Instruction Fuzzy Hash: 5E216D75608305ABDB20AF689C08AAAB7E8AF55B34F340A19F9E1D72D0D770D841CB75

Function 00D8AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D8AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00D8AF13
__swprintf.LIBCMT ref: 00D8AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00DAF910), ref: 00D8AF6A

Strings

%lu, xrefs: 00D8AF26

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 6fde631133341351d4a053b316b2704bdfdc6f88a3f3cc6ff5558fe865df22f6
Instruction ID: 5e985c4bfa9e00a3bd0ee9d2f1b34034bcf8650eb3dc2a3f2319b6f10fb92e25
Opcode Fuzzy Hash: 6fde631133341351d4a053b316b2704bdfdc6f88a3f3cc6ff5558fe865df22f6
Instruction Fuzzy Hash: 53215635A00209AFDB10EFA4DD85EAEB7B8EF49714B1040A9F909DB351DB31EA45CB71

Function 00D7A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

Part of subcall function 00D7A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00D7A399
Part of subcall function 00D7A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D7A3AC
Part of subcall function 00D7A37C: GetCurrentThreadId.KERNEL32 ref: 00D7A3B3
Part of subcall function 00D7A37C: AttachThreadInput.USER32(00000000), ref: 00D7A3BA

GetFocus.USER32 ref: 00D7A554

Part of subcall function 00D7A3C5: GetParent.USER32(?), ref: 00D7A3D3

GetClassNameW.USER32(?,?,00000100), ref: 00D7A59D
EnumChildWindows.USER32(?,00D7A615), ref: 00D7A5C5
__swprintf.LIBCMT ref: 00D7A5DF

Strings

%s%d, xrefs: 00D7A5D9

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 38691dfe651361855efef038e4445f08561dc86303c846bf107caad3ecff2b37
Instruction ID: 51d7c6b3cb824f2fde6976e6de90f0234b4e2eaf3b12447f6bac1d65ada5bffb
Opcode Fuzzy Hash: 38691dfe651361855efef038e4445f08561dc86303c846bf107caad3ecff2b37
Instruction Fuzzy Hash: 72118471600219BBDF117FA8DC85FEE7778DF89710F0480B5B90CAA192EA7059458B75

Function 00D82017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D82048

Strings

KEYS, xrefs: 00D8205F
REMOVE, xrefs: 00D8204E
EXISTS, xrefs: 00D82070
APPEND, xrefs: 00D82081

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: b6ee036501903496d414779a6d77eba1a123e1c4fd27b3367227b92a0e8ce784
Instruction ID: 4d707209e4c1993b1e4190c60ffb9e63b2e9f73ec96f85e284fcc7dbca915371
Opcode Fuzzy Hash: b6ee036501903496d414779a6d77eba1a123e1c4fd27b3367227b92a0e8ce784
Instruction Fuzzy Hash: 56110930D1021A9FCF10EFA4D9518BEB7B4FF16304F5484A9D855A7352EB32690ACB70

Function 00D9EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00D9EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00D9EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00D9F07E
CloseHandle.KERNEL32(?), ref: 00D9F0FF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 0f7ee5703ef2ca5d840773db93222cd19e97a5f42feff1ed972254cdd89c053b
Instruction ID: 3cfd18937e470d5c6356dbe70b7d086615134dcf0828e7c73c976bb2cb827282
Opcode Fuzzy Hash: 0f7ee5703ef2ca5d840773db93222cd19e97a5f42feff1ed972254cdd89c053b
Instruction Fuzzy Hash: 128171B16043109FDB20EF28D856B2AB7E5EF58724F04885DF599DB392DB71AC408BB1

Function 00DA02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00DA10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA0038,?,?), ref: 00DA10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DA03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00DA040E
RegCloseKey.ADVAPI32(?,?), ref: 00DA043A
RegCloseKey.ADVAPI32(00000000), ref: 00DA0447

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: c91ac8b7feea85c67eb83a8fd13c665ec35a3c16a2239dc9bfc6b30e70072075
Instruction ID: ee2fa895eeb858093bd5fe9346e1aef54341cf9c0f0048da73af2f66e0d6e8b0
Opcode Fuzzy Hash: c91ac8b7feea85c67eb83a8fd13c665ec35a3c16a2239dc9bfc6b30e70072075
Instruction Fuzzy Hash: 13513B31208204AFDB14EF64D891F6EBBE8FF89308F04896DB59597291DB71E904CB72

Function 00D9DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00D9DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00D9DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00D9DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00D9DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00D9DD35

Part of subcall function 00D25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00D87B20,?,?,00000000), ref: 00D25B8C
Part of subcall function 00D25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00D87B20,?,?,00000000,?,?), ref: 00D25BB0

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: edaa431764284da2128757c4971f155e24e0a17d960bb81b6feb3a1f84c3552f
Instruction ID: a0b7ad00b7c77e224732b3f09ae4c4b6641a91c908319077b7bc6855fc4772ea
Opcode Fuzzy Hash: edaa431764284da2128757c4971f155e24e0a17d960bb81b6feb3a1f84c3552f
Instruction Fuzzy Hash: 2B513635A00215DFDB00EFA8D494DADB7F5FF59324B1880A9E819AB361DB30ED45CBA0

Function 00D8E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00D8E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00D8E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00D8E8F2

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00D8E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00D8E91F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: d1c8160206645075a1bb3c4d3eff5a78e13ae547b1ba0b1b59de43465295b3ee
Instruction ID: 91e0c521deae1dbaaf8488ee4f56415af6f2fbb80aca15ea92cc5f0f191e34ed
Opcode Fuzzy Hash: d1c8160206645075a1bb3c4d3eff5a78e13ae547b1ba0b1b59de43465295b3ee
Instruction Fuzzy Hash: F8512A35A00215DFCB00EF64D991AADBBF5EF09314B148099E849AB361CB31ED41CF70

Function 00DAA2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c16bf6f00787e88494e030a4ea0bcb52c367ff21947a62d1f284747cfa2ad29
Instruction ID: 9452c63f9cd0938603e174def7c1cc25099a20a09c6662a699160498af2cdd49
Opcode Fuzzy Hash: 3c16bf6f00787e88494e030a4ea0bcb52c367ff21947a62d1f284747cfa2ad29
Instruction Fuzzy Hash: A341B235900214AFDB20DFACCC88BB9BBA5EB0A310F194265F956E72E1D770ED41DA71

Function 00D22344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D22357
ScreenToClient.USER32(00DE67B0,?), ref: 00D22374
GetAsyncKeyState.USER32(00000001), ref: 00D22399
GetAsyncKeyState.USER32(00000002), ref: 00D223A7

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 6991dd606a047587dd71e0b711b9e80e63b3b00bde543015aae094329004eff6
Instruction ID: 815250086b177e26a7a1c2024dee9fcf0f517cdd3303e36e9b6e2ec65f7d974b
Opcode Fuzzy Hash: 6991dd606a047587dd71e0b711b9e80e63b3b00bde543015aae094329004eff6
Instruction Fuzzy Hash: 5A419E31504229FFCF15CFA8D844AEDBBB4FB06324F24435AF86896290C7359994DBB1

Function 00D76920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D7695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00D769A9
TranslateMessage.USER32(?), ref: 00D769D2
DispatchMessageW.USER32(?), ref: 00D769DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D769EB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 678ec21e73493ec34933fc2ec5c4f34ed2a404f8895ea513befbbdb75c6da88f
Instruction ID: 99a9f06fff8d443f2b1b542f72ea2af02034957df55d06c11025ff939c3b7a84
Opcode Fuzzy Hash: 678ec21e73493ec34933fc2ec5c4f34ed2a404f8895ea513befbbdb75c6da88f
Instruction Fuzzy Hash: 9A31D831900B46AADB20DF74DC84FB67BACEB12354F188169E529D62A1F734D845DB70

Function 00D78F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D78F12
PostMessageW.USER32(?,00000201,00000001), ref: 00D78FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00D78FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00D78FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00D78FDA

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: ec72a6dd287d6c6001db8bb8c97ebbe3d5ecc136c4b72912c08d1209f1b5395d
Instruction ID: f3acce80600dcc0c0538b1dc1b8bf50aaf68d4d45c5deee9e73ad258a6637e1a
Opcode Fuzzy Hash: ec72a6dd287d6c6001db8bb8c97ebbe3d5ecc136c4b72912c08d1209f1b5395d
Instruction Fuzzy Hash: A331E071500219EFDB10CFA8D94CA9EBBB6EF05315F148269F968E72D0D7B0D910EBA0

Function 00D7B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00D7B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00D7B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00D7B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00D7B742
_wcsstr.LIBCMT ref: 00D7B74C

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: b28c6cc13b3832a3e399583ab17dd42a9162996ad872ec893849a01139a71d31
Instruction ID: d50ebb4f96f538c4aae8c2674fae6860558226872083f78ce4cdcd67672da45f
Opcode Fuzzy Hash: b28c6cc13b3832a3e399583ab17dd42a9162996ad872ec893849a01139a71d31
Instruction Fuzzy Hash: 6221A731604344BBEB295B799C49F7B7B98DF49760F18807AF909CA2A1FB61DC4096B0

Function 00DAB405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00D22612: GetWindowLongW.USER32(?,000000EB), ref: 00D22623

GetWindowLongW.USER32(?,000000F0), ref: 00DAB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00DAB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00DAB489
GetSystemMetrics.USER32(00000004), ref: 00DAB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00D91184,00000000), ref: 00DAB4D0

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 41b067dbb377947e608c32e82211439eb33c1c3fe31b414bfe92007e5a79fd1b
Instruction ID: 7618b1d8939d993955e6fcbbe6e7c0868f3aae67677fbb136938de977e7fd9ca
Opcode Fuzzy Hash: 41b067dbb377947e608c32e82211439eb33c1c3fe31b414bfe92007e5a79fd1b
Instruction Fuzzy Hash: 10219431910265AFCB109F78CC44A6537A4FB0A738F144735F965C62E2E770D811DB60

Function 00D797E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D79802

Part of subcall function 00D27D2C: _memmove.LIBCMT ref: 00D27D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00D79834
__itow.LIBCMT ref: 00D7984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00D79874
__itow.LIBCMT ref: 00D79885

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 69be661891ca7b98d9454caa9fdc18eb4ef1e30657d81032c323955debefeb9a
Instruction ID: c793bba3583a8cbfc836579737ce7231a3e9070a6531454b0147c5068d459e1a
Opcode Fuzzy Hash: 69be661891ca7b98d9454caa9fdc18eb4ef1e30657d81032c323955debefeb9a
Instruction Fuzzy Hash: BF21DA72700304ABDB209BA59C96EEEBBA8DF4A714F0C4075FD08DB251E6708D4587F2

Function 00D212F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D2134D
SelectObject.GDI32(?,00000000), ref: 00D2135C
BeginPath.GDI32(?), ref: 00D21373
SelectObject.GDI32(?,00000000), ref: 00D2139C

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: cc7df9d74e204f5e351423ab6c8f561c4e0733cb8e97ab5fb79b1f814642936e
Instruction ID: 521835088bbfdb37b66bdc784762ff997ce017e52bc813b716eea184d12d386d
Opcode Fuzzy Hash: cc7df9d74e204f5e351423ab6c8f561c4e0733cb8e97ab5fb79b1f814642936e
Instruction Fuzzy Hash: F4214C70800354EBDB10EF65EC847697BA9FB313A5F588266F810DA2E0D371D895DBB0

Function 00D7C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00D7C176
_memcmp.LIBCMT ref: 00D7C194
_memcmp.LIBCMT ref: 00D7C1A7
_memcmp.LIBCMT ref: 00D7C1BF
_memcmp.LIBCMT ref: 00D7C1D7

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7a7490b05b0b106e1bd4c275a4946b72abcf037367a7f2f5abf93c1e99a41d00
Instruction ID: acefff5e5c090206d27d571b269afb7a0ad49ba147a43bcccd74c73b475543f5
Opcode Fuzzy Hash: 7a7490b05b0b106e1bd4c275a4946b72abcf037367a7f2f5abf93c1e99a41d00
Instruction Fuzzy Hash: F20192A26143157FE214B7209C42EBB679CDB213A4B888139FD0996287FA50DE1586F1

Function 00D84D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D84D5C
__beginthreadex.LIBCMT ref: 00D84D7A
MessageBoxW.USER32(?,?,?,?), ref: 00D84D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00D84DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00D84DAC

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 61c3193dab75c86179a3a93ec63aa7477b8ef65cc66600490c9673f8b4ca4c6d
Instruction ID: 8916100cd89e27b9b7309948182636bef2a277d0dc0604f7c975dabd48c08b27
Opcode Fuzzy Hash: 61c3193dab75c86179a3a93ec63aa7477b8ef65cc66600490c9673f8b4ca4c6d
Instruction Fuzzy Hash: 741104B2904349BFCB01ABA89C48A9A7FACEB45324F1842A5FA14D7390D671CD448BB0

Function 00D7874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00D78766
GetLastError.KERNEL32(?,00D7822A,?,?,?), ref: 00D78770
GetProcessHeap.KERNEL32(00000008,?,?,00D7822A,?,?,?), ref: 00D7877F
RtlAllocateHeap.NTDLL(00000000,?,00D7822A), ref: 00D78786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00D7879D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: 0e44d1aeaccfd25b4ee4d87c627c192a3eadf269db7f813afab6bd06b2240b68
Instruction ID: 2feb1619e4d4b5adeeb1da8fc3d1cc44155c9866764567ec09b0b73a8270213d
Opcode Fuzzy Hash: 0e44d1aeaccfd25b4ee4d87c627c192a3eadf269db7f813afab6bd06b2240b68
Instruction Fuzzy Hash: 91014B71240304EFDB244FAADC8CD6B7BACEF8A3557244469F84AC2260EA318C00DAB0

Function 00D854E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D85502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00D85510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D85518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00D85522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D8555E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 177cbc7cb8915508440912467fce36fb13f8248d850a537adc9323c39ef1778e
Instruction ID: 4ead34fd111c00c9c2f362e3f4b155ce63705ed965451578970d7c4a240e12c0
Opcode Fuzzy Hash: 177cbc7cb8915508440912467fce36fb13f8248d850a537adc9323c39ef1778e
Instruction Fuzzy Hash: 13010935D00A19DBCF00AFE9E849AEDBBB9FB0A711F440196E981F2244DB3096548BB1

Function 00D77652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 00D7766F
ProgIDFromCLSID.COMBASE(?,00000000), ref: 00D7768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D7758C,80070057,?,?), ref: 00D77698
CoTaskMemFree.COMBASE(00000000), ref: 00D776A8
CLSIDFromString.COMBASE(?,?), ref: 00D776B4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 0da409cd7b9f8111a5b869f10119658d23392cc91435efd3aa1fa846788a7d13
Instruction ID: 1e1f279ab8d9116da49a1cfb75fb420cb9f58e22550974897dae9955cfaf8ada
Opcode Fuzzy Hash: 0da409cd7b9f8111a5b869f10119658d23392cc91435efd3aa1fa846788a7d13
Instruction Fuzzy Hash: 9001B1B6600704ABDB105F68DC04AAE7BACEB45751F244568FD08D2325E735DD0087B0

Function 00D785F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D78608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D78612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D78621
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00D78628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D7863E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 0e1c0a7cf56489159c276727b7c7caef34e4c184a344612400cecedf75c84cad
Instruction ID: 0e52120cc1f4b50b8c3a0041a06bd31a45a295aa343876842fb63226a3a163ac
Opcode Fuzzy Hash: 0e1c0a7cf56489159c276727b7c7caef34e4c184a344612400cecedf75c84cad
Instruction Fuzzy Hash: 84F03731241304BFEB200FE5DC8DF6B3BACEF8A755B044469F949C6250DBA19D41EA70

Function 00D78652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00D78669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00D78673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D78682
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00D78689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D7869F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 8dcf1243442595abf87f61023998eb18e75985ccd881929cc89e5da8d89a02cf
Instruction ID: 55126f16c6095ce1951de585bd98c0ba03b962935957914e8d84687f6ee6b3fb
Opcode Fuzzy Hash: 8dcf1243442595abf87f61023998eb18e75985ccd881929cc89e5da8d89a02cf
Instruction Fuzzy Hash: EAF06271240304BFEB211FA5EC8DE6B3BACEF8A765B140065F949C6250DBB1DD41EA71

Function 00D7C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00D7C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00D7C6D1
MessageBeep.USER32(00000000), ref: 00D7C6E9
KillTimer.USER32(?,0000040A), ref: 00D7C705
EndDialog.USER32(?,00000001), ref: 00D7C71F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: c770f1fee5736ac0004d22a769a94c576c81c2b919d2f2a931ad668f7df20fb0
Instruction ID: 38e2d6d36b2eb1b84eb2e1a716b8e5aca8a20e46f33f1226a481fb138e36f5e7
Opcode Fuzzy Hash: c770f1fee5736ac0004d22a769a94c576c81c2b919d2f2a931ad668f7df20fb0
Instruction Fuzzy Hash: 3401A230410704ABEB245F60DC8EF9677B8FF01705F0856ADF586E11E1EBE0A9548FA0

Function 00D213B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00D213BF
StrokeAndFillPath.GDI32(?,?,00D5BAD8,00000000,?), ref: 00D213DB
SelectObject.GDI32(?,00000000), ref: 00D213EE
DeleteObject.GDI32 ref: 00D21401
StrokePath.GDI32(?), ref: 00D2141C

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 5a387ed1290f2f0231142bfe67ab20bf336322858c58ef1d3733bb830f350819
Instruction ID: 79ab2c61ac99aed8ab7b93bff86570f026fdea0e328bf105f3eadabff2782f79
Opcode Fuzzy Hash: 5a387ed1290f2f0231142bfe67ab20bf336322858c58ef1d3733bb830f350819
Instruction Fuzzy Hash: 21F01934000348EBDB156F66EC8C7583BA5AB213AAF88C264E569C82F1C7318996DF34

Function 00D78E74 Relevance: 7.5, APIs: 5, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D78E7F
CloseHandle.KERNEL32(?), ref: 00D78E94
CloseHandle.KERNEL32(?), ref: 00D78E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00D78EA5
HeapFree.KERNEL32(00000000), ref: 00D78EAC

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessSingleWait
String ID:
API String ID: 3751786701-0
Opcode ID: 80f7f5428d584a31650d47e6c84be9048a3f1a0d99b1d92f127c07c0858a4a65
Instruction ID: e7de055c18cd9c1b36b00658ce387305da00cd0340a9d27c2879358b5c8166a9
Opcode Fuzzy Hash: 80f7f5428d584a31650d47e6c84be9048a3f1a0d99b1d92f127c07c0858a4a65
Instruction Fuzzy Hash: 44E0C236104201FFDB011FE1EC0C90ABB69FB9A322B108270F259C1270CB32A421DB60

Function 00D8C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D8C69D
CoCreateInstance.COMBASE(00DB2D6C,00000000,00000001,00DB2BDC,?), ref: 00D8C6B5

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

CoUninitialize.COMBASE ref: 00D8C922

Strings

.lnk, xrefs: 00D8C631, 00D8C659, 00D8C663

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: fdf4d5cb7576e1d88d6c6d6d07a4baffca4389c7b75256677d0202999f014f7a
Instruction ID: 2cee53fc4af7bc22d626f58b0b21d2c4ddbe24b0882af2e34e616fbd28343a8f
Opcode Fuzzy Hash: fdf4d5cb7576e1d88d6c6d6d07a4baffca4389c7b75256677d0202999f014f7a
Instruction Fuzzy Hash: 41A12C71108315AFD700EF54D892EABB7E8EF94708F00495CF196971A2EB70EA49CB72

Function 00D32E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00D40FF6: std::exception::exception.LIBCMT ref: 00D4102C
Part of subcall function 00D40FF6: __CxxThrowException@8.LIBCMT ref: 00D41041

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00D27BB1: _memmove.LIBCMT ref: 00D27C0B

__swprintf.LIBCMT ref: 00D3302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00D32EC6

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 5544639a080be191324b046ca0ccb17be68ba0fcf2ebb9cf0273e80ee83933f5
Instruction ID: fa3b0d7237d2063c6e7aa7b79888a9062f8b247c2e63553042409cef20415676
Opcode Fuzzy Hash: 5544639a080be191324b046ca0ccb17be68ba0fcf2ebb9cf0273e80ee83933f5
Instruction Fuzzy Hash: 86917A311083119FC728EF24E996C6EB7A4EF95754F04491DF4869B2A5DA30EE44CBB2

Function 00D4524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00D452DD

Part of subcall function 00D50340: __87except.LIBCMT ref: 00D5037B

Strings

pow, xrefs: 00D452B5, 00D452D2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 055ca615ffab3399cf31d2b76e1ac3434fe71e1ee73881ef5c0019e5da51354f
Instruction ID: a29d3155dc1bd474795b8618e24a0067dbe47e0bd49ab247bd0c571bb483f191
Opcode Fuzzy Hash: 055ca615ffab3399cf31d2b76e1ac3434fe71e1ee73881ef5c0019e5da51354f
Instruction Fuzzy Hash: 5F517921A09701C7DF117B24E98137E2F94DB40751F288959ECC5862EFEE74CCD89A76

Function 00D4023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00D40277
#, xrefs: 00D40280

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: c4a67789bdddb72954a72f0d0381a101c18338b8e10f437388dd1c0c8c96507c
Instruction ID: 0790cc0295ab9513b81fbb51cb18fbcc846b2a7a2cdadc2a0d0f8121af8bb1d5
Opcode Fuzzy Hash: c4a67789bdddb72954a72f0d0381a101c18338b8e10f437388dd1c0c8c96507c
Instruction Fuzzy Hash: 1F513335504256CFCF25DF28E489AFA7BA4EF2A310F1C8055EC959B2A4E7B09C42C772

Function 00DA7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00DA76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00DA76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00DA7708

Strings

SysMonthCal32, xrefs: 00DA769B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: ce32dfad760ae054098112bc0d14dddc8036c9c0f6ccb83cb4b1b981d8f59310
Instruction ID: a3b860d37d546dc365387bc8fd7f9eccc852b597ce2ebee000c45273d48a3c68
Opcode Fuzzy Hash: ce32dfad760ae054098112bc0d14dddc8036c9c0f6ccb83cb4b1b981d8f59310
Instruction Fuzzy Hash: FB21D132600218BBDF11DFA4CC42FEA3B79EF49724F150254FE15AB1D0D6B1A8508BB0

Function 00DA6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00DA6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00DA6FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00DA6FDF

Strings

Listbox, xrefs: 00DA6F77

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: cd9f192d0dfa780b25424c718983a077f100800acaa37fb1d975743c272d408f
Instruction ID: bd4a7f3099bcc74212c674ce2bc9f6c9545d9797e61b243c7e7f0a7bb87654bf
Opcode Fuzzy Hash: cd9f192d0dfa780b25424c718983a077f100800acaa37fb1d975743c272d408f
Instruction Fuzzy Hash: FA219232610218BFDF119F54DC85EAB37AAEF8A764F098124F9149B190C671EC518BB0

Function 00DA797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00DA79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00DA79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00DA7A03

Strings

msctls_trackbar32, xrefs: 00DA79B8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 1e3abb3f029d629781a776a522254682c51397fc7a02c452ff9ceb4e0929c6e1
Instruction ID: dab53e6566b275a204a81ef5bf7415f108e7cfca7e8d3d6526599f41f53a5e36
Opcode Fuzzy Hash: 1e3abb3f029d629781a776a522254682c51397fc7a02c452ff9ceb4e0929c6e1
Instruction Fuzzy Hash: F011C132244208BAEF109F64CC05FEB77A9EF8A768F064529FA45A6191D271D811CB70

Function 00D9C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D61D88,?), ref: 00D9C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00D9C324

Strings

kernel32.dll, xrefs: 00D9C30D
GetSystemWow64DirectoryW, xrefs: 00D9C31E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b10d02b10c9e9ff86a951be73a146ecdbe5e5d60932fa2f6272872e07c384ca0
Instruction ID: c2370c6dc9652074e299f68ddd76d5d32f88ee18572985066767a4e7615783c5
Opcode Fuzzy Hash: b10d02b10c9e9ff86a951be73a146ecdbe5e5d60932fa2f6272872e07c384ca0
Instruction Fuzzy Hash: BFE08C70220703CFDF204F65C804A8676E4EB0A755B84947AE895C2360E770D840CA70

Function 00D24C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D24C2E), ref: 00D24CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D24CB5

Strings

kernel32.dll, xrefs: 00D24C9E
GetNativeSystemInfo, xrefs: 00D24CAF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 6b69acac6e63f5691a9a51aec11ec4f50d0eacbb2479650dae4b15d7ab91215b
Instruction ID: 0272aed44db0f9ae3b683764af2746f404209b17c844393310b7e4ef079170fe
Opcode Fuzzy Hash: 6b69acac6e63f5691a9a51aec11ec4f50d0eacbb2479650dae4b15d7ab91215b
Instruction Fuzzy Hash: 8ED0C770500323CFC7209FB4EA08602B2E4AF02780B1488BAD882C2290EA70C880CA30

Function 00D24D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D24CE1,?), ref: 00D24DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D24DB4

Strings

kernel32.dll, xrefs: 00D24D9D
Wow64RevertWow64FsRedirection, xrefs: 00D24DAE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: e96ec9b60fc7d106ce60d984738eae781e45f123fa49fd39fd268aee5a1e62df
Instruction ID: f08d2b1d84e31f71617ae8fa44d9e0533742b6d766cae49a3c9657c18e556098
Opcode Fuzzy Hash: e96ec9b60fc7d106ce60d984738eae781e45f123fa49fd39fd268aee5a1e62df
Instruction Fuzzy Hash: A6D01731550723CFD7209FB1E848A8676E4AF16369B15C8BAD8C6D6290EB70D880CA70

Function 00D24D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D24D2E,?,00D24F4F,?,00DE62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D24D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D24D81

Strings

kernel32.dll, xrefs: 00D24D6A
Wow64DisableWow64FsRedirection, xrefs: 00D24D7B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 17a3b3da593df2e22cc18a87b8ef89d3941a8a2d8db98a14dc9a3cfc77e17013
Instruction ID: 8898b6391fcb08abac2626a62df36e5ebae454cb8cb249b225c29fc49650e544
Opcode Fuzzy Hash: 17a3b3da593df2e22cc18a87b8ef89d3941a8a2d8db98a14dc9a3cfc77e17013
Instruction Fuzzy Hash: AAD01731510723CFD7209FB1E84865676E8AF26356B19C8BAD886D6390E670D880CA70

Function 00DA1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00DA12C1), ref: 00DA1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00DA1092

Strings

RegDeleteKeyExW, xrefs: 00DA108C
advapi32.dll, xrefs: 00DA107B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 23e26691ae828cc204e3ef5b626006f4f89a920f74647d19f1539da0ad88b3fe
Instruction ID: cb2eb879ec685fd0e5fcc9b020ffa63d7bbbb4cef7ed1adb058aabb4c80e3d24
Opcode Fuzzy Hash: 23e26691ae828cc204e3ef5b626006f4f89a920f74647d19f1539da0ad88b3fe
Instruction Fuzzy Hash: 9CD0E236510712CFD7209FB5D958A1A7AE4AF06365B168C6AA4CADA250E770C8808A64

Function 00D993F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00D99009,?,00DAF910), ref: 00D99403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00D99415

Strings

kernel32.dll, xrefs: 00D993FE
GetModuleHandleExW, xrefs: 00D9940F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: dc941b81254871c33a15d8d79b45034ba75b3e24c39a52cf5526a306b726d06d
Instruction ID: 6dff9bc5ed0bfa3291a81c6489e07a5223c175f4c4ead6aa9454dacca3eee97e
Opcode Fuzzy Hash: dc941b81254871c33a15d8d79b45034ba75b3e24c39a52cf5526a306b726d06d
Instruction Fuzzy Hash: F1D0C734510313CFCB309FB8C908202B2E4AF22351B04C87EE482C2690E670C880CB30

Function 00D776C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968aada68a3507e40f670eae5f111cb06f402d96a97f58721fc1772da51e160e
Instruction ID: 2ae6b068ea2fb5b6c5dc59ba896d59a4532780441b78b5c45f020bcc5b50f68c
Opcode Fuzzy Hash: 968aada68a3507e40f670eae5f111cb06f402d96a97f58721fc1772da51e160e
Instruction Fuzzy Hash: 25C19175A04216EFDB14CF98C884EAEB7F5FF48710B158999E909EB251E730DE41CBA0

Function 00D9E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00D9E3D2
CharLowerBuffW.USER32(?,?), ref: 00D9E415

Part of subcall function 00D9DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00D9DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00D9E615
_memmove.LIBCMT ref: 00D9E628

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 92e9a729550e77848ffb206d1d3cabb2b3f0737940b3b60c6b418dd07d2d3bcd
Instruction ID: 4b0d1ca105322acbf390b0329d04f4c7684a2c363275f699b0e25cae2a1d8095
Opcode Fuzzy Hash: 92e9a729550e77848ffb206d1d3cabb2b3f0737940b3b60c6b418dd07d2d3bcd
Instruction Fuzzy Hash: 2BC16C71A083119FCB14DF28C48096ABBE4FF98718F18896DF8999B351D731E945CFA2

Function 00D983A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D983D8
CoUninitialize.COMBASE ref: 00D983E3

Part of subcall function 00D7DA5D: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 00D7DAC5

VariantInit.OLEAUT32(?), ref: 00D983EE
VariantClear.OLEAUT32(?), ref: 00D986BF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 45d7924f56323d56a5da9bf9939e56483077b5ab1ccc2b5531c2efd333e30729
Instruction ID: 3e60c0954917ed8ac48bf6399a78448e26bccb506d2a1d58031c348da8db477e
Opcode Fuzzy Hash: 45d7924f56323d56a5da9bf9939e56483077b5ab1ccc2b5531c2efd333e30729
Instruction Fuzzy Hash: 95A148752047119FDB10DF24C891A2AB7E5FF99724F08484DF99A9B3A2CB30ED44DB62

Function 00D77A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.COMBASE(?,00000000), ref: 00D77C32
CoTaskMemFree.COMBASE(00000000), ref: 00D77C4A
CLSIDFromProgID.COMBASE(?,?), ref: 00D77C6F
_memcmp.LIBCMT ref: 00D77C90

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 4beb02e2cfd6928e4c3bbeb099be793fe652b00c55e96ab516ed70d9bb77519c
Instruction ID: e00713ce2c0613f5e60654e0b0294191ad349037f60f311fdb42e2acb4f10010
Opcode Fuzzy Hash: 4beb02e2cfd6928e4c3bbeb099be793fe652b00c55e96ab516ed70d9bb77519c
Instruction Fuzzy Hash: 34811B75A00109EFCB04DF94C984EEEB7B9FF89315F248598F516AB250DB71AE06CB60

Function 00D76DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D76E04
SysAllocString.OLEAUT32(00000000), ref: 00D76EAD
VariantCopy.OLEAUT32 ref: 00D76EDC
VariantClear.OLEAUT32(?), ref: 00D76F03

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 883e15eb5b6f9425ca0104c7943a17a24649e562c0de6e1e7fcc48a00d03e8f9
Instruction ID: e4e35f803cacd55acff6e1095bffed0f45107794618a4eef9f61dd953a1fff87
Opcode Fuzzy Hash: 883e15eb5b6f9425ca0104c7943a17a24649e562c0de6e1e7fcc48a00d03e8f9
Instruction Fuzzy Hash: 995161206087019ADB24AF65E895A6EF7A5EF49310F24CC1FE59ECB291FB70D8409B35

Function 00DA9A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(010AED58,?), ref: 00DA9AD2
ScreenToClient.USER32(00000002,00000002), ref: 00DA9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00DA9B72

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 41f8c058b0bbe122c68ca176230bb600689717ab5645e383025b62edc13503e2
Instruction ID: d92b8b5402b50a93b34956133a68710c226284ab0aeefdf46453cb342984c8af
Opcode Fuzzy Hash: 41f8c058b0bbe122c68ca176230bb600689717ab5645e383025b62edc13503e2
Instruction Fuzzy Hash: F1511A35A00249AFCF10DF68D8D09AEBBB6EB56360F188159F9159B2A0D730AD41CBB0

Function 00D8BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00D8BB09
GetLastError.KERNEL32(?,00000000), ref: 00D8BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00D8BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00D8BB80

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 687453c3fcb720a1feaa19e17ee18a875c81ac697f1fd5f8e04875bb55c5afca
Instruction ID: c7a4415c6500798561b6d3c840401d25597e8ed1185aac3d1c81ef64f66c58bb
Opcode Fuzzy Hash: 687453c3fcb720a1feaa19e17ee18a875c81ac697f1fd5f8e04875bb55c5afca
Instruction Fuzzy Hash: 47413B39600620DFDB10EF25D595A1DBBE1EF59324F098489E84A9B362CB31FD41CBB1

Function 00DA8AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00DA8B4D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 7c1a1d77a9a429e5613abe050be54d9f1ce72a4d931e822abffea7c2e438079e
Instruction ID: 9bcec589ddccc29893b0f669b22ed191a6f7c5013b5cf18b83f933a319ce5eff
Opcode Fuzzy Hash: 7c1a1d77a9a429e5613abe050be54d9f1ce72a4d931e822abffea7c2e438079e
Instruction Fuzzy Hash: AE31AFB4601314BEEB249F58CC85FA937A5EB07350F284912FE55D62E1DF30E940AB71

Function 00DAADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00DAAE1A
GetWindowRect.USER32(?,?), ref: 00DAAE90
PtInRect.USER32(?,?,00DAC304), ref: 00DAAEA0
MessageBeep.USER32(00000000), ref: 00DAAF11

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 1729525e5431e68caf2aefdbe7a9a147bf66dd2d0cf95715a205cac67e7d894e
Instruction ID: 4a967318bf7565f62b1884c609c6239650ca8a2dffede4f2c0c2547f80418ba4
Opcode Fuzzy Hash: 1729525e5431e68caf2aefdbe7a9a147bf66dd2d0cf95715a205cac67e7d894e
Instruction Fuzzy Hash: E54148716002199FCB12DF58C884A69BBF5FF4A340F1882A9F814CB351D731EA01CBB2

Function 00D80FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00D81037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00D81053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00D810B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00D8110B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: aa7687e303ad08f1c0c3dae7af4578bc8eb8f3c68a8ed508b7ad0e8121a49bcf
Instruction ID: e50877fa55ec05541c84b8502783d38601fe659fd89c0129625396526c71374d
Opcode Fuzzy Hash: aa7687e303ad08f1c0c3dae7af4578bc8eb8f3c68a8ed508b7ad0e8121a49bcf
Instruction Fuzzy Hash: 17313734E40688AEFB30AB65CC09BF9BBADAB45310F0C435AE584921D1C37589CE9771

Function 00D81121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00D81176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00D81192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00D811F1
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00D81243

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c268a1242a216b6cc99ab1e2c643ae0f126f30d24e7c2f8d070b2f11dff69493
Instruction ID: 8023370c7dd4a1e2d9fd0ff00590046dbad985d72794f8530a9644d0ccf6e8c3
Opcode Fuzzy Hash: c268a1242a216b6cc99ab1e2c643ae0f126f30d24e7c2f8d070b2f11dff69493
Instruction Fuzzy Hash: 01312874D407186AEF30ABA5CC09BFA7BAEEB4A310F08435AE585921D1C334895E9775

Function 00D56415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D5644B
__isleadbyte_l.LIBCMT ref: 00D56479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00D564A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00D564DD

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f36bb4e3cda2377c8e78bee4c25cf50ebc680fbf006a2827de6b2e8d4ea75292
Instruction ID: a3bf7123a0b107bc386ecc6cdee206069dccca32dba0013724a9941f02d79195
Opcode Fuzzy Hash: f36bb4e3cda2377c8e78bee4c25cf50ebc680fbf006a2827de6b2e8d4ea75292
Instruction Fuzzy Hash: CE31E13160824AAFDF218F74C844BAA7BA5FF41352F594529EC54872A0EB31D898DBB0

Function 00DA5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00DA5189

Part of subcall function 00D8387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D83897
Part of subcall function 00D8387D: GetCurrentThreadId.KERNEL32 ref: 00D8389E
Part of subcall function 00D8387D: AttachThreadInput.USER32(00000000,?,00D852A7), ref: 00D838A5

GetCaretPos.USER32(?), ref: 00DA519A
ClientToScreen.USER32(00000000,?), ref: 00DA51D5
GetForegroundWindow.USER32 ref: 00DA51DB

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 49cfe17ed860ebaf0ee6f0ed349989d344e5195dfecf80698cf7ce19d3731991
Instruction ID: 1e00e4c359607bc877a1b4afef10803470525158c6516525a4a9d25933dc4f40
Opcode Fuzzy Hash: 49cfe17ed860ebaf0ee6f0ed349989d344e5195dfecf80698cf7ce19d3731991
Instruction Fuzzy Hash: BE31F872D00218AFDB00EFA5D995AEFB7F9EF99304F10406AE415E7241EA759A05CBB0

Function 00D40BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00D40BF2

Part of subcall function 00D25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00D87B20,?,?,00000000), ref: 00D25B8C
Part of subcall function 00D25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00D87B20,?,?,00000000,?,?), ref: 00D25BB0

_fprintf.LIBCMT ref: 00D40C29
OutputDebugStringW.KERNEL32(?), ref: 00D76331

Part of subcall function 00D44CDA: _flsall.LIBCMT ref: 00D44CF3

__setmode.LIBCMT ref: 00D40C5E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: c72555b41241d09fa351278ef51df91eb85dbcda5a4ac62e635e536bfb64bb1b
Instruction ID: 024760397186a32339327071a91b475a368c86117f98274c5563389bd3ea8121
Opcode Fuzzy Hash: c72555b41241d09fa351278ef51df91eb85dbcda5a4ac62e635e536bfb64bb1b
Instruction Fuzzy Hash: 44113632904214BFDB04B7B4AC83EBEBB69DF45320F18411AF204A7192EE319D8697B5

Function 00D78B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D78652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00D78669
Part of subcall function 00D78652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00D78673
Part of subcall function 00D78652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D78682
Part of subcall function 00D78652: RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00D78689
Part of subcall function 00D78652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D7869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00D78BEB
_memcmp.LIBCMT ref: 00D78C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D78C44
HeapFree.KERNEL32(00000000), ref: 00D78C4B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocateErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 2182266621-0
Opcode ID: 37c20ec713ed7f8ae161732512f2d7e88360d9b48359c3cb264fa001f19583a9
Instruction ID: 59f06eb83548b233e57becf17c3aaf9fb945962b19de0390ebe41bd8303929e7
Opcode Fuzzy Hash: 37c20ec713ed7f8ae161732512f2d7e88360d9b48359c3cb264fa001f19583a9
Instruction Fuzzy Hash: D2217F71E41208EFDB10DF94C949BEEB7B8EF44355F198099E458A7240EB31AA05DB71

Function 00D91A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D91A97

Part of subcall function 00D91B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D91B40
Part of subcall function 00D91B21: InternetCloseHandle.WININET(00000000), ref: 00D91BDD

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 2a59df1c75f347a2472dc1000abcff7c2c4bfa854fd40eb921822c493921b5ca
Instruction ID: 24aa47b432547f7a4ff1de6b2cbe3717466931da195f5a2deb19ca241ac82c96
Opcode Fuzzy Hash: 2a59df1c75f347a2472dc1000abcff7c2c4bfa854fd40eb921822c493921b5ca
Instruction Fuzzy Hash: 68219F39200602BFDF129FA08C01FBAB7AEFF45705F14451AFA5296650EB71D8119BB0

Function 00D7E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00D7E1C4,?,?,?,00D7EFB7,00000000,000000EF,00000119,?,?), ref: 00D7F5BC
Part of subcall function 00D7F5AD: lstrcpyW.KERNEL32(00000000,?,?,00D7E1C4,?,?,?,00D7EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00D7F5E2
Part of subcall function 00D7F5AD: lstrcmpiW.KERNEL32(00000000,?,00D7E1C4,?,?,?,00D7EFB7,00000000,000000EF,00000119,?,?), ref: 00D7F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00D7EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00D7E1DD
lstrcpyW.KERNEL32(00000000,?,?,00D7EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00D7E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00D7EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00D7E237

Strings

cdecl, xrefs: 00D7E22E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: d45c30690d1699b4fbf3e96e100d1a13d45e4e72b41264e44eb50622a7582cb5
Instruction ID: fcd7a37742389003d2f47bd4a11a681b317fdd24a083a18d9babf5e300100042
Opcode Fuzzy Hash: d45c30690d1699b4fbf3e96e100d1a13d45e4e72b41264e44eb50622a7582cb5
Instruction Fuzzy Hash: 1F118E3A200345EFCB25AF64D84597A77A8FF89350B44816AE80ACB2A1FB71985197B4

Function 00D55332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D55351

Part of subcall function 00D4594C: __FF_MSGBANNER.LIBCMT ref: 00D45963
Part of subcall function 00D4594C: __NMSG_WRITE.LIBCMT ref: 00D4596A
Part of subcall function 00D4594C: RtlAllocateHeap.NTDLL(01090000,00000000,00000001), ref: 00D4598F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 2904a6cc3fff3e406e38cdfa480abe570d2ffbaeea24fbad457f3cc06e87e90b
Instruction ID: 1ec3350016a3e70b24f28a305a64b5208de92c5633b06f38469f6ffe866d5dab
Opcode Fuzzy Hash: 2904a6cc3fff3e406e38cdfa480abe570d2ffbaeea24fbad457f3cc06e87e90b
Instruction Fuzzy Hash: 69110132805B05AFEF223F70FC6561D3B98DF013E2B18042AFD49AA191DB718944A7B0

Function 00D24531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D24560

Part of subcall function 00D2410D: _memset.LIBCMT ref: 00D2418D
Part of subcall function 00D2410D: _wcscpy.LIBCMT ref: 00D241E1
Part of subcall function 00D2410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D241F1

KillTimer.USER32(?,00000001,?,?), ref: 00D245B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D245C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D5D6CE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: bbef6153646e54d6073dcd1d3e22a56fcdeb1156c37007a482a4a52172f4c03f
Instruction ID: 094d2a86dfac167926689dcddd4370d35bda77609222a24e0db8047d7f2a266f
Opcode Fuzzy Hash: bbef6153646e54d6073dcd1d3e22a56fcdeb1156c37007a482a4a52172f4c03f
Instruction Fuzzy Hash: 3C210A705043989FEB329B24D845BE7BBED9F11309F04009DEEDE96241C7B45A898B71

Function 00D78AF9 Relevance: 6.1, APIs: 4, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00D78B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00D78B31
CloseHandle.KERNEL32(00000004), ref: 00D78B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D78B7A

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: 586a7169662d4ff3b8fe665bf9b8a66a0dfb76fa3c41dfc411badd7750f62748
Instruction ID: bcb6a707fe455c05153c70894ff3ead6ae0343863239dabbdd31c1fef8d5ee2b
Opcode Fuzzy Hash: 586a7169662d4ff3b8fe665bf9b8a66a0dfb76fa3c41dfc411badd7750f62748
Instruction Fuzzy Hash: 5E1159B2540209ABDF018FA4ED49FDA7BA9EF09305F088064FE08E2160D7769D61AB70

Function 00D9667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00D87B20,?,?,00000000), ref: 00D25B8C
Part of subcall function 00D25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00D87B20,?,?,00000000,?,?), ref: 00D25BB0

gethostbyname.WS2_32(?), ref: 00D966AC
WSAGetLastError.WS2_32(00000000), ref: 00D966B7
_memmove.LIBCMT ref: 00D966E4
inet_ntoa.WS2_32(?), ref: 00D966EF

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 67a2ef6b706a5f4536b0714462f7230cf50b5d7c2e4a3b9b9cab05ebc5843e7a
Instruction ID: 534731daa65e48df4618e899258d073e69536eecdfc62468c5f1854997124528
Opcode Fuzzy Hash: 67a2ef6b706a5f4536b0714462f7230cf50b5d7c2e4a3b9b9cab05ebc5843e7a
Instruction Fuzzy Hash: 3F116D76900509AFCF00EBA4ED96DEEB7B8EF19714B144065F506A72A1EF30AE04DB71

Function 00D79023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00D79043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D79055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D7906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D79086

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2058c0f4f42e49b43ce440211a12ee82f43c46501b422d9c9b68a2eaacf0ca42
Instruction ID: 8e89409ae04901a2b810677d5356d5b554909b1cf90708e590673feaa798c208
Opcode Fuzzy Hash: 2058c0f4f42e49b43ce440211a12ee82f43c46501b422d9c9b68a2eaacf0ca42
Instruction Fuzzy Hash: D4112E7A901218FFDB11DFA5CD85E9DFB78FB48710F204095E904B7250D6716E50DBA4

Function 00D81652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00D801FD,?,00D81250,?,00008000), ref: 00D8166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00D801FD,?,00D81250,?,00008000), ref: 00D81694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00D801FD,?,00D81250,?,00008000), ref: 00D8169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00D801FD,?,00D81250,?,00008000), ref: 00D816D1

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 22a8142805f80c45d8956661a9a768be50ef09a385405ca44e9b67cea4df425b
Instruction ID: e1261b9ec9a3eb94938c243394277bc185f56613cdf3098ede2c29a515e1193f
Opcode Fuzzy Hash: 22a8142805f80c45d8956661a9a768be50ef09a385405ca44e9b67cea4df425b
Instruction Fuzzy Hash: 4A114835C00618D7CF00AFA5D84AAEEBB78FF09711F094096E9C0B6240DB3195668BB6

Function 00D57207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00D5722B

Part of subcall function 00D57912: __fltout2.LIBCMT ref: 00D5793B

__cftog_l.LIBCMT ref: 00D57251
__cftoe_l.LIBCMT ref: 00D57283

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: e04aa46cd066d123fabe56f25992aa41a550193efb1da2f4e5408722a5ac7172
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 5201803204414ABBCF125E84EC01CEE3F22BF19346F288515FE1858031C237C9B9ABA5

Function 00DAB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00DAB59E
ScreenToClient.USER32(?,?), ref: 00DAB5B6
ScreenToClient.USER32(?,?), ref: 00DAB5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DAB5F5

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 6cc7765d6aa8c05e119a3b10e145060874a7caffa1876f2e5e4175f176febae9
Instruction ID: 1a1279ba40a61207fff6518c52577e648d4f68e98a0a2499b86a45d063bd083c
Opcode Fuzzy Hash: 6cc7765d6aa8c05e119a3b10e145060874a7caffa1876f2e5e4175f176febae9
Instruction Fuzzy Hash: 451146B5D00209EFDB41CFA9C4849EEFBB5FB09310F144166E954E3620D735AA558FA0

Function 00DAB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DAB8FE
_memset.LIBCMT ref: 00DAB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00DE7F20,00DE7F64), ref: 00DAB93C
CloseHandle.KERNEL32 ref: 00DAB94E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: d0f8230142f45abe433ea5a3b112a735561dd5b2eef8b3b9b4b258b990bd23b4
Instruction ID: 3ac83b2710d82b87f31351c97a458f548cfd4e373e10a0c5e738eaf1a858f236
Opcode Fuzzy Hash: d0f8230142f45abe433ea5a3b112a735561dd5b2eef8b3b9b4b258b990bd23b4
Instruction Fuzzy Hash: C6F05EB26443807BE7503BA5AC45FBB3A5CEF09354F000061FA08D9392D7715D0087B8

Function 00D86E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00D86E88

Part of subcall function 00D8794E: _memset.LIBCMT ref: 00D87983

_memmove.LIBCMT ref: 00D86EAB
_memset.LIBCMT ref: 00D86EB8
RtlLeaveCriticalSection.NTDLL(?), ref: 00D86EC8

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 59eb4230849e4788bd5803ffeb59b238f30457577f9c844237597ea92a217f0e
Instruction ID: 613468ede5ad2bd2578c286af41c7d7cf699f1a4343980d440101ad1ad4ab9b5
Opcode Fuzzy Hash: 59eb4230849e4788bd5803ffeb59b238f30457577f9c844237597ea92a217f0e
Instruction Fuzzy Hash: 47F0543A200200ABCF417F55DC85F49BB29EF45320B048061FE089E226C731E951DBB4

Function 00DAC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00D212F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D2134D
Part of subcall function 00D212F3: SelectObject.GDI32(?,00000000), ref: 00D2135C
Part of subcall function 00D212F3: BeginPath.GDI32(?), ref: 00D21373
Part of subcall function 00D212F3: SelectObject.GDI32(?,00000000), ref: 00D2139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00DAC030
LineTo.GDI32(00000000,?,?), ref: 00DAC03D
EndPath.GDI32(00000000), ref: 00DAC04D
StrokePath.GDI32(00000000), ref: 00DAC05B

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 50aff797fed84edd409bb7c24c36d30ec7f9b210121dc2e17d9e25d64dc03052
Instruction ID: b17f57656875bafcf2b1350d9d9c96a00825aeb060a80b106a8ca5b5f4116ffd
Opcode Fuzzy Hash: 50aff797fed84edd409bb7c24c36d30ec7f9b210121dc2e17d9e25d64dc03052
Instruction Fuzzy Hash: 07F05E32001359FBDB226F94AC0AFCE3F59AF16321F448040FA11A52E2C7B55551CBB9

Function 00D7A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00D7A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D7A3AC
GetCurrentThreadId.KERNEL32 ref: 00D7A3B3
AttachThreadInput.USER32(00000000), ref: 00D7A3BA

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: fd03c448076ec3f1ba5870b7d36559bd3582b4fdc70c36c59e05eb714ab76440
Instruction ID: 2163d96de0f6db787c0cc8b17e8eaf4fb980c25a8507b181d77745bfb8ae03b4
Opcode Fuzzy Hash: fd03c448076ec3f1ba5870b7d36559bd3582b4fdc70c36c59e05eb714ab76440
Instruction Fuzzy Hash: 9AE0A531545328BADB206FE6DC0DEDB7E5CEF167A2F088065B509D51A0D67185409BB1

Function 00D22218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00D22231
SetTextColor.GDI32(?,000000FF), ref: 00D2223B
SetBkMode.GDI32(?,00000001), ref: 00D22250
GetStockObject.GDI32(00000005), ref: 00D22258
GetWindowDC.USER32(?,00000000), ref: 00D5C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D5C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00D5C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00D5C112
GetPixel.GDI32(00000000,?,?), ref: 00D5C132
ReleaseDC.USER32(?,00000000), ref: 00D5C13D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: f66df04e3edff0bc7576edef76b0a9d10e0afb436945d216c8999250452e4cef
Instruction ID: bf728575e878f47b388f711db90b13719b4a37a62e14df3e32bfc82a96d88b8a
Opcode Fuzzy Hash: f66df04e3edff0bc7576edef76b0a9d10e0afb436945d216c8999250452e4cef
Instruction Fuzzy Hash: 23E0A532604744EADB215BA8EC09B987B14AB16336F1483A6FA69981E1C67249949B32

Function 00D78C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00D78C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00D7882E), ref: 00D78C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00D7882E), ref: 00D78C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00D7882E), ref: 00D78C7E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: e49e2acdb62af85413c7ae8fa1a2a884900a11571021d3fc49ca56ba82870645
Instruction ID: 30fef0e8e26bd9d8c4e79cb14674d75d211aea643ddf71b82b5c980d86fadc26
Opcode Fuzzy Hash: e49e2acdb62af85413c7ae8fa1a2a884900a11571021d3fc49ca56ba82870645
Instruction Fuzzy Hash: 8CE04F366423219BD7205FF16D0CB963BA8EF52792F088868A245C9040EA3484419B71

Function 00D62187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00D62187
GetDC.USER32(00000000), ref: 00D62191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D621B1
ReleaseDC.USER32(?), ref: 00D621D2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 6489f091d23ba94f0573cba809988f937b3cbaf6ebcd1e17cb38b7cd4a7ba507
Instruction ID: 4328c9abc2c63b479de2f4254388063209b7467b3750c9a955dd8dec9b45473c
Opcode Fuzzy Hash: 6489f091d23ba94f0573cba809988f937b3cbaf6ebcd1e17cb38b7cd4a7ba507
Instruction Fuzzy Hash: FBE0EEB5800714EFDB119FA0D808AADBBB1EB5D351F148469F99AE7320CB7885429F61

Function 00D6219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00D6219B
GetDC.USER32(00000000), ref: 00D621A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D621B1
ReleaseDC.USER32(?), ref: 00D621D2

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: bc28aa5a215cce1e5cde01fa3f9ff23973fdddb63eb4cf7c0dd657a5c38efd23
Instruction ID: 910790a757d19ad7e94e4736c4886e657646e5435a3cbc400d42c227431e6339
Opcode Fuzzy Hash: bc28aa5a215cce1e5cde01fa3f9ff23973fdddb63eb4cf7c0dd657a5c38efd23
Instruction Fuzzy Hash: B0E012B5C00314AFCB219FB0D80869DBBF1EB5D311F148069F95AE7320CB7895419F60

Function 00D7B7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00D7B981

Strings

Container, xrefs: 00D7B8FE
AutoIt3GUI, xrefs: 00D7B8F9

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 4d165007b43caca38278e75660110f8364df38ce254673889ee37ce92772e18a
Instruction ID: 3b9c5eda10e0cba1dc1f858b32d1a561288f8b3ee869f9131b8134d8189585f0
Opcode Fuzzy Hash: 4d165007b43caca38278e75660110f8364df38ce254673889ee37ce92772e18a
Instruction Fuzzy Hash: EA913B706006019FDB24DF64C895B66BBF9FF48710F14856EE94ACB791EB71E844CB60

Function 00D8B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3FEC6: _wcscpy.LIBCMT ref: 00D3FEE9

Part of subcall function 00D29997: __itow.LIBCMT ref: 00D299C2
Part of subcall function 00D29997: __swprintf.LIBCMT ref: 00D29A0C

__wcsnicmp.LIBCMT ref: 00D8B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00D8B361

Strings

LPT, xrefs: 00D8B292

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: dae3469b50d87729799f3298fcf611de514ee39394fb8ad80f0a076cffcb13c4
Instruction ID: beedfc951f3fe577c98f801de323b9e01851a8327db0ac2ec3d1fe9e59f69db8
Opcode Fuzzy Hash: dae3469b50d87729799f3298fcf611de514ee39394fb8ad80f0a076cffcb13c4
Instruction Fuzzy Hash: 2E618475A00215EFCB14EF98C891EAEB7B4EF08320F15405AF546AB391DB70AE44CB70

Function 00D32AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00D32AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00D32AE1

Strings

@, xrefs: 00D32AD5

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: e8be47cb992eaa43d7d8df52e0919e758a19795ad62bec0e4facad90ab710461
Instruction ID: 8eda361ff646a3129fda0d51f5bc2a9172e0c7f1548595d9544dc2974805292e
Opcode Fuzzy Hash: e8be47cb992eaa43d7d8df52e0919e758a19795ad62bec0e4facad90ab710461
Instruction Fuzzy Hash: C75149714187559BD320AF10EC96BAFBBE8FF94314F42485DF1D9811A5DB308929CB36

Function 00D899BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00D2506B: __fread_nolock.LIBCMT ref: 00D25089

_wcscmp.LIBCMT ref: 00D89AAE
_wcscmp.LIBCMT ref: 00D89AC1

Strings

FILE, xrefs: 00D899FA

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 465cca313eebda343bcd0177f9c13cf2b28e992aa5f1a9decf0dea04bf7e4853
Instruction ID: 4ab8370ca5917e5f468264490b3012b988f8c8e5f4d5ad7eb28321f545a9bcfb
Opcode Fuzzy Hash: 465cca313eebda343bcd0177f9c13cf2b28e992aa5f1a9decf0dea04bf7e4853
Instruction Fuzzy Hash: 4841C871A00619BBDF20AAA4EC86FEFBBBDDF45714F040069F940A7185DA75AA0487B1

Function 00D92882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D92892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00D928C8

Strings

|, xrefs: 00D92899

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 3d8f78f828c4848265aafddd47296a4b3eee27fc01b2291b420cfa39b97ebb9d
Instruction ID: e0f6709d33038021c681f7cb4ee707db8c1578353930c69a81550b31abdc29aa
Opcode Fuzzy Hash: 3d8f78f828c4848265aafddd47296a4b3eee27fc01b2291b420cfa39b97ebb9d
Instruction Fuzzy Hash: BC311971C00119AFCF11AFA1DC85EEEBFB9FF18304F144069F815A6166EA319A56DBB0

Function 00DA6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00DA6D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00DA6DC2

Strings

static, xrefs: 00DA6D22

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 082cc5d04885053d12ca535691c477f594fe5834d1f50afd4dcd401a4048b0d7
Instruction ID: bae4f7df32ae9f93caaf1da9aefa8cfbac08fa9073dbc36664b43715ca0ba8cc
Opcode Fuzzy Hash: 082cc5d04885053d12ca535691c477f594fe5834d1f50afd4dcd401a4048b0d7
Instruction Fuzzy Hash: E2319C71200204AEDB109F78CC80AFB77A9FF49764F188619F9A6D7190CA31EC91CB70

Function 00D82D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D82E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D82E3B

Strings

0, xrefs: 00D82DF9

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 9dee53035c2e3b507816f87ecd5fb6b9db6bcc13fe3aa6631692798d77b7f18d
Instruction ID: c9a75f6883f6fde389919a0b935e7b32ab341e870b38a3fe70021636d505f08b
Opcode Fuzzy Hash: 9dee53035c2e3b507816f87ecd5fb6b9db6bcc13fe3aa6631692798d77b7f18d
Instruction Fuzzy Hash: 6031E971A00309ABEB26EF59C885BBEBBB5FF05350F180069F985D61A0D7709944CB74

Function 00DA6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00DA69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DA69DB

Strings

Combobox, xrefs: 00DA699D

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 75b421506bbfaf33b73324a147c32f4332268658f4271ce4f2cbec96aad0af0d
Instruction ID: 603502abe113041846cf7d72f1bfc9d3f1bce4b4f642100469103bb1e642046d
Opcode Fuzzy Hash: 75b421506bbfaf33b73324a147c32f4332268658f4271ce4f2cbec96aad0af0d
Instruction Fuzzy Hash: 6111BF71600208AFEF119F24CC80EEB376EEB9A3A4F194129F9589B290D671DC518BB0

Function 00DA6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00D21D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D21D73
Part of subcall function 00D21D35: GetStockObject.GDI32(00000011), ref: 00D21D87
Part of subcall function 00D21D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D21D91

GetWindowRect.USER32(00000000,?), ref: 00DA6EE0
GetSysColor.USER32(00000012), ref: 00DA6EFA

Strings

static, xrefs: 00DA6EBD

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: f4661766a28001005b435fe7b326bbbfff2a7b10bbfe789f1b31ef420f48d9a8
Instruction ID: 3c55051832a831bde142c8aad1fee78008f820a7c803666e4e2a78d66ba2450c
Opcode Fuzzy Hash: f4661766a28001005b435fe7b326bbbfff2a7b10bbfe789f1b31ef420f48d9a8
Instruction Fuzzy Hash: 32212976610209AFDB04DFB8DD45AEA7BB8FB09314F044629FA55D3250D634E8619B60

Function 00DA6B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00DA6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00DA6C20

Strings

edit, xrefs: 00DA6BF5

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: d62e61de7ad8bb4642b255663288fc61bc245e93ff119361c31acc2f81da95f7
Instruction ID: e16d19cfa2a5e050726ea9651e1ad6a4acfe6a547dbeebb8552cefe37147ed5f
Opcode Fuzzy Hash: d62e61de7ad8bb4642b255663288fc61bc245e93ff119361c31acc2f81da95f7
Instruction Fuzzy Hash: 48118C71500208EBEB109F64DC41AEB3B6AEB16378F284B24F9A1D71E0C775DC919B70

Function 00D82E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D82F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00D82F30

Strings

0, xrefs: 00D82F07

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: b45494ac3d363053d9f65f06423b2f396fa225adab8b931614bd398bed416f55
Instruction ID: b793a9437b1db0cdda40e11bf14dd39481216209607bce1275f256bbbebc2335
Opcode Fuzzy Hash: b45494ac3d363053d9f65f06423b2f396fa225adab8b931614bd398bed416f55
Instruction Fuzzy Hash: 79118E31901254ABDB21FB59DC44FB977B9EF15350F1800A6F994A72A0D7B0ED04C7B5

Function 00D924CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00D92520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00D92549

Strings

<local>, xrefs: 00D92511

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 9a77ee9ac2b2d30f3017c197d872c8fb72e0bb88e3f4ad2d66271b7369ce583b
Instruction ID: 2272f19998e332159cf443115eef6b11db2eac82ee6f4a4ab2d563ef69cd6a99
Opcode Fuzzy Hash: 9a77ee9ac2b2d30f3017c197d872c8fb72e0bb88e3f4ad2d66271b7369ce583b
Instruction Fuzzy Hash: CA11CEB0501225BEDF248F618C99EFBFFA8FF16761F11812AF94586140D270A985DAF0

Function 00D980A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00D980C8,?,00000000,?,?), ref: 00D98322

inet_addr.WS2_32(00000000), ref: 00D980CB
htons.WS2_32(00000000), ref: 00D98108

Strings

255.255.255.255, xrefs: 00D980E3

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 41d52ab90887139d30b080f44d36f23f8f6594e2c981241940166ff71de6155b
Instruction ID: 32610271aefd6587d6a54109ab1a0d3de630d95fd1cdef8fc350a4f5cd1c0bd5
Opcode Fuzzy Hash: 41d52ab90887139d30b080f44d36f23f8f6594e2c981241940166ff71de6155b
Instruction Fuzzy Hash: E811CE34600305ABCF20AFA4DC46FADB324EF05720F108526E915A7291DA32A81196B1

Function 00D792E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00D7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00D7B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00D79355

Strings

ComboBox, xrefs: 00D792F4
ListBox, xrefs: 00D7931F

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f87d223e9109d17e7eea7d1ae5d36efe977a8539b2fc4ba9974d1f02fe5dc0b9
Instruction ID: b4b6c1967748dae274bce608ef02c98bbcc6450ce430451a3d4d4c06af0e0b01
Opcode Fuzzy Hash: f87d223e9109d17e7eea7d1ae5d36efe977a8539b2fc4ba9974d1f02fe5dc0b9
Instruction Fuzzy Hash: 1E01F571A05224ABCB04EBA0DCA2CFEB369FF16320B14461AF976573D1EB31580C8770

Function 00D791DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00D7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00D7B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00D7924D

Strings

ComboBox, xrefs: 00D791EC
ListBox, xrefs: 00D79217

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: e0a3aad22f7b26906ac4735575b1220650e8e901857f6ef24711077f0a192496
Instruction ID: 1ed3ad212564306fd24f2bb5d84d24767d01e1b10abdd1db0033136d2c0889e0
Opcode Fuzzy Hash: e0a3aad22f7b26906ac4735575b1220650e8e901857f6ef24711077f0a192496
Instruction Fuzzy Hash: A101D871A451047BCB14F7A0D9A2EFFB3A8DF15310F144056B516632D2EA216E0C8271

Function 00D79264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D27F41: _memmove.LIBCMT ref: 00D27F82

Part of subcall function 00D7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00D7B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00D792D0

Strings

ComboBox, xrefs: 00D79271
ListBox, xrefs: 00D7929C

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f8ad74119894d4e799cf578574c4dd983371511025ee1493558aae295946cc37
Instruction ID: af070d7104d7f154d4eabe4420a901586f12fbc60348ca2d98839d535202b838
Opcode Fuzzy Hash: f8ad74119894d4e799cf578574c4dd983371511025ee1493558aae295946cc37
Instruction Fuzzy Hash: CB01A772A451147BCF14F7A0D9A2EFFB7ACDF11310F544116B916732C2EA215E0C9675

Function 00D851CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00D851E8
_wcscmp.LIBCMT ref: 00D851FA

Strings

#32770, xrefs: 00D851F4

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 52f3e9f510a5601ef2574099a3baf130276fc43017dcd50ee82d5fe969bd6bbf
Instruction ID: 16a443c1c4c8af3beec0323f2059d45e029b75a0839a5616dcc4dfa32db7397c
Opcode Fuzzy Hash: 52f3e9f510a5601ef2574099a3baf130276fc43017dcd50ee82d5fe969bd6bbf
Instruction Fuzzy Hash: 54E0613250032C1BD310A799AC45FA7FBACEB41731F000157FD50D3140D560990587F0

Function 00D781BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00D781CA

Part of subcall function 00D43598: _doexit.LIBCMT ref: 00D435A2

Strings

Error allocating memory., xrefs: 00D781C3
AutoIt, xrefs: 00D781BE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 70f3119d4d6d7296c86d841e0d82e8e4199e5999f61baff52fea0030193d0122
Instruction ID: ea089dbfad7236204c6093120ac16c5aba95e7115cd35edefc8d25ee9e2cfb94
Opcode Fuzzy Hash: 70f3119d4d6d7296c86d841e0d82e8e4199e5999f61baff52fea0030193d0122
Instruction Fuzzy Hash: 77D017362C532836D21432A96D0BBCAAA888B15B56F484026BB08956D38AD299C242B9

Function 00D5B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D5B564: _memset.LIBCMT ref: 00D5B571

Part of subcall function 00D40B84: InitializeCriticalSectionAndSpinCount.KERNEL32(00DE5158,00000000,00DE5144,00D5B540,?,?,?,00D2100A), ref: 00D40B89

IsDebuggerPresent.KERNEL32(?,?,?,00D2100A), ref: 00D5B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D2100A), ref: 00D5B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D5B54E

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: f58415777b6aed63425811147df0947e9a3a7342e7eda52279ef9e1ad08d3e1d
Instruction ID: 772a03f8c916597437ae9ecbbaf49ae228c77902d540f4159ccca8828e4fe516
Opcode Fuzzy Hash: f58415777b6aed63425811147df0947e9a3a7342e7eda52279ef9e1ad08d3e1d
Instruction Fuzzy Hash: B4E06D702003118FDB25DF68E5047427BE4EB00755F04896DE996C7361E7B4D408CB71

Function 00DA5BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DA5BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00DA5C08

Part of subcall function 00D854E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D8555E

Strings

Shell_TrayWnd, xrefs: 00DA5BEE

Memory Dump Source

Source File: 00000005.00000002.1283217070.0000000000D21000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000005.00000002.1283196136.0000000000D20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DD5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000DDF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E00000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283217070.0000000000E31000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283484401.0000000000E37000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1283502188.0000000000E50000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d20000_prgNb8YFEA.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 81b791cdebe14e57b15b2be01c22a1070461ba421941d04fedceddea583f0292
Instruction ID: d8ba5f90f47a73fc588089c4f2350b8d44f6e458928e7b3d9f7db8f385b6eb75
Opcode Fuzzy Hash: 81b791cdebe14e57b15b2be01c22a1070461ba421941d04fedceddea583f0292
Instruction Fuzzy Hash: 8CD0C931788311BAE764BBB4EC4BF976A54AB01B51F040865B655EA2D0D9E4A800C670

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report prgNb8YFEA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Milburr\brontothere.exe

C:\Users\user\AppData\Local\Temp\autBACB.tmp

C:\Users\user\AppData\Local\Temp\autBE75.tmp

C:\Users\user\AppData\Local\Temp\autEC6A.tmp

C:\Users\user\AppData\Local\Temp\nonplacental

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brontothere.vbs

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
prgNb8YFEA.exe

Function 00D23B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00D23633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Function 00D24AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00D24FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00E37080 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Function 00D893DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00D271EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00D23A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00D23778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre